Data controller and contact
The data controller is Łukasz Krygowski, trading as CONSILIUM ET COMMERCE ŁUKASZ KRYGOWSKI, ul. Jesionowa 27A, 38-460 Jedlicze, Poland, NIP 6842681966, REGON 541381380. CyberKlucz is a brand of this business.
For personal data matters, contact us by email at kontakt@cyberklucz.pl, by telephone on +48 575 553 581 or by post at the address above. This notice covers contact through cyberklucz.pl and related correspondence.
No data protection officer has been appointed. For personal data matters, contact the controller directly at the address above.
What data we receive
- Form: your name, message and email address; if you request a call, a telephone number is required and email is optional. You may also provide your current website address and information needed for a reply.
- Enquiry context: your selected service, package or demo and a request for a call, if you use these options. This information helps us prepare a reply; it is not consent to a purchase.
- Email or telephone: the sender’s address, telephone number and information shared in correspondence or conversation. The form does not record calls.
- Technical data: the IP address when connecting to the server, request time, requested address, response status and information sent by the browser; what is recorded in logs depends on the hosting and email configuration.
- After a contract is concluded: data needed to perform and settle it, such as the customer’s or representative’s details, address and NIP on the invoice.
Providing contact details is voluntary, but the form cannot accept an enquiry without your name, message and at least the required reply channel. Billing details are needed to the extent required by the contract and law. Do not send passwords, MFA codes, card details, special categories of personal data or unnecessary information about other people.
Purposes and legal bases for processing
| Purpose | Legal basis and explanation |
|---|---|
| Preparing a quote or taking steps before a contract at your request; performing a contract to which you are a party | Article 6(1)(b) GDPR |
| Replying to a general question or contacting a business representative | Article 6(1)(f) GDPR: legitimate interest in managing correspondence and business relationships |
| Protecting the form, limiting spam and diagnosing faults | Article 6(1)(f) GDPR: legitimate interest in protecting the website and correspondence |
| Establishing, pursuing or defending specific claims | Article 6(1)(f) GDPR: legitimate interest in protecting the controller’s rights |
| Settlement and compliance with legal obligations after a contract is concluded | Article 6(1)(c) GDPR: applicable tax and accounting obligations |
Contacting us does not subscribe you to a newsletter or activate advertising. You do not need to consent to the privacy policy or marketing to receive a reply. We do not use enquiry data for unrelated marketing campaigns.
Recipients and providers
The controller and people authorised to handle the matter can access the data. Depending on its scope, data may be processed by hosting, email, IT maintenance and backup providers, and, once a contract is concluded, accounting or legal service providers. Those acting on our behalf receive only the necessary data on an appropriate basis, including a data processing agreement where required. Public authorities may receive data only as provided by law.
Website hosting and the kontakt@cyberklucz.pl mailbox are provided by SEOHOST Sp. z o.o., ul. Obornicka 330, 60-689 Poznań, NIP 9721323212. The provider processes data on our behalf under a concluded personal data processing agreement.
We do not sell enquiry data. We keep correspondence in SEOHOST email; we do not use a separate CRM, cloud service or additional email archive.
Processing locations and transfers
The website does not load Google Analytics, Meta Pixel, external fonts or YouTube or Vimeo players. Its own images, fonts and videos are served from this website. An ordinary link to an external website establishes contact with it when you follow the link, under that website’s rules.
SEOHOST documentation identifies data centre infrastructure in Poland. The list of subprocessors attached to the agreement includes DATASPACE P.S.A., EXEA S.A. and OVH Sp. z o.o. in Poland, and Quality Unit, s.r.o. in Slovakia, which handles the provider’s support tickets. These entities are in the European Economic Area. We do not use website analytics or marketing tools that transfer data outside the EEA. Before introducing an additional service requiring such a transfer, we will identify the appropriate basis, safeguards and how to obtain a copy of them, and update this notice. A Polish provider’s name alone does not guarantee the location of every processing operation.
How long we keep data
The period depends on the purpose and type of data. Offer enquiries are not kept indefinitely merely in case of future interest in working together. Infrastructure logs and backups have separate rules described below.
