Privacy Policy
We collect your contact details only when you reach out to us yourself — by filling in a form on the website or in our ads on Facebook and Instagram, by email or messenger, or by phone. We use them to reply to you and to run your project, and we do not sell them or share them for marketing. Advertising and analytics tools (Google Ads, Meta Pixel, Google Analytics, Microsoft Clarity) are switched on only after you consent in the cookie settings. Below, point by point: who is responsible for your data, what exactly we keep, for how long, and how to have it deleted.
Data controller
The controller of your personal data is a natural person running a business under the IT Deweloper brand. The data is stored and processed personally, without being handed to anyone else.
Victor Parhimchik (Wiktor Parchimczyk)
founder and owner of the web studio IT Deweloper
- VAT ID (NIP) 5423493188
- Nowogródzka 4A, 15-490 Białystok, Poland
-
This email address is being protected from spambots. You need JavaScript enabled to view it. - +48 731 190 041
No Data Protection Officer (DPO) has been appointed — the law does not require one for a business of this size. All data matters are handled personally, at
What data we collect
We do not buy databases and we do not gather information about you from outside sources. Everything we hold, you gave us yourself.
When you write or call
The contact form, the brief and the online calculator deliver exactly what you typed into them: your name, e-mail, optionally a phone number, the text of your message and any files you attached. The same goes for an e-mail, a WhatsApp or Telegram message and a phone call — we are left with your address, number or handle and the content of the conversation.
When you submit a request on Facebook or Instagram
When you fill in a form in our ad on Facebook or Instagram, Meta passes to us what you entered: name, email, phone number and your answers to the form questions. Some fields are pre-filled from your Meta profile — you can see and change them before submitting.
What the server records
Like any website, our server keeps a technical log: IP address, date and time of the request, the page opened, browser type. This serves the operation and security of the site, not the identification of you.
Cookies
Technical cookies to run the site and remember your banner choice, plus analytics and advertising cookies — the latter only with your consent. Details in “Cookies and similar technologies”.
What we do not do
We do not build a profile of you, we do not make automated decisions about you (Art. 22 GDPR), and we do not collect special categories of data — about health, beliefs or religion (Art. 9 GDPR). Google Analytics and Microsoft Clarity work only with your consent to the “Statistics” category. The Google Ads and Meta advertising pixels work only with your consent to the “Marketing” category: they let us see whether an ad led to an enquiry and show our ads to people who have already visited the site.
Purposes and legal bases for processing
| What for | Which data | Legal basis under the GDPR |
|---|---|---|
| Answer your enquiry, quote a price, discuss the project | contact details and the text of the enquiry | Art. 6(1)(b) steps taken at your request before entering into a contract |
| Perform the contract: development, support, handover of access | contact and contractual data | Art. 6(1)(b) performance of a contract |
| Issue an invoice and report to the tax office | data required for the documents | Art. 6(1)(c) legal obligation (Polish Tax Ordinance, Accounting Act) |
| Keep the site running and protected from spam | technical server logs | Art. 6(1)(f) legitimate interest |
| Show the location map on the “Contact” page | your request to the map service | Art. 6(1)(a) your consent |
| Understand how visitors use the site — which pages are popular, whether navigation works well | anonymised visit statistics via Google Analytics | Art. 6(1)(a) your consent |
| Defend against possible claims | correspondence and project documents | Art. 6(1)(f) legitimate interest |
| Handle a request submitted through a Facebook or Instagram form | data you entered in the form | Art. 6(1)(b) steps at your request before entering into a contract |
| Measure ad performance and show ads to site visitors | cookie identifiers, visit and enquiry data (Google Ads, Meta Pixel) | Art. 6(1)(a) your consent |
| Improve site usability | records of on-page behaviour — clicks, scrolling (Microsoft Clarity) | Art. 6(1)(a) your consent |
We don't send mailings. Your contact details are not used for advertising — advertising tools receive only technical visit data, and only with your consent.
