Privacy Policy

This Privacy Policy explains how we process the personal data of people who use the apostrophe.pl website, and, while the new site is being rolled out, the apostrophe-cgl.pages.dev website, and of people who contact us through the form, by e-mail or by telephone.

This is a translation provided for convenience. The Polish version of this policy is the binding one. In the event of any discrepancy, the Polish text prevails.

1. Data controller

The controller of personal data is:

APOSTROPHE spółka z ograniczoną odpowiedzialnością
ul. Wybickiego 34
62-050 Mosina, Poland
KRS: 0001217558
NIP (VAT ID): 7773461103
REGON: 543739621

Office and correspondence address:
ul. Pałucka 65A
54-153 Wrocław, Poland

Contact for matters concerning personal data:

e-mail: [email protected]
telephone: +48 601 899 610

In the rest of this document we use the terms “Apostrophe”, “the Controller” or “we”.

2. What data we process

The scope of the data processed depends on how you use the site and how you contact us.

Contact form

Through the contact form we may process:

• information about who you are, for example an author, a musician or band, an online creator or a company;
• your name;
• your e-mail address;
• your telephone number, if given;
• the content of your message;
• the date and time the form was submitted;
• basic technical data relating to the submission, such as the IP address, browser information and events recorded in security logs.

Please do not include in your message any data that is not needed to handle your enquiry, in particular national identification numbers, identity document details, health data or other special categories of data.

Contact by e-mail or telephone

If you contact us directly, we may process:

• your name;
• your e-mail address;
• your telephone number;
• the name of your company or organisation;
• your position or professional role;
• information contained in your message or given during a conversation;
• data relating to further correspondence and arrangements.

Using the website

While you use the site, the technical infrastructure may process:

• the IP address;
• the date and time of the connection;
• the address of the page visited;
• information about the browser, operating system and device;
• the referring page address;
• information about errors, security and how the request was handled;
• aggregated information about traffic and site performance.

This data is processed primarily by Cloudflare, which provides hosting, content delivery, protection against abuse and performance measurement.

3. Purposes and legal bases of processing

We process personal data for the following purposes:

Replying to your message and preparing a quote

If your enquiry concerns possible cooperation, a quote or entering into a contract, we process the data in order to take steps at your request before entering into a contract.

The legal basis is Article 6(1)(b) GDPR.

Handling other correspondence

If your message does not lead directly to a contract, we process the data in order to reply, to conduct correspondence and to maintain business relationships.

The legal basis is Article 6(1)(f) GDPR, that is our legitimate interest in handling enquiries and communicating with people interested in what Apostrophe does.

Carrying out the work

If we enter into a contract, the data may be processed in order to conclude and perform it, to make arrangements, to settle accounts and to run the project.

The legal basis is Article 6(1)(b) GDPR and, as regards accounting, tax or other legal obligations, Article 6(1)(c) GDPR.

Establishing, pursuing and defending claims

We may retain correspondence and information relating to our work together where this is needed to document what was agreed or to establish, pursue or defend claims.

The legal basis is Article 6(1)(f) GDPR.

Keeping the site secure and working correctly

Technical data may be processed in order to:

• display and deliver the site;
• protect against attacks, spam and other abuse;
• diagnose errors;
• keep the contact form secure;
• maintain technical logs;
• improve the performance and availability of the site.

The legal basis is Article 6(1)(f) GDPR, that is our legitimate interest in keeping the site secure and working correctly.

Statistics and analytics

We use Cloudflare Web Analytics in order to see aggregated visit statistics and to assess the performance of the site.

According to Cloudflare, this tool does not use cookies, does not build user profiles, does not track individual people across different sites and does not record query parameters in URLs.

To the extent that the processing of technical data may be regarded as the processing of personal data, the basis is Article 6(1)(f) GDPR, that is our legitimate interest in measuring how the site works and improving it.

We do not use analytics data to make decisions about individual people.

4. Whether providing data is voluntary

Providing data is voluntary, but some of it is necessary for us to be able to reply to your message.

The form requires:

• selecting the type of person or organisation;
• your name;
• your e-mail address;
• the content of your message;
• confirmation that you have read the Privacy Policy.

The telephone number is optional.

If the required fields are not completed, the form cannot be sent. You can still contact us directly by e-mail or telephone.

5. How long we keep data

We keep data no longer than is necessary for the purpose for which it was collected.

In particular:

• data from enquiries that did not lead to cooperation is kept as a rule for 12 months from the end of the correspondence;
• where correspondence may be needed to establish, pursue or defend claims, we may keep it until the relevant limitation period expires, which depending on the type of matter may be 3 or 6 years;
• data relating to a concluded contract is kept for the period of its performance and then for the time required by tax, accounting and limitation rules;
• technical data and security logs are kept for the period resulting from the configuration of Cloudflare services and for the time needed to detect errors and abuse;
• according to Cloudflare documentation, non-aggregated Cloudflare Web Analytics data is kept for 7 days, and aggregated statistics are available for up to 6 months.