| Category | Period or criterion |
|---|---|
| Form result and any fields needing correction | Available in the application for up to 10 minutes; deleted once the result is read. Expiry does not mean immediate deletion of every database copy |
| Rate-limit counter | Valid for 15 minutes, renewed by an attempt counted towards the limit; the key is based on an IP hash with a secret website component, which is pseudonymisation, not full anonymisation |
| Pre-contract correspondence | Up to 6 months after contact ends, with monthly review and deletion; longer retention is limited to necessary evidence for a specific claim on an appropriate basis |
| Documentation of a concluded contract | For performance and settlement; necessary evidence for the applicable limitation period, and tax documents for the period required by law |
| CyberKlucz web and error logs available in the hosting account | The controller’s adopted period is 30 days after the event. Necessary extracts relating to a specific incident may be kept separately until it is explained or the relevant proceedings end. Deleting files requires action by the provider: the available account has no permission to delete them. SEOHOST has not yet confirmed implementation of automatic 30-day retention; according to its information, logs may remain in the account indefinitely unless deleted. The adopted period therefore does not mean automatic deletion is already operating |
| Logs held by SEOHOST, including email logs and other technical logs | According to the operator’s response, these may be kept for up to 2 years, including on its other servers. Deleting logs available in the account does not delete all records held by the operator |
| Backups made by SEOHOST | According to the operator, backups are made daily; at least 7 daily, 2 weekly and 1 monthly copy are kept. The operator may retain more copies and has not specified a maximum period. According to its response, a deleted message may remain in backups for at least a month, usually up to 2 months and occasionally up to 3 months; this description does not guarantee deletion within 3 months. The customer cannot configure these periods independently |
The form code does not create a permanent lead database. Messages go to the email inbox. Incorrectly completed fields may be held briefly in the WordPress database so they can be corrected. The website does not automatically delete email or the provider’s backups.
The infrastructure description above is based on SEOHOST’s response provided to us on 8 October 2026. The six-month period for concluded enquiries applies to active correspondence; it does not mean every copy and log is deleted at the same moment. Backups are for recovery after a failure, not for continuing contact using deleted correspondence. After restoration, we repeat earlier deletions if they are still required. We also assess erasure or restriction requests in relation to technical data and backups, and pass them to the provider to the extent necessary. The provider’s failure to specify a maximum period does not mean we claim a right to arbitrary, indefinite use of the data.
Cookies and browser storage
Cookies are small pieces of information stored by the website in the browser. They may be linked to personal data. Separate rules apply to accessing device storage and to processing the data itself.
| Name or area | Purpose and time of use | Duration |
|---|---|---|
| ck_contact_result | An essential technical result identifier after an attempt to submit the form. It does not contain the message, but links the browser to the result and a temporary draft. Path scope: /en/contact/ | Up to 10 minutes, deleted once the result is received |
| WordPress cookies when signing in to the CMS | Checking cookie support, authentication and panel settings; these concern people opening the sign-in page or using the CMS, not ordinary browsing of the offer | The session or sign-in period; selecting “Remember me” may extend validity. This depends on the panel configuration |
The form cookie is HttpOnly and SameSite=Lax; over HTTPS it has the Secure attribute. It supports the requested form function. We do not use analytics or advertising cookies. We do not use localStorage or sessionStorage to track users. Caching files and media speeds up their display and is not used by us for advertising.
You can delete or block cookies in your browser’s privacy settings. Blocking the form cookie may prevent confirmation, errors and previously entered fields from being displayed. This does not change the status of a message actually passed for sending; if in doubt, use telephone or email.
For these essential functions, we do not request consent for marketing cookies that we do not use. Adding analytics, advertising or external embeds requires a fresh audit, an update to this notice and consent where legally required, before those tools are enabled.
Demos, videos and automation
The pizza basket, print calculator and animation effects are demonstrations. They do not place orders or take payments. The video is a file served by the website, not an embedded player from an advertising provider.
The form uses an automatic attempt limit and spam protection. Through this website, we do not carry out advertising profiling or make decisions producing legal effects or similarly significantly affecting a person within the meaning of Article 22 GDPR. The attempt limit may temporarily block the form; telephone and email remain available.
Your rights and contact with UODO
You may request access to your data, rectification, erasure or restriction of processing under the GDPR. Erasure does not cover data we must still lawfully retain, such as tax documents.
You may object, on grounds relating to your particular situation, to processing based on legitimate interest. We will then assess whether an overriding basis for further processing exists. Data portability applies to data you provide that is processed automatically under a contract or consent, within the scope set out in the GDPR. If a specific purpose relies on consent, you may withdraw it without affecting earlier lawful processing.
Send your request to kontakt@cyberklucz.pl or the controller’s postal address. Where there are reasonable doubts, we may ask for proportionate confirmation of identity. We will reply without undue delay, normally within a month. In cases where the law allows an extension, we must inform you of the reasons within that period.
You have the right to lodge a complaint with the President of the Personal Data Protection Office. Current details and contact methods are available on the UODO website. You do not have to complain to us first to exercise this right.
Version and changes
Version: 8 October 2026, adopting 30 days for CyberKlucz web and error logs and identifying limitations on implementation by the provider. Changes to features or providers require an updated notice. The current notice is available at this address; changes do not automatically expand the purposes for which previously received data is used.