PRIVACY AND COOKIES POLICY

§1. Data Controller

The controller of your personal data is: Push Agency Dawid Śliwiński, located at: ul. Łagodna 4B, 63-004 Gowarzewo, Poland, VAT ID (NIP): PL6972347119.

You can contact the Data Controller regarding personal data protection and the exercise of your statutory rights via email: [email protected].

§2. Purposes, Legal Grounds, and Data Retention Periods

Your personal data is processed solely for specified, lawful business purposes:

• Handling contact forms and discovery inquiries:
  • Data categories: Full name, business email address, phone number, store URL, estimated monthly revenue, and message content.
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interests of the Controller in managing business correspondence) or Art. 6(1)(b) GDPR (taking steps at the request of the data subject prior to entering into a contract).
  • Retention period: For the duration necessary to resolve the inquiry and until the expiration of potential claims arising from the correspondence.
• Booking diagnostic audits / strategy sessions (Cal.com widget):
  • Data categories: Full name, business email address, store URL, monthly revenue range, selected date, and time slot.
  • Legal basis: Art. 6(1)(b) GDPR (performance of pre-contractual measures to deliver the scheduled audit or consultation).
  • Retention period: Until the completion of the consultation or for the duration of any ongoing commercial relationship.
• Website analytics, performance, and CRO tracking:
  • Data categories: Anonymized IP addresses, cookie identifiers, device specifications, and user behavioral paths.
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interests in analyzing performance and optimizing technical infrastructure) or Art. 6(1)(a) GDPR (user consent granted via the cookie preference center).
  • Retention period: Until cookie expiration or until an effective objection/revocation of consent is submitted.
• Accounting, statutory compliance, and invoicing (upon engagement):
  • Data categories: Company name, EU VAT/tax ID, registered business address, authorized representative full name.
  • Legal basis: Art. 6(1)(c) GDPR (compliance with statutory legal and tax obligations).
  • Retention period: For the statutory period required under applicable commercial and tax law (5 years following the end of the tax year).

§3. Data Processors and Service Providers

The Data Controller engages vetted third-party infrastructure providers who process data strictly under relevant data processing agreements:

• Hosting & Email Infrastructure: LH.pl Sp. z o.o. (secure server hosting and email operations).
• Appointment Scheduling Engine: Cal.com, Inc. (calendar automation and audit scheduling).
• Analytical & CRO Tooling: Google Ireland Limited / Google LLC (Google Analytics 4, Google Tag Manager).
• Accounting & Tax Services: Licensed external accountancy firm managing the Controller’s statutory records.

§4. International Data Transfers (Outside the EEA)

When using services such as Google Analytics and Cal.com, certain technical data may be processed on servers located outside the European Economic Area (e.g., in the United States). All transfers comply with Chapter V of the GDPR via:

• The European Commission’s adequacy decision under the EU-U.S. Data Privacy Framework for certified entities.
• Standard Contractual Clauses (SCCs) issued by the European Commission, ensuring adequate safeguards and enforceable data subject rights.

§5. Cookies and Local Storage

The website uses cookies — small text files stored locally on your device to maintain session state and collect technical telemetry.

• Strictly Necessary Cookies: Essential for site routing, security, and consent management. These do not require explicit prior consent.
• Analytics & Performance Cookies: Used to evaluate user navigation flow (e.g., Google Analytics 4) and integrate third-party functionality (e.g., Cal.com scheduling). Activated only upon explicit consent.
• Managing Cookie Settings: You can modify your cookie settings, reject optional cookies, or clear local storage at any time via your browser preferences or our on-site preference manager. Disabling certain cookies may impair specific interactive functions (e.g., embedded calendars).

§6. Your Rights Under GDPR

Under Regulation (EU) 2016/679 (GDPR), you hold the following enforceable rights:

• Right of access to your personal data and to receive a copy (Art. 15 GDPR).
• Right to rectification of inaccurate or incomplete data (Art. 16 GDPR).
• Right to erasure (“right to be forgotten”) (Art. 17 GDPR).
• Right to restriction of processing (Art. 18 GDPR).
• Right to data portability (Art. 20 GDPR).
• Right to object to processing grounded in legitimate interests (Art. 21 GDPR).
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to lodge a complaint with a supervisory authority: President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, or the local data protection authority within your EU Member State.

§7. Automated Decision-Making and Profiling

Your personal data is not subject to automated decision-making processes, including profiling that produces legal effects or similarly significantly impacts you.

§8. Policy Updates

The Data Controller reserves the right to amend this Privacy Policy to reflect changes in legal requirements, technical stack updates, or operational adjustments. The prevailing version is always accessible at: https://push.com.pl/en/privacy-policy/.