Privacy policy and cookies

Controller

Under the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR), the controller of your personal data is Kamil Bigaj, trading as OneNet Kamil Bigaj, ul. Bolesława Chrobrego 16/9, 66-620 Gubin, Poland. If you have questions about your data, email me at info@onenet.com.pl or call me on +48 510 634 755.

What data I process and why

Contact form and quote window

Through the contact form and the “Free quote” window, you send me your name, company, email address, message and, if you wish, your phone number. Along with these details, I record the address of the page you sent the form from, including any campaign parameters it contains (for example UTM). I use all of this to answer your enquiry and prepare a quote. The legal bases are your consent, which you give with the checkbox in the form (Art. 6(1)(a) GDPR), and the need to take steps at your request before a possible contract (Art. 6(1)(b) GDPR). If an enquiry does not lead to a contract, I keep it for 12 months from receipt; after that, it is deleted automatically. Once I have dealt with the enquiry, the legal basis for keeping it is my legitimate interest in establishing, exercising or defending legal claims (Art. 6(1)(f) GDPR). If an enquiry leads to a contract, I keep the data in the same way as contract data (see “Contract and invoicing”).

As soon as a form comes into view, you start filling it in or you open the quote window, the page loads Cloudflare Turnstile, a service provided by Cloudflare, Inc. The service checks your IP address and technical details of your browser to tell humans from bots. I use it on the basis of my legitimate interest in protecting the forms from spam and abuse (Art. 6(1)(f) GDPR).

To prevent mass submissions, the server limits how many times a form can be sent from one IP address. For this purpose, it stores a hash of your IP address with the times of your submissions and deletes entries older than 24 hours the next time anyone sends a form. The legal basis is my legitimate interest in protecting the forms from abuse (Art. 6(1)(f) GDPR).

Email, WhatsApp and phone

If you email me, message me on WhatsApp or call me, I process your email address or phone number and what you tell me. I use this data to deal with your request, either before a possible contract or while performing it (Art. 6(1)(b) GDPR), or on the basis of my legitimate interest in answering the messages I receive (Art. 6(1)(f) GDPR). I keep it while I deal with your request and afterwards until any claims become time-barred, in order to establish, exercise or defend legal claims (Art. 6(1)(f) GDPR).

Contract and invoicing

If you place an order, I process the data I need to conclude and perform the contract (Art. 6(1)(b) GDPR) and to issue invoices and settle taxes (Art. 6(1)(c) GDPR). I cannot conclude a contract without this data, and invoice details are also a legal requirement. I keep contract data for the duration of the contract and afterwards until any claims become time-barred, in order to establish, exercise or defend legal claims (Art. 6(1)(f) GDPR). I keep invoices and accounting records until the tax liability becomes time-barred under Polish law, which is generally five years from the end of the year in which the tax payment deadline passed.

Visit statistics with Google Analytics

If you agree to the “Statistics” category, the website loads Google Analytics 4 through the Google tag. Google Analytics sets cookies and records pseudonymous identifiers, the pages you view, how far you scroll, clicks on external links, the phone number, the email address and the WhatsApp link, downloads, form interactions, where your visit came from, your device type and your approximate location. I use this data for aggregated visit statistics. The legal basis is your consent (Art. 6(1)(a) GDPR).

The provider is Google Ireland Ltd., and data may be transferred to Google LLC in the USA (see Transfers to the USA). Google Analytics keeps data according to the standard settings of the service: event data for 2 months and user-level data for up to 14 months; after that, it is deleted automatically. The retention of the cookies is shown in the table in the Cookies section.

Heatmaps and session recordings with Microsoft Clarity

If you agree to the “Statistics” category, the website also loads Microsoft Clarity. The service sets cookies, stores one entry in your browser’s session storage and records how your visit goes: mouse movements, clicks, scrolling, the pages you view, your device type and browser, and your approximate location derived from your IP address. This produces heatmaps and recordings that show me how the website is used and help me improve its layout and readability. What you type into form fields is not recorded, and the forms are masked in the recordings. The legal basis is your consent (Art. 6(1)(a) GDPR).

