Privacy policy.

The controller of your personal data is PRODAUT Sp. z o.o., registered office: Sułków 36, 48-120 Baborów, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) under number 0001242863 (District Court in Opole, 8th Commercial Division of the KRS), NIP (tax ID) 7481597304, REGON 544821885.

For any matter concerning personal data, write to kontakt@prodaut.pl. We have not appointed a data protection officer - at the scale of our business it is not required.

• -Contact form (home page, /contact, offer pages): first and last name, e-mail address, message content. Along with the message we store technical data that helps us judge how well our ads work: campaign parameters from the page URL (utm, the Google Ads click ID gclid), the landing page and the address of the page the visitor came from.
• -E-mail: the data you provide when writing to us directly at kontakt@prodaut.pl.
• -Consultation booking: the booking calendar is run by Google (Google Calendar). Google processes booking data under its own privacy policy; we receive your first and last name, e-mail and the meeting time.
• -Our own traffic statistics: we count visits with Umami software on our own server, with no cookies and without storing anything in your browser. A visitor is counted as an irreversible hash with a daily salt that cannot be linked to a person or tracked across days. The data never leaves our infrastructure - see the cookie policy.
• -Site usage data: we store Google Analytics / Google Ads identifiers and cookies only after you give consent in the banner. Before consent, Google tags run in cookieless mode and send only anonymized signals (no user identifiers) - see the cookie policy.

• -Replying to your enquiry, preparing a quote, scheduling a consultation - Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract), and when you write on behalf of a company you represent - Art. 6(1)(f) GDPR (our legitimate interest: conducting business correspondence).
• -Performance of a contract, if you decide to work with us - Art. 6(1)(b) GDPR.
• -Visit statistics and ad performance measurement (Google Analytics 4, Google Ads) - Art. 6(1)(a) GDPR, i.e. your consent given in the cookie banner. You can withdraw it at any time on the /en/cookies page.
• -Matching your enquiry to an ad (Google Ads enhanced conversions) - Art. 6(1)(a) GDPR. If in the banner you gave consent covering the processing of user data for advertising purposes (in Consent Mode: ad_user_data), then after you submit the form your e-mail address is converted in your browser into an irreversible hash (SHA-256) and passed in that form to Google Ireland Ltd., so that Google can match your enquiry to an ad click. Google never receives the address in plain text. Without consent nothing is sent.
• -Improving the layout and readability of the site (Microsoft Clarity: click maps, scroll depth and a replayable session recording) - Art. 6(1)(a) GDPR, i.e. your consent from the banner. Without consent the script does not load. Contact form fields are masked in the page code, so your name, e-mail address and message content never end up in the recording.
• -Establishing, exercising or defending legal claims - Art. 6(1)(f) GDPR.

Providing data in the form is voluntary, but without your name, e-mail address and message we will not be able to reply.

We use providers that process data on our behalf under data processing agreements:

• -Resend, Inc. - sending e-mails from the form (a notification to us and a confirmation to you). Servers in the European Union (Ireland region).
• -Discord Netherlands B.V. and Discord, Inc.- a notification about a new form message (name, e-mail address, content) on the team's internal channel, so that no enquiry sits waiting in an inbox. The data goes to Discord's servers, including in the USA, under standard contractual clauses.
• -Google Ireland Ltd. - mailbox and calendar (Google Workspace) and, only with your consent, Google Analytics 4 and Google Ads (including the hashed e-mail address from the form for conversion matching). For advertising data Google acts as a separate controller under the Google Ads Controller-Controller Data Protection Terms.
• -Microsoft Ireland Operations Limited - only with your consent, heatmaps and session recordings (Microsoft Clarity).
• -Vercel Inc. - hosting of prodaut.pl.
• -Providers of accounting, legal or IT services to us - to the extent necessary to perform them.

Some providers (Google, Microsoft, Vercel, Resend, Discord) are US companies and data may be processed outside the European Economic Area. This takes place on the basis of a European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.

• -Form and e-mail correspondence: until the matter is closed, no longer than 12 months from the last contact, unless we start working together.
• -Contract-related data: for the term of the contract, and then until the limitation periods for claims and tax obligations expire.
• -Analytics and advertising data: for the periods described in the cookie policy or until you withdraw consent.

You have the right to:

• -access your data and obtain a copy of it,
• -rectification, erasure or restriction of processing,
• -data portability,
• -object to processing based on legitimate interest,
• -withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal,
• -lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland).

To exercise these rights, write to kontakt@prodaut.pl.

We do not make decisions about you based solely on automated processing. With your consent, Google Ads may tailor the ads you see to your activity on the site - the rules are described by Google in How Google uses information from sites or apps that use our services.

When we change our tools or the scope of processing, we will update this document and the date at the top of the page. The version published on prodaut.pl is always the current one.