1. Controller
The controller of your personal data is FufuLabs sp. z o.o., ul. Henryka Sienkiewicza 85/87 lok. 1, 90-057 Łódź, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0001261715, tax identification number (NIP) 7252369926, statistical number (REGON) 545529715.
For any matter concerning personal data, write to [email protected]. We have not appointed a data protection officer because the scale of our processing does not require one; we handle requests ourselves.
2. What data we collect
The website has no user accounts and no signing in. Personal data reaches us in two ways:
- Through the project form. Three fields are required: project type (chosen from a list), project description and e-mail address. Optionally, you may state what already exists (chosen from a list), an approximate budget (chosen from a list), a deadline, a company name and a phone number. To the message delivered to our mailbox, the server adds the IP address the form was sent from, the time the submission arrived, the language of the form and the date by which we will reply.
- By e-mail, if you write to us directly at [email protected].
To limit the number of submissions, the server keeps the sender's IP address and e-mail address in memory for some time; section 4 describes the details. The server that serves the website also keeps its ordinary connection records: the IP address, the time, the address of the page requested and the name the browser gives for itself. We do not join them up with the data from the form.
3. Purposes and legal bases
We process data from the form and from correspondence in order to answer your enquiry, send a copy of the submission with our reply date to the address you provided, ask follow-up questions and prepare a proposal for scope, timing and price. The legal basis is Art. 6(1)(b) GDPR: steps taken at your request prior to entering into a contract and, once a contract is concluded, its performance. If you send us a project description as an employee or associate of a company and the contract is to be concluded with that company, we process your contact data under Art. 6(1)(f) GDPR; our legitimate interest is then corresponding and making arrangements with that company.
We process the IP address, the time of receipt, the submission-limit counters, the server records and the Turnstile check in order to protect the website and the mailbox against bots, bulk submissions and abuse, and for the establishment, exercise or defence of legal claims. The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in the security of the website and in defending against claims.
Providing data is voluntary. Without the three required fields, namely project type, description and e-mail address, the form will not accept the submission and we will have no way to reply. The remaining fields shorten our reply.
4. How long we keep data
We keep project descriptions and correspondence for 24 months from the last contact. If we conclude a contract, we keep the data for the duration of its performance and then for the limitation period for claims and for as long as tax and accounting laws require.
We delete the server records of connections after 30 days.
The submission limit operates solely in the working memory of the server process, with no database and nothing written to disk. The server keeps submission times there, assigned to the sender's IP address and to the e-mail address stored in lower case; only submissions from the last hour count towards the limit. Older entries stop counting but have no fixed deletion time: the server removes them at the next submission from the same address or while tidying up its memory, and all of them disappear when the server is restarted.
5. Who we entrust data to
We do not sell data and do not share it for marketing purposes. Only the companies that keep the website and the e-mail running have contact with the data:
- OVH: the e-mail provider that hosts the [email protected] mailbox. Messages from the form and the copies sent back to senders pass through its mail servers; those servers stand in the European Union.
- Cloudflare: the service that delivers the website quickly around the world and shields it from attacks, and the Turnstile mechanism, which checks on sending whether the form was filled in by a person's browser. Cloudflare sees the IP address and technical details of the connection, and when a submission is being checked our server passes it the one-time result of the check and the sender's IP address. Transfers of data outside the European Economic Area are safeguarded by standard contractual clauses approved by the European Commission.
- The company that rents us the server the website runs on: the application runs on its machines and the connection records are kept there. We do not keep the content of submissions on the server; we send it straight to the mailbox.
We may disclose data to public authorities where the law requires us to do so.
6. No profiling or automated decisions
We do not profile individuals and do not make decisions about them by automatic means alone. Turnstile assesses a single request for signs of automation, not a person; the result of that assessment is not kept together with the content of the submission. The server automatically rejects submissions over the limit and those Turnstile does not confirm. This is a technical safeguard with no legal effect on you: you can always send the same description as an ordinary e-mail to [email protected].
We do not measure visitor traffic and we place no advertising code on the website. Typefaces, styles and scripts all come from our own address; apart from Cloudflare, the website loads nothing from anyone else.
8. Your rights
With regard to the data we process, you have the right to:
- access your data and obtain a copy of it;
- rectification of your data;
- erasure of your data where it is no longer needed for the purpose for which it was collected;
- restriction of processing;
- portability of data processed under Art. 6(1)(b) GDPR;
- object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR.
It is enough to send your request to [email protected]; we reply within one month. If you believe that we process your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.
9. Changes and contact
This document applies from the version date shown in its header. We change it when the way we process data changes, for example when a new subcontractor is added; every change receives a new version date. For matters relating to this policy, write to [email protected]. This policy is published in Polish and in English; in the event of any discrepancy between the two, the Polish version prevails.