1. Data controller
The personal data controller is ASURUM sp. z o.o., ul. Aleja Jana Pawła II 43A/37B, 01-001 Warsaw, Poland, email: [email protected].
2. Data and source
For enquiries we process name, phone number, optional email, selected service, message and confirmation of the mandatory privacy notice. We do not request sensitive data. The server may process standard technical logs briefly where necessary for security and maintenance.
3. Purposes and legal bases
- handling an enquiry and steps before a contract: Article 6(1)(b) GDPR;
- correspondence, website security and legal claims: legitimate interests, Article 6(1)(f) GDPR;
- analytics and marketing measurement: only with consent, Article 6(1)(a) GDPR and applicable device-storage rules.
4. Form, Telegram and spam protection
After successful submission, the enquiry is stored in the database and forwarded to a designated Telegram chat. The Telegram message contains only the submitted contact details, selected service and message. It does not include IP address, page URL, traffic source, UTM data, browser details or other technical metadata.
The form uses Cloudflare Turnstile, a honeypot, minimum-time checks, rate limiting, CSRF protection, validation and duplicate detection. Cloudflare processing may involve transfers outside the EEA under safeguards recognized by the GDPR.
5. Recipients and transfers
Data may be provided to hosting and IT providers, Cloudflare and Telegram only as necessary for handling the enquiry and security. Google Analytics, Google Tag Manager and Meta Pixel are enabled only after the relevant consent. We do not sell personal data.
6. Retention
Enquiries are retained for the time needed to handle them, maintain correspondence and protect possible legal claims, after which they are deleted or anonymized. The current cookie choice is stored locally in a necessary cookie for up to 12 months and can be changed or withdrawn at any time. Technical logs are limited to the period necessary for security.
7. Rights
You may request access, correction, deletion, restriction, portability, object to processing and withdraw consent without affecting prior lawful processing. You may complain to the President of the Polish Personal Data Protection Office.
8. Voluntary provision and changes
Providing data is voluntary, but name, phone, message and acceptance of the notice are required to use the form. This policy may be updated when website functions or providers change.