Polski

Privacy policy

Version 1.0. Effective from 18 July 2026.

1. Data controller

The controller of personal data processed in connection with the use of infotower.pl and contact by form, email or telephone is Infotower Business Solutions sp. z o.o., ul. Chorzowska 50, 44-100 Gliwice, Poland, National Court Register (KRS): 0000467668, tax identification number (NIP): 6312649995, national business registry number (REGON): 243304743.

You can contact the controller by email at biuro@infotower.pl, by telephone at +48 697 517 384 or by writing to the registered office address.

2. Data Protection Officer

The Data Protection Officer is Tomasz Werner. For matters concerning the processing of personal data or the exercise of data protection rights, contact the DPO at iodo@infotower.pl.

3. Scope of this policy

This policy describes processing connected with the public infotower.pl website, the contact form and correspondence initiated through it. It does not replace separate privacy information provided to customers, contractors, job applicants or project participants where a particular process requires a separate notice.

4. Data we process and where it comes from

We may process:

  • data entered in the contact form: name and surname, email address, subject and message, and optionally the organisation name and telephone number;
  • data contained in subsequent correspondence and basic message metadata, such as the date, sender, recipient and enquiry identifier;
  • technical data recorded in server logs, in particular the IP address, request time, requested address, browser and operating-system information, and data required to identify errors and attempted abuse;
  • temporary salted hashes of the IP address and email address, used solely to limit excessive form submissions;
  • the light or dark display preference stored locally in the user’s browser.

We receive the data directly from the user or automatically from the user’s device when it communicates with the server. The form does not store enquiry content in the WordPress database. The content is delivered by email, and the sender receives an automatic acknowledgement without a copy of the submitted message.

The form is not intended for patient data, medical records, passwords, other confidential information or special-category personal data. Please do not include such data in a message.

5. Purposes and legal bases

We process data for the following purposes:

  • responding to a general enquiry, corresponding with the user and arranging further contact — on the basis of our legitimate interest in communicating with persons interested in the company’s activities and documenting arrangements, under Article 6(1)(f) GDPR;
  • presenting an offer, accepting an order or taking steps at the data subject’s request before entering into a contract — under Article 6(1)(b) GDPR;
  • performing a contract and managing a customer relationship where the contact results in a contract — under Article 6(1)(b) GDPR;
  • complying with legal obligations, in particular tax, accounting and data-subject-rights obligations — under Article 6(1)(c) GDPR;
  • securing the website and email, preventing abuse, diagnosing errors, and establishing, exercising or defending legal claims — on the basis of our legitimate interest under Article 6(1)(f) GDPR.

Selecting the checkbox next to the form confirms that the user has read the privacy information. It is not marketing consent. The form does not subscribe the user to a newsletter and is not used for marketing profiling.

6. Whether providing data is mandatory

Providing data is voluntary. The name and surname, a valid email address, a subject and the message are required for us to accept and answer an enquiry. Without them the form cannot be submitted. The organisation name and telephone number are optional.

If an enquiry concerns entering into or performing a contract, certain additional information may be necessary to prepare an offer, order or documentation required by law. We will provide separate information where appropriate.

7. Recipients of data

Data may be accessed, only where necessary, by:

  • authorised employees and collaborators of Infotower Business Solutions;
  • home.pl S.A., which provides hosting, infrastructure and email services;
  • Microsoft and its authorised subprocessors in connection with Microsoft 365 email services;
  • providers of IT support, security, backup or technical services, where they take part in operating the website or email and act under appropriate agreements;
  • legal, accounting or audit advisers where this is necessary to meet obligations or protect the controller’s rights;
  • public authorities where disclosure is required by law.

We do not sell personal data.

8. Transfers outside the European Economic Area

Website hosting and the contact form’s primary email transport use home.pl infrastructure. The subsequent handling and storage of correspondence may also use Microsoft 365. Depending on the service, tenant configuration and support operations, Microsoft or its subprocessors may process data outside the European Economic Area.

Where such a transfer occurs, it is made using a mechanism permitted by the GDPR, in particular an adequacy decision or the European Commission’s standard contractual clauses, together with the safeguards described in the Microsoft Products and Services Data Protection Addendum. Information about the safeguards relevant to a particular transfer can be requested from the Data Protection Officer.

The website contains a link to Google Maps but does not embed a map or Google scripts. When the link is selected, the user leaves infotower.pl and further processing is governed by the rules of the service that is opened.

9. Retention periods

  • temporary hashes used to limit form abuse are stored for 15 minutes for the IP address and 30 minutes for the email address;
  • ordinary enquiry correspondence is retained for 12 months after the conversation has ended;
  • where the contact results in a contract, complaint, settlement or dispute, the relevant data may be retained for the duration of the contract, the statutory record-keeping period or until the applicable limitation period for claims has expired;
  • technical website and email logs are retained for the period resulting from the infrastructure provider’s settings and retention rules and, in the event of an incident, until its investigation and any related claims have been secured;
  • the display preference remains in the browser until the user removes it or clears website data.

After the applicable period, data is deleted or anonymised unless continued retention is required by law.

10. Data-subject rights

Subject to the conditions set out in the GDPR, the data subject has the right to:

  • access their data and receive a copy;
  • rectify inaccurate data;
  • erase data;
  • restrict processing;
  • object, on grounds relating to their particular situation, to processing based on Article 6(1)(f) GDPR;
  • data portability where processing is automated, based on a contract and the other GDPR conditions are met.

A request may be sent to iodo@infotower.pl. We may ask for information necessary to confirm the identity of the person making the request.

The data subject also has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

11. Automated decision-making and profiling

Data connected with the website and contact form is not used to make decisions concerning the user based solely on automated processing, or for profiling that produces legal effects or similarly significantly affects the user.

12. Security

We apply technical and organisational measures appropriate to the nature of the processing, including encrypted HTTPS connections, authenticated email delivery, form submission limits, access controls, updates and backups. No internet transmission can provide an absolute guarantee of security. Please therefore do not use the form to send patient data, medical records, passwords or information requiring a dedicated, agreed communication channel.

13. Cookies and local storage

The public website does not currently use optional analytics or marketing tools. The light or dark display preference is stored in the browser’s local storage and is not used for advertising or cross-site tracking. Technical details are described in the Cookie policy.

14. Changes to this policy

We may update this policy following changes in law, website functions, providers or processing activities. The current version and effective date are stated at the beginning of the document. Material changes will be communicated on the website in a manner appropriate to their significance.