Privacy Policy
Contents
1. Data controller
The data controller responsible for your personal data is:
Trading as Olmedo Flores
KRS: 0001159081 · NIP (VAT): PL6762688564
ul. Wielicka 28, budynek B, 3. piętro · 30-552 Kraków · Poland · European Union
Contact: our contact form
As a Polish limited liability company registered in the European Union, we are subject to Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and the Polish Act on Personal Data Protection of 10 May 2018.
2. Personal data we collect
We only collect personal data that you provide voluntarily through our contact form. We do not use tracking pixels, advertising networks, or behavioural analytics tools.
| Data Field | Required? | Purpose |
|---|---|---|
| Full name | Yes | Identify and address you in correspondence |
| Company name | No | Understand your organisational context |
| Email address | Yes | Respond to your inquiry |
| Phone number | No | Alternative contact for scheduling a discovery call |
| Service interest | No | Route your inquiry to the right expertise |
| Budget range | No | Assess project fit and scope a relevant proposal |
| Project description | Yes | Understand your challenge and prepare a meaningful response |
We do not collect sensitive personal data (special categories under GDPR Art. 9), financial account details, or data relating to minors.
3. Purposes & legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Responding to your project inquiry and scheduling a discovery call | Art. 6(1)(b) – necessary for pre-contractual measures taken at your request |
| Preparing and sending a project proposal | Art. 6(1)(b) – pre-contractual / Art. 6(1)(f) – legitimate interest |
| Maintaining records of business correspondence | Art. 6(1)(f) – legitimate interest in operating our business |
| Complying with legal obligations (e.g. accounting records) | Art. 6(1)(c) – legal obligation |
We do not use your data for automated decision-making or profiling (GDPR Art. 22).
4. Retention periods
- Inquiry data (no contract signed): retained for up to 2 years from the date of your last contact, then securely deleted.
- Project / contract data: retained for 5 years from the end of the contractual relationship, in accordance with Polish accounting law (Ustawa o rachunkowości, Art. 74).
- Email correspondence: retained for up to 3 years from last contact, in line with the general statute of limitations for civil claims under Polish law.
When the applicable retention period expires, data is deleted or anonymised so that it can no longer be linked to you.
5. Third-party processors
We share your data only with processors that are necessary for operating this website. We do not sell your data to any third party.
| Processor | Service | Location | Privacy Reference |
|---|---|---|---|
| Formsubmit.co | Contact form relay – forwards your form submission to our email address | USA | formsubmit.co/privacy |
| Netlify, Inc. | Static website hosting – serves all pages of this site | USA | netlify.com/privacy |
| Google LLC (Fonts) | Inter typeface loaded via Google Fonts CDN | USA | policies.google.com/privacy |
| Cloudflare, Inc. | Font Awesome icon library loaded via CDN | USA | cloudflare.com/privacypolicy |
6. International transfers
Some of our processors (Netlify, Formsubmit.co, Google, Cloudflare) are based in the United States. Transfers of personal data to these processors are made on the basis of:
- Standard Contractual Clauses (SCCs) approved by the European Commission under GDPR Art. 46(2)(c), and/or
- EU–US Data Privacy Framework (where the processor is certified).
You can request a copy of the relevant safeguards by contacting us at the address below.
7. Your rights under GDPR
As a data subject under GDPR, you have the following rights. To exercise any of them, contact us at the contact form. We will respond within 30 days.
| Right | What it means |
|---|---|
| Access (Art. 15) | Obtain a copy of your personal data and information about how we process it. |
| Rectification (Art. 16) | Correct inaccurate or incomplete data we hold about you. |
| Erasure (Art. 17) | Request deletion of your data when it is no longer necessary for the purposes collected, or when you withdraw consent. |
| Restriction (Art. 18) | Request that we limit the processing of your data in certain circumstances. |
| Portability (Art. 20) | Receive your data in a structured, machine-readable format and transfer it to another controller. |
| Objection (Art. 21) | Object to processing based on legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds. |
| Withdraw consent | Where processing is based on consent, withdraw it at any time without affecting prior processing. |
8. Cookies & tracking
localStorage (key: fd_lang)
to remember your language preference. This is a functional preference and does not
identify you personally. No consent is required under the ePrivacy Directive for
strictly necessary functional storage.
We do not use Google Analytics, Facebook Pixel, or any other third-party tracking scripts. If analytics are added in the future, this policy will be updated and a consent mechanism will be implemented before any data is collected.
9. Supervisory authority
You have the right to lodge a complaint with the competent data protection supervisory authority. As we are registered in Poland, the relevant authority is:
Polish Data Protection Authority
ul. Stawki 2, 00-193 Warsaw, Poland
uodo.gov.pl · kancelaria@uodo.gov.pl
If you are located in another EU/EEA member state, you may also contact your local supervisory authority.
10. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be indicated by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
11. Contact Us
For any privacy-related questions, requests to exercise your rights, or complaints, please contact us:
Data protection contact
Olmedo Flores Sp. z o.o. (Olmedo Flores)
Krakow, Poland · EU
We aim to respond to all privacy requests within 30 days.