Data retention period
- Correspondence that did not lead to cooperationup to 12 months from the last message
- Project and contract datafor the duration of the work plus 6 years — the limitation period for claims under the Polish Civil Code
- Accounting documents5 years from the end of the year in which the tax payment fell due
- Web server logsup to 12 months
- The cookie holding your choice (
yootheme_consent)30 days, after which the banner asks again - Session cookieuntil the browser session ends
- Requests from Facebook and Instagram formssame as correspondence: up to 12 months if no cooperation started
- Google Ads cookie (
_gcl_au)90 days - Meta Pixel cookie (
_fbp)90 days - Microsoft Clarity cookies (
_clck,_clsk)up to 12 months
If you withdraw consent or ask us to delete your data, we will delete it — except for what we are required by law to keep, such as invoices and accounting records.
User rights
Under the GDPR you have the right to:
- know what data we hold about you and receive a copy of it Art. 15
- rectify inaccurate or incomplete data Art. 16
- erase your data — the “right to be forgotten” Art. 17
- restrict processing Art. 18
- receive your data in a machine-readable format and transfer it to another controller Art. 20
- object to processing based on legitimate interest Art. 21
- withdraw consent at any time — this does not affect the lawfulness of processing before the withdrawal Art. 7(3)
To exercise any of these, write to
Complaint to the supervisory authority
If you believe we are processing your data improperly, you have the right to lodge a complaint with the Polish supervisory authority:
Prezes Urzędu Ochrony Danych Osobowych (PUODO)
ul. Stawki 2, 00-193 Warszawa, PL — uodo.gov.pl
Cookies and similar technologies
On your first visit you see a banner with the buttons “Accept”, “Reject” and “Manage cookies”. Until you agree, optional cookies and external services do not load at all — this is an opt-in model, not “consent by default”.
Maintains the session and protects forms against request forgery. The name is generated at random.
until the browser session endsyootheme_consentnecessaryRemembers your choice in the banner so you are not asked on every visit.
30 daysShows the interactive location map on the “Contact” page.
loads only after consent_ga, _ga_*)with consentCounts visits and on-site behaviour as aggregate statistics. Set only after you consent to the “Statistics” category.
up to 13 months_clck, _clsk)with consentShows how visitors use the pages (clicks, scrolling) so we can make the site easier to use. Set only after consent to the “Statistics” category.
up to 12 months_gcl_au)with consentLets us see whether a Google ad led to an enquiry. Set only after consent to the “Marketing” category.
90 days_fbp)with consentLets us measure ads on Facebook and Instagram and show them to site visitors. Set only after consent to the “Marketing” category.
90 daysYou can change your decision at any time: the “Manage cookies” button opens the same dialogue with the categories. Cookies can also be deleted separately in your browser settings.
The “I am not a robot” check
Forms are protected by PowCaptcha: it solves a small computational task directly in your browser. It does not track you, does not set cookies and does not send data to third-party services — unlike the usual picture-based captchas.
Sharing data with third parties
We do not sell data or share your contacts for marketing. Data leaves our correspondence only where the service cannot work otherwise, or where you have consented.
- dhosting.pl sp. z o.o. hosting, Poland
The site, the database, the mail and the backups physically live on its servers. This is a processor under Art. 28 GDPR; the data stays on Polish territory, that is, within the EEA.
- OpenStreetMap Foundation maps, with consent
Connects only if you allowed the map. At that moment your IP address becomes visible to the map service's servers.
- Google Ireland Limited analytics and ads, with consent
Google Analytics — visit statistics, enabled only after consent to “Statistics”. Google Ads — ad performance measurement, enabled only after consent to “Marketing”. Part of the processing takes place outside the EEA under Google's certification to the EU–US Data Privacy Framework.
- Meta Platforms Ireland Ltd. advertising, with consent
Meta Pixel sends website visit data only after consent to “Marketing”; for this processing we and Meta are joint controllers (Art. 26 GDPR). If you submit a request through a Facebook or Instagram form, it passes through Meta. Part of the processing takes place outside the EEA under the EU–US Data Privacy Framework.
- Microsoft Ireland Operations Ltd. analytics, with consent
Microsoft Clarity is enabled only after consent to “Statistics”. Part of the processing takes place outside the EEA under the EU–US Data Privacy Framework.
- WhatsApp and Telegram you choose the channel
If you write to us on a messenger yourself, the conversation is processed under those services' own rules and some data may be processed outside the EEA. If this matters to you, write by e-mail.
- Accounting and state authorities required by law
Only to the extent expressly required by legislation.
Data may leave the EEA via Google, Meta and Microsoft — only with your consent or when you contact us through their services yourself; nothing else is transferred outside the EEA.
