EN
Order a website

Privacy Policy

Who processes your data when you send the order form or request a call, why and for how long, what rights you have – and what this website stores in your browser.

Last updated:

This is an English translation of the Polish Privacy Policy (Polityka prywatności), provided for convenience. In the event of any discrepancy between the two versions, the Polish version is legally binding.

§ 1. Data controller

  1. The controller of your personal data is [UZUPEŁNIJ – pełna nazwa firmy] (trading as Webbuy), [ADRES], tax ID (NIP) [NIP] (“we”).
  2. You can contact us about anything relating to personal data:
  1. This policy applies to data processed in connection with using the website webbuy.pl, sending the order form or the call form, and contacting us by e-mail or by phone.
  2. “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

§ 2. What data we collect

  1. Order form: first name (and surname, if you provide it), e-mail address, phone number, preferred contact method, company name, industry, city, current website address, information about your domain and hosting, the selected package and modules, a description of your needs, example websites, colors, uploaded files, expected start date and budget, and your notes.
  2. Call form: first name, phone number or e-mail address, a convenient time for the call and – if you add one – a message.
  3. Correspondence: the data you provide in e-mails and during conversations, e.g. when agreeing on an offer and performing a contract.
  4. Technical data of a request: the date and time it was sent, the date on which you confirmed you had read this policy, the language of the page the form was sent from, and a hash of your IP address. We do not store the IP address itself – we keep only its one-way hash, solely to protect the forms against spam and abuse.
  5. The hosting provider may keep standard server logs (e.g. IP address, date and time, address of the page opened, browser type) to ensure the security and operation of its service.
  • Responding to your request, the call and preparing an offer – Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract); if you act on behalf of a company – Article 6(1)(f) GDPR, i.e. our legitimate interest in contacting a person who represents a potential client.
  • Concluding and performing the contract (project, deployment, subscription) – Article 6(1)(b) GDPR and, for contact persons of a client that is a company, Article 6(1)(f) GDPR.
  • Invoices, settlements and tax obligations – Article 6(1)(c) GDPR in conjunction with tax and accounting laws.
  • Protecting the forms against spam and abuse, website security – Article 6(1)(f) GDPR.
  • Establishing, exercising and defending legal claims – Article 6(1)(f) GDPR.

The checkbox you tick in the form confirms that you are aware of the rules described in this policy and want us to contact you. The legal basis for processing is then Article 6(1)(b) or (f) GDPR, not consent.

§ 4. How long we keep data

  • Requests that did not lead to a contract – for [UZUPEŁNIJ – okres, np. 12 miesięcy od ostatniego kontaktu], unless you ask us to delete them sooner.
  • Data related to a contract – for as long as the contract is being performed, and then until the limitation period for claims expires (Article 118 of the Polish Civil Code).
  • Accounting documents – for the period required by tax law, as a rule 5 years from the end of the calendar year in which the tax payment deadline expired.
  • IP address hash – together with the request it relates to. Records used only to limit the number of requests are deleted automatically once they are no longer needed.
  • Data processed on the basis of our legitimate interest – until you raise an effective objection.

§ 5. Who we share data with

  1. We share data only with entities that help us run the website and the business, and only to the extent necessary:
  • the hosting provider – OVH, on whose servers the website, the request database and the files uploaded through the form are hosted,
  • the e-mail provider through which we send and receive e-mails – [UZUPEŁNIJ – nazwa dostawcy, jeśli inny niż OVH],
  • [UZUPEŁNIJ – biuro rachunkowe, jeśli dotyczy],
  • entities authorized under the law, when they request it in accordance with the law.
  1. Service providers process data on our behalf under data processing agreements (Article 28 GDPR).
  2. Push notifications in our admin panel let us know about new requests. Their content is encrypted on our server and decrypted only on our device, so the notification services of browser vendors (e.g. Google, Apple, Mozilla) deliver them without access to their content.
  3. Transfers of data outside the European Economic Area: [UZUPEŁNIJ – jeśli dotyczy: odbiorca, kraj i podstawa przekazania, np. decyzja Komisji Europejskiej stwierdzająca odpowiedni stopień ochrony albo standardowe klauzule umowne].
  4. We do not sell data or share it with anyone for marketing purposes.