The provider is Microsoft Ireland Operations Limited, and data may be transferred to Microsoft Corporation in the USA (see Transfers to the USA). Microsoft also processes this data as a controller in its own right, as described in the Microsoft Privacy Statement. Your consent does not cover advertising, so Clarity does not pass data from this website to Microsoft’s advertising services. The data needed to play back recordings is kept for 30 days; heatmap data and recordings I mark are kept for up to 9 months and then deleted. The retention of the cookies is shown in the table in the Cookies section.

Ad measurement with Google Ads

If you agree to the “Marketing” category, the website also loads the Google Ads tag. With it, I measure whether visits and enquiries come from my adverts, and I can show adverts to visitors of this website later (remarketing). Google sets cookies for this and can track your behaviour across websites. When you send a form, the Google tag and the Google Ads tag can send the email address and phone number you entered to Google in hashed form (SHA-256), so that Google can link an enquiry to a click on an advert. The legal basis is your consent (Art. 6(1)(a) GDPR), and the provider is Google Ireland Ltd.

Server log files

Each time you open a page, the server stores standard log data: your IP address, the date and time, the page address, your browser and your operating system. The legal basis is my legitimate interest in running the website securely and finding errors (Art. 6(1)(f) GDPR). The hosting provider keeps the server log files for up to 30 days.

Recipients

Personal data is received by:

• LH.pl sp. z o.o.: hosting of the website, the server log files, the enquiries and the consent register (servers in Poland)
• Cloudflare, Inc.: protection of the forms from bots (Turnstile)
• Google Ireland Ltd.: statistics and ad measurement (Google Analytics, Google Ads)
• Microsoft Ireland Operations Limited: heatmaps and session recordings (Microsoft Clarity)
• WhatsApp Ireland Limited: if you contact me on WhatsApp

Transfers to the USA

Google LLC (Google Analytics and Google Ads), Microsoft Corporation (Microsoft Clarity), Cloudflare, Inc. (Turnstile) and WhatsApp LLC (WhatsApp) are based in the USA and certified under the EU‑US Data Privacy Framework. The European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR) covers transfers to these companies.

Your rights

You have the right to:

• access your data and get a copy of it (Art. 15 GDPR)
• have inaccurate data corrected (Art. 16 GDPR)
• have your data erased (Art. 17 GDPR)
• have the processing of your data restricted (Art. 18 GDPR)
• receive your data in a machine-readable format (data portability, Art. 20 GDPR)
• withdraw your consent at any time with effect for the future, without affecting the lawfulness of processing before the withdrawal (Art. 7(3) GDPR)
• lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State where you live or work or where the alleged infringement took place

The supervisory authority for my business is the President of the Personal Data Protection Office (UODO) in Poland: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa.

Right to object (Art. 21 GDPR): where I process data on the basis of my legitimate interest (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation.

To exercise any of these rights, email me at info@onenet.com.pl. Providing your data is voluntary. Without the details the form requires, however, I cannot accept or deal with an enquiry.

Visitors from the United Kingdom

If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 also apply to the processing of your data. The legal bases and rights described in this policy apply in the same way. Transfers of your data to Google LLC, Microsoft Corporation and Cloudflare, Inc. in the USA are covered by UK adequacy regulations for the UK Extension to the EU‑US Data Privacy Framework, under which these companies are certified. You can also lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority, at ico.org.uk. From 30 September 2026 its functions pass to the Information Commission.

Cookies

The website stores cookies in your browser and uses similar technologies. I set necessary cookies without consent because the website needs them for the functions you request. All other categories set cookies only after you consent in the cookie banner.

The onenet_cc cookie stores your choice together with a random consent ID. If you accept at least one category other than necessary cookies, I also record this in a register on my server: the consent ID, the chosen categories, the language, the version and the time, without your IP address. The cookie and the register let me respect your choice and prove that consent was given, which the law requires me to do (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR). I keep register entries for three years.

You can change or withdraw your choice at any time with the Cookie settings link in the footer. In your browser settings, you can also decide whether cookies may be stored and delete them.