Privacy and data protection
Privacy policy and GDPR information
This document covers rwrozwoj.pl, contact and project inquiry forms, and events organised or co-organised by R&W. If a specific event has an additional privacy notice, that notice supplements the rules below. In case of any discrepancy, the Polish version is authoritative.
Last updated: 10 October 2026
1. Data controller
The controller of your personal data is R&W Rozwój i Wdrożenie Sp. z o.o., ul. Wojska Polskiego 8, 41-208 Sosnowiec, Poland, KRS 0001269028, NIP 6443603404, REGON 545800431, share capital PLN 5,000.00.
For matters concerning personal data, contact kontakt@rwrozwoj.pl. The controller has not appointed a data protection officer unless a separate notice for a project or event states otherwise.
2. Scope
This policy applies to data processed in connection with:
- submitting a project inquiry form or sending an email;
- business discussions, preparing an offer and performing a contract;
- registration for and participation in conferences, forums, training, seminars and other events;
- billing, complaints and the establishment or defence of claims;
- website security and technical server logs.
3. Purposes, legal bases and retention
| Purpose | Legal basis | Retention period |
|---|---|---|
| Responding to an inquiry and assessing a project submission | Article 6(1)(b) or (f) GDPR | Usually up to 24 months after the contact ends |
| Preparing, concluding and performing a contract | Article 6(1)(b) GDPR | For the duration of the contract and then until the relevant limitation periods expire |
| Registration for and administration of an event | Article 6(1)(b) GDPR | Until the event ends and then for the period required for billing and claims |
| Accounting, tax and other legal obligations | Article 6(1)(c) GDPR | For the period required by applicable law |
| Website security and the establishment or defence of claims | Article 6(1)(f) GDPR | Logs usually for up to 12 months; documents until the relevant limitation periods expire |
| Marketing or use of a person's image, where applicable | Article 6(1)(a) GDPR | Until consent is withdrawn or the stated purpose is achieved |
The controller's legitimate interests include conducting business correspondence, protecting the website and establishing, pursuing or defending claims.
4. Categories of data
Depending on the matter, we may process your name, organisation, position, email address, phone number, inquiry or project description, billing information and details connected with event participation. The server may also record technical data such as an IP address, request date and time, browser type and error information.
Please do not use the form to send special-category personal data, passwords, access credentials or confidential technical documentation. We will agree separately on the information required for a more detailed project assessment.
5. Recipients
Data may be entrusted to providers of hosting, email, IT support, accounting, legal advice, payments or other services necessary to handle the matter. For events, data may also be provided to co-organisers, the venue operator and suppliers of catering, badges or certificates, but only to the extent necessary to deliver the event.
Each recipient receives data on an appropriate legal or contractual basis and only to the extent necessary.
6. Transfers outside the EEA
If a technology provider processes data outside the European Economic Area, the controller uses safeguards required by the GDPR, in particular a European Commission adequacy decision or standard contractual clauses. Information about the applicable safeguards can be requested using the contact details in section 1.
7. Your rights
Subject to the conditions set out in the GDPR, you have the right to:
- access your data and receive a copy;
- rectify inaccurate data;
- request erasure or restriction of processing;
- data portability, where applicable;
- object to processing based on the controller's legitimate interests;
- withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal;
- lodge a complaint with the competent supervisory authority, including the President of the Personal Data Protection Office in Poland.
Send a rights request to kontakt@rwrozwoj.pl. Before handling it, we may request information necessary to verify your identity.
8. Voluntary provision and automated decisions
Providing data is voluntary, but fields marked as required are necessary to handle an inquiry, registration or contract. We do not make decisions producing legal or similarly significant effects solely by automated means and do not profile individuals for that purpose.
9. Cookies and technical data
The website may use technical cookies or browser storage necessary for its functions, security and remembering the selected language. We do not currently use advertising cookies or third-party user tracking. If such solutions are introduced, this policy and, where required, the consent mechanism will be updated before they are enabled.
10. Security and changes to this policy
We apply organisational and technical measures appropriate to the type of data and the risk, including access controls, backups and hosting service safeguards. This policy may be updated to reflect changes in law, website features or event organisation. The current version is always published on this page.