Privacy policy

Controller

The controller is Prownex IT Services Sp. z o. o., ul. Łąkowa 8, 37-300 Leżajsk, Poland. All company details are in the legal notice. Please send questions about data protection to Email or to the address above.

Inquiries through the form, by email or by telephone

We process your name, your email address, the topic and your message and, if you give them, your company and telephone number. The message from the form also contains the language, the address of the page and the time. The form sends the inquiry to us by email and a confirmation with a copy to the address you entered.

Server logs

When you use the website, the server stores technical data of the connection: IP address, date and time, requested address (URL), response code and amount of data transferred and, depending on the browser, the referring page (referrer) and the browser identifier (user agent). We process this data to run the website, analyse errors and protect it.

For the form, the application logs whether a submission was accepted or rejected, with the technical reason. If an email cannot be sent, the log contains the mail server's error message, which may include the target address.

Protecting the form against spam

We protect the form with our own methods, without third-party services. Suspicious submissions may be rejected automatically. To limit the number of submissions per connection, we temporarily keep a hash (HMAC) of your IP address in the server's cache.

Statistics

To analyse how the website is used and to improve it, we use our own statistics tool on our server. It records the pages viewed, where visits come from, campaign details in the address (utm parameters), the approximate screen size, the time of use and the type of browser, operating system and device.

To count visits, the tool forms a hash of IP address and browser identifier with a key that changes every day. It does not store the IP address itself. It sets no cookies, does not use your browser's storage and passes no data to third parties. Visits for which your browser sends the "Do Not Track" signal are not counted.

Purposes and legal bases

• Answering inquiries and preparing offers: Art. 6(1)(b) GDPR where the processing is necessary for steps prior to a contract at your request. In other cases, in particular business contacts about contracts with other companies, Art. 6(1)(f) GDPR; our legitimate interest is handling inquiries and business communication.
• Business correspondence: Art. 6(1)(f) GDPR; our legitimate interest is conducting and documenting communication about our business.
• Concluding and performing a contract: Art. 6(1)(b) GDPR where you are a party to the contract and the processing is necessary for it.
• Security and operation of the website, protection of the form: Art. 6(1)(f) GDPR; our legitimate interest is a secure and stable website.
• Establishing, exercising or defending legal claims: Art. 6(1)(f) GDPR; our legitimate interest is protecting our rights.
• Complying with legal obligations: Art. 6(1)(c) GDPR, where laws require the processing.
• Statistics: Art. 6(1)(f) GDPR; our legitimate interest is analysing how the website is used and improving it.

Where we rely on a legitimate interest, we weigh it against your rights and freedoms.

Recipients

The hosting provider of our server processes data on our behalf (Art. 28 GDPR). We run our email system ourselves. Lawyers and tax advisers receive data where needed in an individual case, authorities where there is a legal obligation.

Transfers outside the EEA

We do not transfer personal data to countries outside the European Economic Area (EEA).

Retention

• Inquiries and correspondence: until the matter is closed, then as long as we need the record to prove the course of contact or to defend claims.
• Server and application logs: up to 12 months.
• Data of the form protection: up to 1 day.
• Statistics, including the hashes of visits: up to 12 months.

After that we delete the data.

Cookies and local storage

The website uses only what functions you use yourself need:

• CRAFT_CSRF_TOKEN (cookie): protects the form against requests made in your name by other sites; only on pages with the form, until the end of the browser session.
• CraftSessionId (cookie): shows the confirmation of your inquiry once after sending; until the end of the browser session.
• px-tone (local storage): your choice between light and dark appearance, if you use the switch; until you delete it.

The necessary entries fall under the exemption for technically required operations (Art. 5(3) of Directive 2002/58/EC; Germany: § 25(2) no. 2 TDDDG, Austria: § 165(3) TKG 2021, Poland: Art. 399 PKE). We use no cookies for advertising or tracking across websites.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).

Right to object: you can object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR).

Write to Email. We answer as a rule within one month.

Complaint to a supervisory authority

You can lodge a complaint with a supervisory authority (Art. 77 GDPR). Our competent authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO) in Warsaw, uodo.gov.pl. You can also turn to the supervisory authority at your habitual residence, your place of work or the place of the alleged infringement.

Obligation to provide data and automated decisions

Providing your data is voluntary. Without name, email address, topic and message we cannot handle an inquiry through the form. We make no automated decisions within the meaning of Art. 22 GDPR.