This is an English translation provided for convenience. The Polish version (Polityka prywatności) is the binding one; in case of any discrepancy the Polish version prevails.
This policy explains what personal data we collect on the website, for what purpose, on what legal basis and what rights you have. We apply it in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR, in Polish: RODO) and the Act of 10 May 2018 on the Protection of Personal Data (ustawa o ochronie danych osobowych).
1. Data controller
The controller of your personal data is Dawid Maciaszek, a natural person who runs the website and offers services under the KCD Studio brand (hereinafter: the “Controller”, “we”). Agreements for carrying out projects are concluded and settled through the useme.com platform, operated by Useme sp. z o.o., registered in Wrocław, which issues the VAT invoice to the client.
Contact on personal data matters: kontakt@kcdstudio.com or by post at: Dawid Maciaszek, ul. Synów Pułku 12/82, 01-354 Warszawa.
2. What data we process and why
a) Contact form and e-mail correspondence. When you send an enquiry, we process the data you provide: first and last name, e-mail address, company name (if you give it), the topic you choose and the content of the message, and in e-mail correspondence also the data in the signature and attachments. We do this in order to:
- reply to the enquiry, prepare a quotation and agree the terms of any cooperation. If you are asking on your own behalf (as a private person, sole trader or freelancer), the basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). If you are writing as an employee, associate or representative of a company or other organisation, the basis is Art. 6(1)(f) GDPR - our legitimate interest is then replying to that organisation’s enquiry and preparing an offer for it;
- where applicable, establish, pursue or defend against claims - Art. 6(1)(f) GDPR (interest: protecting our rights).
Form on a partner’s website. You can also send us enquiries about websites through the form on the “Strony WWW” (websites) subpage of the surkomp.pl website, run by our partner. Data from this form comes directly to us (to the server serving kcdstudio.com) and we are its controller - we process it for the same purposes, on the same bases and through the same providers (including Cloudflare Turnstile and Brevo) as data from the form on our website. The operator of surkomp.pl does not receive this data.
b) Technical data. When you use the website, the hosting servers automatically record technical data (including IP address, date and time of the request, browser type). We process it to ensure the operation and security of the website, including protection against attacks - Art. 6(1)(f) GDPR. On this basis Cloudflare provides us only with aggregate, anonymous traffic statistics (e.g. the daily number of visits, page views and blocked attacks), which do not allow anyone to be identified and do not use cookies. We use them to monitor the operation, performance and security of the website.
c) Protecting the form against spam (Cloudflare Turnstile). When you start filling in the form, we load the Cloudflare Turnstile service, which checks whether the form is being filled in by a human and not by an automated tool. Turnstile analyses, among other things, the IP address and technical signals from the browser; it does not require solving puzzles and is not used for tracking or advertising. The basis is our legitimate interest in protecting the website and the mailbox against spam and abuse (Art. 6(1)(f) GDPR).
d) Statistics and advertising - only with your consent. If in the cookie window you consent to the “Statistics” category, we will run Google Analytics (via Google Tag Manager) and Microsoft Clarity to learn how the website is used (e.g. pages visited, source of the visit, approximate location, device type, buttons and links clicked, sections viewed and scroll depth, page load time). From this data Microsoft Clarity also creates recordings of the visit (clicks, mouse movements, scrolling) and heatmaps; text typed into the form is hidden in them and does not reach Microsoft. If you consent to the “Marketing” category, we will run Google Ads to measure the effectiveness of our ads (e.g. whether a form was sent after an ad was clicked) and to reach people who have visited the website with ads (remarketing). The basis is your consent (Art. 6(1)(a) GDPR); you can change or withdraw your consent at any time (section 7). We do not pass the form content, first name, last name or e-mail address to Google and Microsoft tools - we pass only the information that the form was started or sent, the topic and package chosen, and, in the event of an error, its type and the names of the incorrectly filled fields (without their content). Without consent, Google and Microsoft scripts are not loaded at all.
Internal statistics panel. We review the results from the tools described in points b) and d), and data on the website’s visibility in search engines (Google Search Console, Bing Webmaster Tools), in an internal panel accessible only to the Controller and protected by two-factor login. The panel pulls from these tools only aggregate data (e.g. the number of visits, page views, ad impressions and clicks, the number of enquiries sent without their content, breakdown by country, city or device type) - it does not contain IP addresses, cookie identifiers, visit recordings or other data that would allow a visitor to be identified. Statistics from Google Analytics, Microsoft Clarity and Google Ads concern only people who have consented to them. We check the availability of the website with automated requests from our server, which do not concern visitors.
e) Cooperation and settlement through Useme. If you decide to cooperate, the agreement will be concluded and the VAT invoice issued through the useme.com platform, operated by Useme sp. z o.o. registered in Wrocław (KRS 0000467478, National Court Register number). For this purpose we will pass to Useme, or you will provide directly on that platform, the data needed to conclude the agreement and issue the invoice (e.g. first and last name or company name, NIP (tax ID), address, e-mail address, scope and price of the order). The basis for passing it is Art. 6(1)(b) GDPR when you order on your own behalf, or Art. 6(1)(f) GDPR when you act on behalf of the ordering company (interest: concluding and settling the order). Useme processes this data as a separate controller, on the terms described in its privacy policy and rules, available at useme.com. Separately from that, we process your contact data and correspondence about the project (arrangements, delivery and acceptance of work, corrections, support) in order to perform the ordered work - on the basis of Art. 6(1)(b) GDPR when you are a party to the agreement on your own behalf, or Art. 6(1)(f) GDPR when you represent the client (interest: proper performance of the project and contact with the client).
f) Contact person data received from the client. If we carry out a project for your employer or principal, or someone named you in an enquiry as a contact person, we may receive your business data from them (first and last name, position, business e-mail address and phone number). The source of this data is your employer, principal or the person who sent the enquiry. We process it to keep in touch about the enquiry or project, and after it ends - to establish, pursue or defend against claims; the basis is Art. 6(1)(f) GDPR (interest: smooth cooperation with the client and protection against claims). You can object to this processing (section 6). The remaining information in this policy applies accordingly.
g) Complaints. If you submit a complaint (§ 7 of the Terms), we process the data given in the complaint and in correspondence to consider it and reply - on the basis of Art. 6(1)(b) GDPR when it concerns services provided on the website, or Art. 6(1)(f) GDPR when it concerns a project (interest: handling complaints). We document the course of the review on the basis of Art. 6(1)(f) GDPR (interest: demonstrating that the complaint was considered and defending against claims).
Providing data is voluntary, but without a first and last name, e-mail address and the content of the message we cannot accept the enquiry or reply to it. Company name and topic are optional.
Please do not send special categories of data (e.g. health data), passwords and access credentials to systems, or data of third parties that is not needed to prepare a quotation, in the form or by e-mail.
3. Recipients of data
We do not sell data. Data may be received by:
- entities that process data on our behalf and on our instructions (processors):
- Cloudflare, Inc. (USA) - website hosting, CDN network, protection against attacks, form handling and Cloudflare Turnstile anti-spam protection;
- Sendinblue SAS (Brevo) (France) - sending messages from the form to our mailbox;
- OVH SAS (OVHcloud) (France) - the kontakt@kcdstudio.com mailbox in which we receive enquiries and keep correspondence;
- only after you consent in the cookie window - Google Ireland Limited (Ireland) and Google LLC (USA): for Google Analytics under the Google data processing terms, and for Google Ads (conversion measurement and remarketing) as a separate controller under the Google Ads data protection terms; details: Google Privacy Policy and Google information for partners;
- only after you consent to the “Statistics” category - Microsoft Corporation (USA) and its affiliates: for Microsoft Clarity (statistics, visit recordings, heatmaps) under the Microsoft Clarity terms of use; details: Microsoft privacy statement;
- if cooperation takes place - Useme sp. z o.o., registered in Wrocław (useme.com), the operator of the platform through which the agreement is concluded and the VAT invoice is issued to the client; it processes data as a separate controller;
- where necessary to establish or pursue claims or defend against them - a lawyer (adwokat or radca prawny) who provides us with legal assistance, as a separate controller bound by professional secrecy;
- public authorities - where required by law.
We may receive a short notification in a messenger (e.g. Telegram or Discord) about a new enquiry. Such a notification contains only the information that there is a new enquiry and the topic chosen from the list of services - without a first name, e-mail address, company name or message content - so the operators of those messengers do not receive your data.
4. Transfers of data outside the EEA
Some of our providers (Cloudflare, Inc., and after you consent also Google LLC and Microsoft Corporation) are based in the USA or may process data outside the European Economic Area. We transfer data to the USA on the basis of a European Commission decision finding an adequate level of protection (Commission Implementing Decision (EU) 2023/1795 - EU-US Data Privacy Framework), if the provider is certified under that framework. In other cases the basis is the standard contractual clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914), included in our agreements with providers. You can obtain information about the safeguards applied and a copy of them by writing to kontakt@kcdstudio.com.
5. How long we keep data
- correspondence and requests for quotations - for the time needed to handle the enquiry, and then up to 12 months from the last contact, unless an agreement is concluded;
- if cooperation takes place - for the duration of the order and until the limitation period for claims expires; settlement documents (agreements, invoices) are kept by Useme in accordance with tax regulations;
- complaints - for the time they are being considered, and then until the limitation period for related claims expires;
- data processed with consent (Google Analytics, Microsoft Clarity, Google Ads) - until consent is withdrawn, but no longer than the retention period set in those tools (for Google Analytics - a maximum of 14 months; in Microsoft Clarity recordings - 30 days, and heatmaps and selected recordings - up to 13 months) and the cookie validity period given in section 7;
- technical data (logs) - for the short period needed to ensure the operation and security of the website; logs are recorded automatically by the hosting provider (Cloudflare) and deleted in a cycle resulting from the settings of its services. We do not create separate registers of IP addresses ourselves.
6. Your rights
You have the right to:
- access your data and receive a copy of it,
- rectification (correction) of data,
- erasure of data - in the cases set out in Art. 17 GDPR (we may refuse erasure, for example, of data needed to establish, pursue or defend against claims),
- restriction of processing,
- data portability - for data processed on the basis of Art. 6(1)(b) GDPR or consent,
- withdraw consent at any time - without affecting the lawfulness of processing carried out before its withdrawal (you can change your cookie consent in “Cookie settings” in the footer of the page),
- lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO) (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).
Right to object. At any time you can object - on grounds relating to your particular situation - to the processing of your data based on our legitimate interest (Art. 6(1)(f) GDPR). We will then stop processing the data for that purpose, unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or grounds for the establishment, pursuit or defence of claims. Send your objection to kontakt@kcdstudio.com.
To exercise your rights, write to kontakt@kcdstudio.com.
We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. If you consent to the “Marketing” category, Google may, on the basis of your activity on the website, tailor the ads shown to you (profiling for advertising purposes) - you can prevent this by not giving consent or by withdrawing it.
7. Cookies and similar technologies
Cookies are small files saved in your browser. On your first visit we show a window in which you decide about cookies. The “Reject all” button is in that window straight away, next to “Accept all” and the same size, and refusing does not restrict access to the website. You can change your decision at any time in “Cookie settings” (the link in the footer and the cookie icon in the corner of the screen). Until you give consent, your browser does not connect to Google servers (Google Consent Mode v2 in “denied” mode as the default setting).
Necessary - do not require consent because they are needed to provide the service you are using (Art. 399(3) of the Act of 12 July 2024 - Electronic Communications Law (Prawo komunikacji elektronicznej)):
cc_cookie- remembers your cookie decision; validity: 6 months;- Cloudflare technical files (e.g.
__cf_bm,cf_clearance,_cfuvid) and Cloudflare Turnstile mechanisms - protecting the website and the form against attacks and bots; validity: from session length to a few hours, depending on the protection features enabled (Cloudflare description).
Statistics - only with consent:
_ga,_ga_*(Google Analytics) - distinguishing visitors and sessions for statistics; validity: up to 2 years;_clck,_clsk(Microsoft Clarity) - recognising the visitor and linking page views into one session; validity:_clckup to a year,_clsk1 day. Clarity may also set files on Microsoft domains (CLID,MUID,ANONCHK,MR,SM) - in line with the Microsoft description.
Marketing - only with consent:
_gcl_*,_gac_*(Google Ads) and Google files on Google domains (e.g. doubleclick.net) - measuring conversions from ads and remarketing; validity: usually up to 90 days, for files on Google domains in line with Google’s information on cookies.
After you withdraw consent, we delete the cookies of that category from the website’s domain, and Google and Microsoft scripts stop working. Our code does not store other data in the browser’s memory (localStorage, sessionStorage). The website’s fonts and scripts are loaded from the same domain, not from external services (e.g. Google Fonts). You can also delete or block cookies in your browser settings; blocking necessary files may make it harder to use the form.
8. Changes to the policy
We may update this policy, e.g. when the law or the way the website works changes. The current version is always available on this page, and the date of the last change is shown at the top.