Privacy policy

The controller of your personal data is GFX3 Marcin Czerwik, ul. Baczyńskiego 14A lok. 14, 41-203 Sosnowiec, Poland, VAT ID (NIP) 6442887977.

For anything concerning personal data, write to websites@gfx3.pl. I answer personally – I have not appointed a data protection officer, because a one-person business is not required to.

You give it to me yourself, in one of two situations:

• Contact form – your name or company name, e-mail address, optionally a phone number, and the message itself.
• Project brief – company name, contact person, e-mail, optionally a phone number, plus your answers about the project: what you do, who your audience is, references, style, existing materials, scope and deadline. Optionally also any files you attach (logo, brand assets, inspiration).

The two forms differ in what happens after you hit send, and I would rather say it plainly:

• The contact form stores nothing on the server. The message goes straight to my mailbox. Your IP address and the time of sending are appended in the footer of that e-mail – as part of the form's spam protection.
• The brief is stored on the server – along with your answers and files, it records your IP address, the time of sending and the exact wording of the consent you ticked. That is the evidence of when, and to what precisely, you consented.

Both paths pass through a spam filter that uses no captcha and no third-party service. If the filter considers a submission automated, it holds it together with the IP address – so that I can recover a message caught by mistake. For how long, see below.

I do not ask for any special-category data and I ask that you do not put any in your message.

• Answering your contact-form message – art. 6(1)(b) GDPR. By sending an enquiry you are yourself asking me to take steps prior to a possible contract. I do not need your consent for this and I do not ask for it – there is no tickbox on the contact form.
• Preparing a proposal from a brief – here it is different: I need your consent, art. 6(1)(a) GDPR. You give it deliberately when submitting the brief, and I store its wording together with the submission.
• Concluding and performing a contract, should we decide to work together – art. 6(1)(b) GDPR.
• Retaining correspondence and defending against claims – my legitimate interest, art. 6(1)(f) GDPR. This basis matters: when you withdraw your consent for the brief, I stop processing the data for proposal purposes, but the correspondence itself may be retained to the extent necessary.
• Protecting the forms against spam – also my legitimate interest, art. 6(1)(f) GDPR.
• Accounting and tax obligations, if it comes to invoicing – art. 6(1)(c) GDPR.

Providing the data is voluntary, but without an e-mail address I have no way to reply, and without the answers in the brief I cannot prepare a design.

• Brief answers and attached files stored on the server – 90 days from submission, then deleted. This covers the answers as well as the files.
• Submissions held by the spam filter – 30 days, then deleted. Only messages the filter considered automated end up there.
• E-mail correspondence – 3 years from the last contact, on the basis of legitimate interest. That is the general limitation period for business-related claims under Polish law.
• Accounting records, if any arise – 5 years from the end of the tax year, as required by law.

I do not sell or share your data. I do use services without which the site and the mail would not work – these are processors acting on my instructions:

• Prociv Sp. z o.o. (the vh.pl service), ul. Czerniawska 2A/27, 50-576 Wrocław, Poland – maintenance of the server that runs the site and stores brief submissions.
• Vercom S.A. (the EmailLabs service) – sending e-mail from the forms.
• Google Ireland Limited (Google Workspace) – receiving and storing e-mail correspondence.
• Google Ireland Limited (Google Analytics) – visit statistics, only if you consent on the cookie bar. Without your consent the analytics script is not loaded at all, and when you do enable it, the IP address is anonymised.

Hosting and mail delivery run on servers within the European Economic Area. Google services may also process data outside the EEA – this happens on the basis of the European Commission's adequacy decision (the EU-U.S. Data Privacy Framework) and the standard contractual clauses approved by the Commission. I will provide a copy of those safeguards on request.

At any time you have the right to:

• access your data and obtain a copy of it,
• rectify inaccurate data or complete incomplete data,
• request erasure,
• request restriction of processing,
• port your data to another controller,
• object to processing based on legitimate interest – stating what in your particular situation speaks against it,
• withdraw your consent to the processing of brief data at any moment – one message is enough. Withdrawal does not affect the lawfulness of processing carried out beforehand.

If you only ever wrote to me through the contact form, there is no consent there to withdraw – in that case the right tool is an objection or a request for erasure.

You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa), if you believe I process your data unlawfully.

I do not make automated decisions about you and I do not profile you.

Cookies are described separately, together with the option to change your mind about analytics – see the cookie policy.