Document version:
We collect your contact details only when you reach out to us yourself — by filling in a form on the website or in our ads on Facebook and Instagram, by email or messenger, or by phone. We use them to reply to you and to run your project, and we do not sell them or share them for marketing. Advertising and analytics tools (Google Ads, Meta Pixel, Google Analytics, Microsoft Clarity) are switched on only after you consent in the cookie settings. Below, point by point: who is responsible for your data, what exactly we keep, for how long, and how to have it deleted.
Data controller
The controller of your personal data is a natural person running a business under the IT Deweloper brand. The data is stored and processed personally, without being handed to anyone else.
Victor Parhimchik (Wiktor Parchimczyk)
founder and owner of the web studio IT Deweloper
- VAT ID (NIP) 5423493188
- Nowogródzka 4A, 15-490 Białystok, Poland
-
This email address is being protected from spambots. You need JavaScript enabled to view it. - +48 731 190 041
No Data Protection Officer (DPO) has been appointed — the law does not require one for a business of this size. All data matters are handled personally, at
What data we collect
We do not buy databases and we do not gather information about you from outside sources. Everything we hold, you gave us yourself.
When you write or call
The contact form, the brief and the online calculator deliver exactly what you typed into them: your name, e-mail, optionally a phone number, the text of your message and any files you attached. The same goes for an e-mail, a WhatsApp or Telegram message and a phone call — we are left with your address, number or handle and the content of the conversation.
When you submit a request on Facebook or Instagram
When you fill in a form in our ad on Facebook or Instagram, Meta passes to us what you entered: name, email, phone number and your answers to the form questions. Some fields are pre-filled from your Meta profile — you can see and change them before submitting.
What the server records
Like any website, our server keeps a technical log: IP address, date and time of the request, the page opened, browser type. This serves the operation and security of the site, not the identification of you.
Cookies
Technical cookies to run the site and remember your banner choice, plus analytics and advertising cookies — the latter only with your consent. Details in “Cookies and similar technologies”.
What we do not do
We do not build a profile of you, we do not make automated decisions about you (Art. 22 GDPR), and we do not collect special categories of data — about health, beliefs or religion (Art. 9 GDPR). Google Analytics and Microsoft Clarity work only with your consent to the “Statistics” category. The Google Ads and Meta advertising pixels work only with your consent to the “Marketing” category: they let us see whether an ad led to an enquiry and show our ads to people who have already visited the site.
Purposes and legal bases for processing
| What for | Which data | Legal basis under the GDPR |
|---|---|---|
| Answer your enquiry, quote a price, discuss the project | contact details and the text of the enquiry | Art. 6(1)(b) steps taken at your request before entering into a contract |
| Perform the contract: development, support, handover of access | contact and contractual data | Art. 6(1)(b) performance of a contract |
| Issue an invoice and report to the tax office | data required for the documents | Art. 6(1)(c) legal obligation (Polish Tax Ordinance, Accounting Act) |
| Keep the site running and protected from spam | technical server logs | Art. 6(1)(f) legitimate interest |
| Show the location map on the “Contact” page | your request to the map service | Art. 6(1)(a) your consent |
| Understand how visitors use the site — which pages are popular, whether navigation works well | anonymised visit statistics via Google Analytics | Art. 6(1)(a) your consent |
| Defend against possible claims | correspondence and project documents | Art. 6(1)(f) legitimate interest |
| Handle a request submitted through a Facebook or Instagram form | data you entered in the form | Art. 6(1)(b) steps at your request before entering into a contract |
| Measure ad performance and show ads to site visitors | cookie identifiers, visit and enquiry data (Google Ads, Meta Pixel) | Art. 6(1)(a) your consent |
| Improve site usability | records of on-page behaviour — clicks, scrolling (Microsoft Clarity) | Art. 6(1)(a) your consent |
We don't send mailings. Your contact details are not used for advertising — advertising tools receive only technical visit data, and only with your consent.
