MarketFace
EN

Privacy policy

Learn who processes your data, for which purposes, for how long and how to exercise your rights.

Original Polish document

Translation notice

This translation is provided for convenience. In case of doubt, the Polish version prevails.

1. Controller and contact

The personal data controller and operator of marketface.pl is Łukasz Ambroży, trading as MF Łukasz Ambroży, tax identification number (NIP): 691-254-93-45, ul. Pocztowa 9/7, 59-220 Legnica, Poland ("Marketface", "we").

For matters concerning personal data, consent and exercising your rights, you can write to iod@marketface.pl or the postal address above. We have not appointed a data protection officer; this mailbox is our point of contact for privacy matters.

2. Data scope and sources

We receive data directly from you when you request a growth potential assessment, send an email or contact us by phone. We process your first name, chosen contact method, email address or phone number, correspondence and business details you provide voluntarily: industry, main service, service area, website address and current advertising.

Using the website also involves processing technical data: IP address, browser and device information, request time and parameters, and security signals. After the appropriate consent, measurement tools collect information about pages visited, events, traffic sources and browser identifiers. We do not ask for special categories of data, such as health data.

3. Purposes and legal bases

The request for contact in the form relates to the assessment you requested and a discussion about working together. It is not a newsletter subscription or consent to later unsolicited marketing campaigns. We do not operate a newsletter. Cookie consent is separate from form submission.

  • Preparing the assessment and offer you requested and taking steps at your request before entering into a contract — Article 6(1)(b) GDPR, if you are the prospective contracting party.
  • Responding to other enquiries and contacting business representatives — Article 6(1)(f) GDPR. Our legitimate interest is managing correspondence and business relationships.
  • Performing our contract — Article 6(1)(b) GDPR; related tax and accounting obligations — Article 6(1)(c) GDPR and applicable tax and accounting law.
  • Maintaining and securing the website, preventing spam, handling incidents and establishing, pursuing or defending claims — Article 6(1)(f) GDPR. Our interest is protecting the website, its users and our rights.
  • Cookie-based analytics in Google Analytics 4 and advertising performance measurement using Meta Pixel — Article 6(1)(a) GDPR, meaning your consent. Storing information on your device and accessing it for optional purposes requires consent under Article 399 of the Polish Electronic Communications Law.

4. Voluntary provision of data

Providing data is voluntary. To handle the form, we need your first name, preferred contact channel and the corresponding email address or phone number. The second channel and business details are optional. Without the details needed to reply, we cannot handle your enquiry through that channel.

Refusing analytics and advertising consent does not restrict access to content, the form or the assessment. If you enter into a contract with us, additional data may be needed to perform and settle it.

5. Providers and data recipients

Entities acting on our behalf process data under appropriate agreements and may use subprocessors. For the collection and transmission of event data through Meta Pixel, we participate in joint controllership with Meta under Meta's Controller Addendum. We are responsible for information and consent on our website; Meta determines further processing in its services. You can exercise your rights against either joint controller.

  • OVH sp. z o.o. (OVHcloud) — hosting of the website infrastructure.
  • Google Ireland Limited and entities providing Google Workspace — operation of our email service, where we store correspondence.
  • Plus Five Five, Inc. (Resend) — delivery of form submissions to our mailbox. The provider processes message content and delivery data.
  • Cloudflare, Inc. — traffic delivery and protection through Cloudflare Tunnel and form protection through Turnstile. In the Cloudflare Pages or Workers deployment option, the provider also hosts the website; the form in Workers uses native rate limiting with pseudonymised keys and counters, without an application database. Turnstile analyses IP addresses and connection and browser characteristics, among other signals. In protecting our website, Cloudflare acts as a processor and, when improving bot detection, also as a separate controller under its policy.
  • Google Ireland Limited and entities providing the Google tag and Google Analytics 4 — website analytics within the scope described below.
  • Meta Platforms Ireland Limited — recipient of measurement data when Meta Pixel is enabled and advertising consent has been given. While the Pixel integration remains disabled, no data is sent to it.
  • Authorised people handling enquiries and, where needed, accounting and legal service providers. We also disclose data to authorities entitled to receive it under the law.

6. Data transfers outside the EEA

Using global providers may involve transferring data outside the European Economic Area, particularly to the United States. Resend stores message data there; choosing a European sending region does not mean European storage. Google and Cloudflare use infrastructure and subprocessors in various countries. A hosting provider being based in Poland does not mean every other provider processes data exclusively in Poland.

Providers set out transfer safeguards in their agreements, particularly standard contractual clauses approved by the European Commission and, where applicable to the recipient and transfer, an adequacy decision. Contact us for information about the safeguards applied and how to obtain a copy. Using a provider's services does not mean giving up your GDPR rights.

7. Retention periods

If you effectively withdraw consent, object or request erasure, we stop the processing covered by that request unless another applicable basis permits continued retention. Data processed by providers as separate controllers is also subject to their own retention rules and the rights described in their policies.

  • Assessment enquiries and correspondence that did not lead to collaboration — up to 12 months after the last contact.
  • Correspondence and collaboration records — for the contract term, then only as needed for legal obligations or claims. Under Polish law, the limitation period for business-related claims is generally 3 years and the general period is 6 years; specific laws may provide other periods. We consider the applicable start and end dates, suspension and interruption of the period, rather than retaining every message for the longest possible time.
  • Tax documents — until the tax liability limitation period expires, generally 5 years after the end of the calendar year in which the tax payment deadline fell, taking account of events affecting that period and other applicable statutory obligations.
  • Ordinary security logs under our control — up to 90 days. Information separated out concerning an incident or claim may remain until the matter is resolved and the relevant claims period has ended.
  • Rotating backups under our control — up to 90 days. Data deleted from the live system may remain in a backup until it is overwritten; we do not use it for ongoing activity. After restoring a backup, we repeat the required deletions.
  • Form security data — in the Node deployment option, the active rate-limiting window is 10 minutes after verification or 30 minutes without a token; verification attempts have a separate 10-minute window. HMAC keys derived from IP addresses, counters, limit parameters and expiry timestamps are held in process memory, without raw IP addresses or form contents. Expired entries are removed on subsequent limiter calls and all entries when the process ends; window expiry does not guarantee deletion at that exact time. In the Cloudflare option, Workers handles the form using native rate limiting in 60-second windows. We pass only HMAC keys to this mechanism, without raw IP addresses or form contents. Cloudflare maintains counters within its locations and synchronises them with a delay; this is not a strict global limit. A 60-second window does not guarantee deletion exactly after one minute. The application does not use a database for form rate limiting.
  • Cookie choice record — 180 days; one-time form receipt confirmation — 5 minutes. Measurement tool cookie periods are described in the Cookie policy. A cookie's lifetime is separate from the provider's retention of event data.

8. Measurement, consent and profiling

Google Analytics 4 is integrated directly through the Google tag. The tag uses Advanced Consent Mode: Google may receive limited cookieless measurements before a choice is made and after refusal, including request time, browser information, referrer, visited URL and consent status. Refusal disables optional Google cookies but does not disable every transmission to Google in this mode. Google Analytics 4 measures website use; Meta Pixel measures advertising effectiveness and user actions after ad clicks. Meta Pixel belongs to the advertising category even when used only for measurement. We do not use Google Ads or remarketing on this website. The direct Meta integration measures page views (PageView), accepted form submissions (Lead) and, separately, phone clicks (contact_phone_click) and email address clicks (contact_email_click). We do not send form content, phone numbers or email addresses to Meta as event parameters. Meta measurement remains disabled until a Pixel ID is configured; it then requires advertising consent.

We do not make solely automated decisions that produce legal effects or similarly significantly affect you. Measurement tool providers may combine identifiers and events with other data under their own rules. Form information is used to handle your enquiry; the form code does not pass its fields to measurement tools' data layer.

The Cookie policy describes transmissions before consent is selected and how to change it. Withdrawing consent is as accessible as giving it, through "Cookie settings" in the footer. Withdrawal applies going forward and does not affect the lawfulness of earlier processing.

9. Your rights

Under the conditions set out in the GDPR, you have the right to access your data and a copy, rectification, erasure and restriction of processing. Data portability applies to data you provided that is processed automatically on the basis of consent or a contract.

You can withdraw consent at any time. For processing based on legitimate interests, you can object on grounds relating to your particular situation; an objection to direct marketing is unconditional.

Send requests to iod@marketface.pl. We generally respond within one month of receiving a request. For complex or numerous requests, the period may be extended by two months; we will explain the reasons within the first month. We may ask for information necessary to verify your identity. You also have the right to complain to the President of the Polish Personal Data Protection Office (UODO).

10. Policy changes

We publish the current version on this page with its date. We update it when purposes, tools, recipients or laws change. If new processing requires fresh consent, we ask for it before starting.