Once the relevant periods have passed, data is deleted or anonymised, unless further retention is required by law.

6. Recipients of the data

Data may be passed to entities that provide us with services necessary to run the site and handle correspondence.

Currently these are in particular:

• Cloudflare, Inc. – hosting of the site on Cloudflare Pages, network infrastructure, security, operation of the form function and Cloudflare Web Analytics;
• Plus Five Five, Inc., trading as Resend – technical delivery of form messages to our e-mail inbox;
• LH.pl sp. z o.o. – maintenance of the company mailbox in the apostrophe.pl domain;
• IT service providers engaged to maintain or develop the site;
• legal, accounting or advisory service providers, where access to data is needed to perform their services;
• public authorities, where the obligation to disclose data follows from the law.

Entities acting on our instructions may process data only to the extent needed to perform the services entrusted to them.

Data sent through the form is passed by a function running in Cloudflare infrastructure to the Resend service, and then to the [email protected] inbox maintained by LH.pl.

7. Transfers outside the European Economic Area

Cloudflare and Resend are United States providers, so data may also be processed outside the European Economic Area, in particular in the United States.

Cloudflare states that it relies on the EU–US Data Privacy Framework. Where that mechanism does not apply, Cloudflare uses standard contractual clauses approved by the European Commission.

Resend uses the European Commission’s standard contractual clauses for transfers outside the EEA.

Providers may use further processors in accordance with their own data processing agreements. Information about current safeguards and sub-processors can be found in the providers’ documentation:

• Cloudflare privacy policy;
• Cloudflare data processing addendum;
• Resend privacy policy;
• Resend data processing agreement;
• Resend list of sub-processors.

You are welcome to contact us if you would like more information about the safeguards in place.

8. Cookies and similar technologies

The site does not use advertising or remarketing cookies, or tools that track users across different websites.

Cloudflare Web Analytics works without cookies. The tool uses technical browser information needed to measure visits and site performance.

In certain situations Cloudflare may use technical mechanisms necessary for the security of the site, for example when protecting against automated attacks or abuse. These mechanisms are not used by Apostrophe for advertising or profiling.

Because the site does not currently use optional analytics or marketing cookies that require consent, we do not display a banner asking you to accept them.

If in future we add tools that require storing or reading optional information on your device, we will put an appropriate consent mechanism in place before switching them on, and we will update this Policy.

9. Links to other sites

The site may contain links to external services, among them Google Maps.

The Google map is not embedded directly in our site. Data is passed to Google only after you click the link and move to Google Maps. From that moment the data is processed according to the rules applying to that external service.

We are not responsible for the privacy practices of the owners of external sites.

10. Your rights

Depending on the basis and circumstances of the processing, you have the right to:

• be informed about the processing of your data;
• access your data and receive a copy of it;
• have incorrect or incomplete data rectified;
• have your data erased;
• have the processing restricted;
• data portability, where the processing is based on a contract or consent and is carried out by automated means;
• object to processing based on our legitimate interest;
• withdraw your consent, where particular processing is based on it;
• lodge a complaint with the President of the Personal Data Protection Office.

Withdrawing consent does not affect the lawfulness of processing carried out before it was withdrawn.

These rights are not absolute. In certain cases we may continue to process data where the law requires it or where it is necessary to establish, pursue or defend claims.

To exercise your rights, please contact us at:

[email protected]

We may ask for information allowing us to confirm the identity of the person making the request.

If you consider that we process data unlawfully, you may lodge a complaint with:

Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office)
ul. Stanisława Moniuszki 1A
00-014 Warszawa, Poland
https://uodo.gov.pl

11. Automated decision-making

We do not use the data of people who contact us to make decisions based solely on automated processing that would produce legal effects concerning them or similarly significantly affect them.

We do not carry out profiling on the basis of data from the contact form or from Cloudflare Web Analytics.

12. Data security

We apply organisational and technical measures appropriate to the nature of the data processed, in particular:

• encryption of the connection to the site using HTTPS;
• restricting access to data to people who need it to carry out their duties;
• protecting the form against the injection of malicious code;
• mechanisms limiting automated spam;
• using providers that secure the infrastructure and the transmission of data;
• keeping software up to date and controlling access to services.

No method of transmitting or storing data can, however, guarantee complete security.

13. Changes to this Privacy Policy

This Policy may be updated if the way the site works, the services it uses or the applicable law change.

The current version is always published on this page together with the date of the last update. Significant changes may additionally be announced in a visible place on the site.