PLEN

Tell us about your project

Privacy Policy

How we handle your personal data

This policy explains what personal data Windsor & Webb collects, why we collect it, how long we keep it and what rights you have. It applies to the website www.windsorandwebb.com and to the services we provide to clients.

Effective from 1 October 2026

Controller

The controller of your personal data is Christopher Closset, conducting business activity under the name Windsor & Webb, ul. Puszkina 33, 35-328 Rzeszów, NIP: 8133786044, REGON: 380758410, e-mail address: kontakt@windsorandwebb.com (“Windsor & Webb”, “we”, “us”).

For any questions about your personal data, write to kontakt@windsorandwebb.com or to our postal address above.

What data we collect

Data you give us. When you use the contact form, write to us or call us, or become a client, we collect details such as your name, business name, e-mail address, phone number, website address and the content of your message. For clients we also process contract, invoicing and payment details.

Data collected automatically. When you visit the website, we may collect your IP address, browser type and version, device type and operating system, approximate location, pages visited, date and time of visits and technical errors. Some of this is collected using cookies and similar technologies; see our Cookie Policy. We measure visits with Cloudflare Web Analytics, which does not use cookies or local storage and does not track users across websites.

Data in client projects. When we build, host or maintain a website for a client, we may have access to personal data of that client’s customers (for example contact form submissions or online store orders). We process such data only on the client’s documented instructions, as a processor, under a data processing agreement.

Purposes and legal bases

  • Replying to your enquiry and preparing a proposal — steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
  • Performing the agreed services, including hosting and support — performance of a contract (Art. 6(1)(b) GDPR).
  • Issuing invoices, keeping accounting records and meeting tax obligations — legal obligation (Art. 6(1)(c) GDPR).
  • Ensuring the security of the website, preventing abuse, analysing how the website is used and improving it — our legitimate interest (Art. 6(1)(f) GDPR).
  • Sending marketing information and using non-essential cookies — your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
  • Establishing, pursuing or defending legal claims — our legitimate interest (Art. 6(1)(f) GDPR).

Providing your data is voluntary, but without it we cannot reply to your message or provide our services.

Recipients of data

We do not sell personal data. We share it only where necessary with:

  • providers of IT services we use to run the business, such as hosting, e-mail, website analytics, accounting and payment services;
  • Cloudflare, Inc. — website hosting, delivery of contact form messages and protection of the form against spam and bots (Cloudflare Turnstile), which for this purpose analyses data such as your IP address and technical browser information;
  • specialists we work with on a client project, such as a photographer or copywriter, where this is part of the agreed work;
  • our accounting office and legal advisers;
  • public authorities, where required by law.

These recipients may process the data only for the purpose of providing services to us and are obliged to keep it secure.

Transfers outside the EEA

We aim to use providers that store data in the European Economic Area. Where a provider transfers data outside the EEA, the transfer is based on a European Commission adequacy decision or on Standard Contractual Clauses approved by the European Commission, together with any additional safeguards required.

How long we keep data

We keep personal data only as long as necessary for the purposes described above:

  • enquiries that do not lead to a project — for up to 12 months from our last contact;
  • client and contract data — for the duration of the cooperation and then until any claims become time-barred;
  • invoicing and accounting records — for the period required by Polish tax and accounting law (generally 5 years from the end of the calendar year in which the tax obligation arose);
  • data processed on the basis of consent — until consent is withdrawn.

Security

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including encrypted connections, access controls and regular software updates. If a personal data breach is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay and notify the supervisory authority where required.

Your rights

Under the GDPR you have the right to:

  • access your personal data and receive a copy of it;
  • rectify inaccurate data;
  • erase your data;
  • restrict processing;
  • data portability;
  • object to processing based on our legitimate interest, including direct marketing;
  • withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise these rights, write to kontakt@windsorandwebb.com. We will reply within one month of receiving your request; in complex cases this may be extended by a further two months, in which case we will let you know.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

Changes to this policy

We may update this policy to reflect changes in our services or the law. The current version is always available on the website. This policy is effective from 1 October 2026.