Privacy
Privacy and cookies policy
In short: no ads, no Google tracking tools, no selling of data. I only measure the quote configurator, and only with your consent.
- No ads, no GoogleNo pixels, no Google Analytics, no advertising cookies.
- Measurement only with consentDeclining, or not deciding, means zero measurement, server side included.
- Data in the EUThe form database is hosted in Ireland (Supabase, eu-west-1 region).
- Your callChange your consent any time with one click in the footer.
Controller
The controller of personal data collected through jaroslawgrasza.pl is Jarosław Grasza. For anything related to your data, write to jaroslawgrasza@gmail.com.
What data, why and on what legal basis
Contact form
Name, email, phone and message, plus browser information (user agent) and the time of sending. I use them to reply and to protect the form from spam. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Art. 6(1)(f) GDPR (legitimate interest: correspondence and abuse prevention). After you send the form, the site shows my phone number and remembers it in your browser.
Quote configurator and enquiry
Enquiry form data (name, email, phone, message), the selected configuration, indicative prices, language and user agent. Purpose and legal basis as above: Art. 6(1)(b) and (f) GDPR.
Contract generator
Details entered into a contract in a private offer link (e.g. company name, address, tax ID, contact person), saved when you click “Save”. Purpose: preparing and concluding the contract. Legal basis: Art. 6(1)(b) GDPR and, once a contract is signed, Art. 6(1)(c) GDPR (tax and accounting duties).
Configurator measurement, only with consent
Which options you pick in the configurator, indicative prices, language, user agent and a random ID for this browser. No name, no email, and no IP address stored in the database. For text fields I only record whether they are filled in, never what you type. It tells me which packages and modules visitors care about, so I can improve the offer. Legal basis: your consent, Art. 6(1)(a) GDPR, and for storing the ID in your browser Art. 399 of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej). With consent I also record that an enquiry was sent and when a private offer link is opened. I prepare such a link for a specific person, so opening it is tied to your offer. Without consent none of this happens.
Hosting and server logs
On every visit the providers' servers (Vercel for the site, Supabase for the forms) process technical connection data, including your IP address, in short-term logs. Purpose: delivering the site, security and troubleshooting. Legal basis: Art. 6(1)(f) GDPR.
Cookies and browser storage
This site sets no cookies. It remembers a few things in browser storage (localStorage), which legally follows the same rules as cookies. Here is the complete list:
| Key | Purpose | How long | Type |
|---|---|---|---|
jg_consent | Your measurement decision and its date. | 12 months, then I ask again. | Essential |
jg_session | A random browser ID for configurator measurement. | Until consent is withdrawn or expires. Deleted immediately when you decline. | Measurement, consent only |
jg_phone | The phone number revealed after you send the contact form, so you do not have to send it again. | Until you clear browser data. | Functional, result of your action |
jg_offer_state | Configuration state in a private offer link, so a refresh does not start over. | Until you open the public offer page or clear browser data. | Functional |
Consent is not a condition for using the site, and declining blocks nothing. If your browser sends a Global Privacy Control signal, I treat it as a refusal and do not ask. You can change your consent any time with “Change consent” in the footer, or right here:
The admin panel also uses session storage (sessionStorage) for signing in. This applies only to me as the administrator.
Who processes data for me
I do not sell data or share it for marketing. I use services that process data on my behalf:
- Vercel Inc., website hosting.
- Supabase Inc., database and form functions. Data is stored in Ireland (eu-west-1 region).
- Resend, email notifications about new enquiries sent to my inbox.
- Google, the Gmail inbox where I receive and handle correspondence.
Transfers outside the EEA
Vercel, Supabase and Resend are based in the USA, and Google may also process data outside the European Economic Area. Transfers rely on the European Commission's adequacy decision (EU-US Data Privacy Framework) for certified recipients, or on standard contractual clauses (Art. 46(2)(c) GDPR). The form database itself is hosted in Ireland.
How long I keep data
- Enquiries from the form and configurator: for the duration of our conversation, then up to 2 years after the last contact, unless you ask for deletion earlier.
- Contracts and billing data: for the period required by tax and accounting law (usually 5 years from the end of the tax year).
- Configurator measurement: 12 months, then deleted automatically.
- Your consent decision in the browser: 12 months.
- Server logs: short term, according to the providers' settings.
Your rights
You have the right to access your data, to rectification, erasure, restriction of processing and data portability, and to object to processing based on legitimate interest. You can withdraw consent at any time, without affecting the lawfulness of earlier processing. Just write to jaroslawgrasza@gmail.com.
Configurator measurement is linked only to a random ID, so I do not know who you are. The exception is opening a private offer link, because I prepare such a link for a specific person. Withdrawing consent removes the ID from your browser. If you also want the recorded events deleted, send me its value (the jg_session key in your browser's developer tools) before withdrawing consent.
You can also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl, or with the authority in your country.
Voluntary data and automated decisions
Providing data in the forms is voluntary, but without it I cannot reply or prepare an offer. I make no automated decisions and do no profiling.
Changes to this policy
Version 1 is in effect from 3 October 2026. If I materially change how measurement works, the banner will ask for your consent again.