This policy describes how personal data of visitors to koritsu.io and users of the contact form is processed.
1. Data controller
The controller of personal data is KORITSU sp. z o.o., with its registered office in Lublin, Poland (ul. Marii Curie-Skłodowskiej 3 lok. 27, 20-027 Lublin), tax ID (NIP) 7123498030, REGON 54245687800000 (hereinafter: "Koritsu").
Matters concerning personal data may be addressed to [email protected].
2. Scope of data processed
When the contact form is submitted, the data provided by the sender is processed:
- full name,
- email address,
- company name,
- the content of the message.
Providing the data is voluntary. Without a full name, an email address and the content of the message, a reply to the enquiry is not possible. The company name is optional. Senders are asked not to include special categories of data or data that is not needed to answer the enquiry.
The server on which the website runs may automatically record in technical logs the IP address, the date and time of the request and information about the browser. This data serves solely to ensure the security and proper functioning of the website. To protect the form against abuse, the number of submissions from a single IP address is limited.
3. Purposes and legal bases of processing
Data from the form is processed for the following purposes:
- Replying to the enquiry and conducting correspondence. The basis is the legitimate interest of the controller in communicating with persons who contact Koritsu (Art. 6(1)(f) GDPR). Where the enquiry concerns the conclusion of a contract, the basis is taking steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR).
- Preparing an offer and carrying out cooperation. The basis is Art. 6(1)(b) GDPR.
- Establishing, pursuing or defending legal claims. The basis is the legitimate interest of the controller (Art. 6(1)(f) GDPR).
- Ensuring the security of the website and protection against abuse. The basis is the legitimate interest of the controller (Art. 6(1)(f) GDPR).
Data is not used for automated decision-making or for profiling.
4. Recipients of data
Data may be transferred to entities that provide technical services to Koritsu and act on its instructions:
- providers of the hosting services on which the website runs,
- Amazon Web Services EMEA SARL (Amazon SES), which handles the delivery of messages from the form, using infrastructure in an EU region [region to be confirmed],
- providers of email and IT services used to handle correspondence.
Data may be disclosed to public authorities where such an obligation arises from the law. Data is not sold and is not passed to third parties for marketing purposes.
Where a provider processes data outside the European Economic Area, this takes place solely on the basis of the mechanisms provided for in the GDPR, in particular an adequacy decision or standard contractual clauses.
5. Data retention period
- Correspondence that does not lead to cooperation is kept for up to 12 months after it ends.
- Where a contract is concluded, data is kept for the duration of the contract, then until the limitation period for claims expires and for the period required by tax and accounting regulations.
- Technical server logs are kept for the period necessary to ensure security.
After these periods, data is deleted or anonymised.
6. Rights of data subjects
Under the GDPR, data subjects have the right to:
- access their data and receive a copy of it,
- rectification of data,
- erasure of data,
- restriction of processing,
- data portability, where data is processed on the basis of a contract and by automated means,
- object to processing based on the legitimate interest of the controller.
To exercise these rights, contact [email protected]. A response will be provided without undue delay and no later than within one month.
7. Complaint to a supervisory authority
Data subjects have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.
8. Cookies
The website uses only one technical cookie, NEXT_LOCALE, which stores the selected language version. The cookie is necessary for the website to function and does not require consent.
The website does not use analytics, advertising or marketing cookies and does not load third-party tracking scripts. Cookies can be deleted or blocked at any time in the browser settings.
9. Changes to the policy
The policy may be updated, in particular if the way the website operates or the applicable law changes. The current version is available on this page together with the date of the last change.
This document requires legal review before publication.