§ 6. Your rights

You have the right to:

  • access your data and receive a copy of it (Article 15 GDPR),
  • have your data rectified (Article 16 GDPR),
  • have your data erased (Article 17 GDPR),
  • restrict processing (Article 18 GDPR),
  • receive the data we process by automated means on the basis of a contract and transfer it to another controller (data portability, Article 20 GDPR),
  • object to processing based on our legitimate interest (Article 21 GDPR),
  • lodge a complaint with the President of the Polish Data Protection Authority (UODO), ul. Stawki 2, 00-193 Warszawa, Poland, if you believe we are processing your data unlawfully (Article 77 GDPR).

To exercise your rights, write to kontakt@webbuy.pl. We will respond without undue delay and in any event within one month; in exceptional cases, this period may be extended by two further months, in which case we will let you know (Article 12(3) GDPR). At your request, we delete your request from the panel together with the uploaded files – except for data we are legally required to keep, e.g. invoices.

§ 7. Do you have to provide your data?

Providing data is voluntary. However, without the data marked as required in the form, we will not be able to respond to your request or prepare an offer, and without the data needed for a contract, we will not be able to conclude and perform it. Providing data for invoicing is a statutory requirement.

§ 8. Automated decision-making and profiling

We do not make decisions about you based solely on automated processing of data, including profiling (Article 22 GDPR). The amount calculated in the order form is an estimate based on the price list – whether to accept an order is always decided by a person, after talking to you.

§ 9. Files uploaded through the form

  1. Files attached to the order form (up to 5 JPG, PNG, WebP, SVG or PDF files, each up to 10 MB) are stored on the server in a directory that cannot be accessed from the internet, under randomly assigned names. Only logged-in members of our team have access to them.
  2. We keep them for as long as the request they relate to and delete them together with it.
  3. Please do not include other people’s data or documents containing special categories of data (e.g. health information) in your files – we do not need them to build a website.

§ 10. Cookies and browser storage

  1. The website webbuy.pl does not use cookies for tracking, analytics or advertising, and does not load scripts, fonts or maps from external services. We do not set any cookies for visitors to the website.
  2. We store a few settings in your browser’s storage (localStorage). These entries are not sent to our server and are not used to identify you:
  • the selected theme (light or dark),
  • the selected site language,
  • your choice in the cookie notice,
  • the order form draft (without files) – so you don’t lose what you have entered if you refresh the page; the draft is removed once the form is sent, and you can delete it earlier with the “Clear” button.
  1. Storage that is necessary for features you use yourself does not require consent (Polish Electronic Communications Law of 12 July 2024). You can delete these entries at any time in your browser settings – the website will keep working and will simply return to its default settings.
  2. The admin panel used by our team uses a single session cookie – only for logged-in users, to keep them logged in and to protect the panel against unauthorized actions. Visitors to the website do not receive it.
  3. On project pages, you can open a preview of our client’s website. It loads only after you click – in a frame on our website or in a new tab – and is governed by its own privacy policy, so it may use its own cookies.

§ 11. How we protect data

  • the connection to the website is encrypted (HTTPS),
  • files from the form are stored outside the public part of the server, under random names,
  • instead of the IP address, we store only its hash,
  • we protect the forms against spam without external services and without reCAPTCHA – using a honeypot field and a request limit,
  • only authorized persons have access to the panel; login attempts are limited, passwords are stored in hashed form, and the panel’s forms are protected against CSRF attacks,
  • data is visible only to the people who need it to handle your request.

§ 12. Changes to this policy

We update this policy when the law, our services or the way the website works change. The current version, with the date of its last update, is always available on this page.

Questions about this document? Write to us: kontakt@webbuy.pl

Privacy settings

No ads, no analytics, no third-party scripts. We only keep what the site needs to work, in your browser’s storage.

Details in our privacy policy