Data retention period
- Correspondence that did not lead to cooperationup to 12 months from the last message
- Project and contract datafor the duration of the work plus 6 years — the limitation period for claims under the Polish Civil Code
- Accounting documents5 years from the end of the year in which the tax payment fell due
- Web server logsup to 12 months
- The cookie holding your choice (
yootheme_consent)30 days, after which the banner asks again - Session cookieuntil the browser session ends
- Requests from Facebook and Instagram formssame as correspondence: up to 12 months if no cooperation started
- Google Ads cookie (
_gcl_au)90 days - Meta Pixel cookie (
_fbp)90 days - Microsoft Clarity cookies (
_clck,_clsk)up to 12 months
If you withdraw consent or ask us to delete your data, we will delete it — except for what we are required by law to keep, such as invoices and accounting records.
User rights
Under the GDPR you have the right to:
- know what data we hold about you and receive a copy of it Art. 15
- rectify inaccurate or incomplete data Art. 16
- erase your data — the “right to be forgotten” Art. 17
- restrict processing Art. 18
- receive your data in a machine-readable format and transfer it to another controller Art. 20
- object to processing based on legitimate interest Art. 21
- withdraw consent at any time — this does not affect the lawfulness of processing before the withdrawal Art. 7(3)
To exercise any of these, write to
Complaint to the supervisory authority
If you believe we are processing your data improperly, you have the right to lodge a complaint with the Polish supervisory authority:
Prezes Urzędu Ochrony Danych Osobowych (PUODO)
ul. Stawki 2, 00-193 Warszawa, PL — uodo.gov.pl
Cookies and similar technologies
On your first visit you see a banner with the buttons “Accept”, “Reject” and “Manage cookies”. Until you agree, optional cookies and external services do not load at all — this is an opt-in model, not “consent by default”.
Maintains the session and protects forms against request forgery. The name is generated at random.
until the browser session endsyootheme_consentnecessaryRemembers your choice in the banner so you are not asked on every visit.
30 daysShows the interactive location map on the “Contact” page.
loads only after consent_ga, _ga_*)with consentCounts visits and on-site behaviour as aggregate statistics. Set only after you consent to the “Statistics” category.
up to 13 months_clck, _clsk)with consentShows how visitors use the pages (clicks, scrolling) so we can make the site easier to use. Set only after consent to the “Statistics” category.
up to 12 months_gcl_au)with consentLets us see whether a Google ad led to an enquiry. Set only after consent to the “Marketing” category.
90 days_fbp)with consentLets us measure ads on Facebook and Instagram and show them to site visitors. Set only after consent to the “Marketing” category.
90 daysYou can change your decision at any time: the “Manage cookies” button opens the same dialogue with the categories. Cookies can also be deleted separately in your browser settings.
The “I am not a robot” check
Forms are protected by PowCaptcha: it solves a small computational task directly in your browser. It does not track you, does not set cookies and does not send data to third-party services — unlike the usual picture-based captchas.
Sharing data with third parties
We do not sell data or share your contacts for marketing. Data leaves our correspondence only where the service cannot work otherwise, or where you have consented.
- dhosting.pl sp. z o.o. hosting, Poland
The site, the database, the mail and the backups physically live on its servers. This is a processor under Art. 28 GDPR; the data stays on Polish territory, that is, within the EEA.
- OpenStreetMap Foundation maps, with consent
Connects only if you allowed the map. At that moment your IP address becomes visible to the map service's servers.
- Google Ireland Limited analytics and ads, with consent
Google Analytics — visit statistics, enabled only after consent to “Statistics”. Google Ads — ad performance measurement, enabled only after consent to “Marketing”. Part of the processing takes place outside the EEA under Google's certification to the EU–US Data Privacy Framework.
- Meta Platforms Ireland Ltd. advertising, with consent
Meta Pixel sends website visit data only after consent to “Marketing”; for this processing we and Meta are joint controllers (Art. 26 GDPR). If you submit a request through a Facebook or Instagram form, it passes through Meta. Part of the processing takes place outside the EEA under the EU–US Data Privacy Framework.
- Microsoft Ireland Operations Ltd. analytics, with consent
Microsoft Clarity is enabled only after consent to “Statistics”. Part of the processing takes place outside the EEA under the EU–US Data Privacy Framework.
- WhatsApp and Telegram you choose the channel
If you write to us on a messenger yourself, the conversation is processed under those services' own rules and some data may be processed outside the EEA. If this matters to you, write by e-mail.
- Accounting and state authorities required by law
Only to the extent expressly required by legislation.
Data may leave the EEA via Google, Meta and Microsoft — only with your consent or when you contact us through their services yourself; nothing else is transferred outside the EEA.
Document version: