Privacy Policy (GDPR)

The controller of your personal data is A-PROJEKT Sp. z o.o. with its registered office in Warsaw, ul. Kowieńska 22 lok. 151, 03-438 Warszawa, entered in the register of entrepreneurs of the National Court Register under KRS number 0000411728, NIP 9512353775, REGON 146009522 (the “Controller”).

In matters concerning personal data protection you can contact the Controller:

• in writing — at the registered office address indicated above,
• by e-mail — at [email protected],
• by phone — at +48 22 654 39 15.

We process your personal data for the following purposes:

• handling correspondence and enquiries (e-mail, phone, forms) — based on the Controller's legitimate interest in communicating with interested persons (Art. 6(1)(f) GDPR),
• sending the newsletter — based on freely given consent (Art. 6(1)(a) GDPR); consent may be withdrawn at any time,
• conducting recruitment — based on the candidate's consent and labour law provisions (Art. 6(1)(a) and (b) GDPR in conjunction with Art. 22¹ of the Polish Labour Code),
• concluding and performing contracts with clients, subcontractors and suppliers (Art. 6(1)(b) GDPR),
• fulfilling legal obligations, in particular tax and accounting obligations (Art. 6(1)(c) GDPR),
• establishing, pursuing or defending claims — based on the Controller's legitimate interest (Art. 6(1)(f) GDPR).

Your personal data may be disclosed only to entities supporting the Controller's activity, to the extent necessary to provide the services:

• hosting and website maintenance providers,
• IT service providers and website security providers (including CDN network services such as Cloudflare),
• postal and courier service providers,
• accounting and legal service providers,
• public authorities entitled to receive the data under the law.

Data are not transferred to third countries outside the European Economic Area, except where a network service provider processes data under standard contractual clauses approved by the European Commission.

• correspondence — for the duration of the matter, and then until the expiry of the limitation periods for potential claims,
• newsletter — until consent is withdrawn (unsubscribing from the list),
• recruitment — until the end of the recruitment process, and where separate consent has been given, also for future recruitments,
• contracts — for the duration of their performance and the period required by law (as a rule, 5 years from the end of the tax year),
• claims — until the expiry of the limitation periods provided for by law.

In connection with the processing of personal data, you have the following rights:

• the right of access to your data and to obtain a copy of it (Art. 15 GDPR),
• the right to rectification of your data (Art. 16 GDPR),
• the right to erasure — the “right to be forgotten” (Art. 17 GDPR),
• the right to restriction of processing (Art. 18 GDPR),
• the right to data portability (Art. 20 GDPR),
• the right to object to processing based on legitimate interest (Art. 21 GDPR),
• the right to withdraw consent at any time — without affecting the lawfulness of processing carried out before its withdrawal.

To exercise these rights, please contact us at [email protected]. You also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

Providing personal data is voluntary, but necessary to use some of the website's features (e.g. subscribing to the newsletter) or to take part in recruitment, and — when concluding contracts — to conclude and perform them.

Your data are not subject to automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

In-house statistics module. To ensure the security of the website, examine its functionality and keep visit statistics, the Controller records technical visit data on the server side: IP address (version 4 or 6), host name determined by reverse DNS (revDNS), browser identifier (user agent), addresses of visited pages, referring page address and a technical visitor identifier created as a hash of part of the above data. The module does not use cookies. The legal basis for processing is the Controller's legitimate interest (Art. 6(1)(f) GDPR). Statistical data are periodically deleted and are not combined with other data enabling direct identification of a person.

Third-party tools. With the visitor's voluntary consent (Art. 6(1)(a) GDPR), given via the consent banner, the website may use third-party analytics tools:

• Google Analytics (Google Ireland Ltd.) — traffic statistics; the tool uses cookies and information about the use of the website may be transferred to Google servers,
• Google Tag Manager (Google Ireland Ltd.) — a container managing analytics and marketing scripts; other tools listed in this policy may be loaded through it,
• Microsoft Clarity (Microsoft Ireland Operations Ltd.) — analysis of how the website is used (heat maps, session recordings); the tool uses cookies,
• other analytics scripts deployed by the Controller — always loaded only after consent is given.

Consent can be withdrawn at any time by deleting the trk_consent cookie in your browser settings (the consent banner will reappear on your next visit). Refusing consent does not limit access to the website's content — the third-party tools will simply not be loaded.

The website uses cookies to the following extent:

• consent cookie (trk_consent) — remembers the visitor's decision regarding analytics tools (stored for up to 12 months),
• analytics tool cookies (Google Analytics, Microsoft Clarity) — only after consent is given, as described in the “Website statistics and analytics tools” section,
• technical cookies of services ensuring the security and performance of the website (e.g. Cloudflare),
• a technical session cookie of the administration panel, available only to the Controller's authorized employees.

In addition: the map on the “Contact” page is embedded from OpenStreetMap — the map operator may record standard connection data (e.g. IP address); the servers store standard access logs (IP address, date and time of the request) for security purposes.

The privacy policy may be updated in connection with changes in the law or in the scope of the services provided. The current version is always available on this page, with the date of the last update given in the introduction.