Privacy and cookies

1. Data controller and contact details

The controller of your personal data is KONOTOP-BUD VIKTOR KONOTOPCHYK, Polish tax identification number (NIP) 1231535523. For questions about your data or to exercise your rights, email kontakt@konotop-bud.eu or call 724 744 444. The full correspondence address is provided in the company details.

2. Enquiries and the email template

The estimate template runs in your browser. Text entered in the template window is not sent to KONOTOP-BUD or saved in a website database. It remains in the memory of the open tab; closing the template window alone does not delete it, but reloading or leaving the page may do so. The website does not save this draft in cookies or browser local storage.

The ‘Open in email app’ button passes the text to your chosen email application, ‘Copy text’ places it on your device’s clipboard, and ‘Download TXT’ creates a local file. After these actions, the data is also subject to the settings of your device and chosen email service. I receive the message and attachments only after you send them.

Correspondence may contain your name, email address, optional telephone number, project location and description, dimensions, photographs and design plans. Providing data is voluntary, but without a reply address and a description of your enquiry, I may be unable to respond or prepare an estimate. A town or district is sufficient for an initial enquiry; do not send your PESEL number, identity document or information unrelated to the work. Before sending photographs, remove unnecessary data and images of people.

3. Purposes and legal bases for processing

• Preparing an estimate and taking steps at your request before entering into a contract, then performing the contract — Article 6(1)(b) GDPR.
• Responding to general correspondence, contacting a customer’s representative, maintaining website security, and establishing, exercising or defending legal claims — Article 6(1)(f) GDPR. The legitimate interest is the efficient handling of correspondence and the protection of the business and website.
• Complying with legal obligations relating to matters such as tax accounting and customers’ statutory rights — Article 6(1)(c) GDPR.
• Basic visitor statistics supplied by the hosting provider are used to assess website performance — Article 6(1)(f) GDPR, based on the legitimate interest in maintaining and improving the website. The website does not carry out advertising profiling or automated decision-making that produces legal effects. Sending an enquiry does not subscribe you to a newsletter or marketing communications.

4. Hosting, logs and statistics

The website runs on ChatGPT Sites (OpenAI), which uses Cloudflare infrastructure. Infrastructure providers process the technical data needed to deliver and protect the website, such as IP addresses, request times, the addresses of pages visited, and browser and device information. The platform also provides statistics on page views and unique visits.

The website’s own code does not contain Google Analytics, advertising pixels, embedded maps or social media widgets. Fonts and photographs are loaded from the website’s domain. The Oferteo link opens a separate service whose privacy rules apply once you visit it.

5. Cookies and device storage

The current configuration uses essential infrastructure security measures. Cloudflare sets the __cf_bm cookie to distinguish automated traffic from legitimate visits. According to the provider’s documentation, it expires after 30 minutes of continuous inactivity. We do not use it for advertising or cross-site tracking.

Essential mechanisms used to deliver and protect the requested website do not require consent under Article 399(3) of the Polish Electronic Communications Law. We do not enable optional advertising or analytics cookies. Built-in hosting statistics are described separately above; this does not mean that no technical data is processed.

You select a language through the page address, without a preference being saved in cookies. You can delete or block cookies in your browser; blocking essential security measures may make access more difficult. If technologies requiring consent are introduced, they should be activated only after consent has been obtained.

6. Data recipients and transfers outside the EEA

To the extent necessary, data may be received by hosting and security providers (OpenAI and its subprocessors, including Cloudflare), the business email provider Interia (Interia.pl sp. z o.o.), and, when performing contracts and meeting business obligations, accounting and legal service providers and authorised public bodies. People assisting with the work receive only the information needed for the agreed task.

The Sites data processing agreement identifies OpenAI as the processor and, for customers in the EEA, OpenAI Ireland Ltd. The infrastructure may process data outside the EEA. The Sites agreement provides for transfer safeguards through an adequacy decision or standard contractual clauses. Information about the safeguards and a copy of the safeguards applied can be obtained from the controller using the contact details provided and in the provider’s documentation.

7. How long we retain data

We retain enquiries that do not result in a contract, together with their attachments, for up to 12 months after the last contact about that enquiry, and then delete them. If a contract is concluded, or specific data must be retained to handle claims or comply with legal obligations, the relevant periods described below apply. This concerns only the data needed for that purpose, not automatically all correspondence.

Tax documents are generally retained for 5 years from the end of the calendar year in which the tax payment deadline fell, unless the law requires a longer period. Contract, guarantee or dispute records are retained for as long as necessary to deal with the relevant rights and claims.

Technical data is subject to the hosting provider’s retention cycles for website operation, security and statistics. These retention periods are not the same as a cookie’s lifetime. You can contact the controller for information about data associated with your visit. The lifetime of the identified cookie is given in section 5.

8. Your rights

Under the conditions set out in the GDPR, you may request access to your data and a copy of it, rectification, erasure or restriction of processing. The right to data portability applies to data processed by automated means on the basis of a contract or consent.

You may object, on grounds relating to your particular situation, to processing based on a legitimate interest, including statistics. We will then assess whether there are overriding legitimate grounds for continuing the processing. If you give consent in a separate situation, you may withdraw it without affecting the lawfulness of earlier processing.

You can send a request to kontakt@konotop-bud.eu. We generally respond within one month; in cases provided for by the GDPR, this period may be extended with an explanation of the reason. You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).