Privacy Policy

Last updated: 20 October 2026

1. Who we are

This policy covers our own website, enquiries and client relationships, including projects for business systems with a connected website. Where we process personal data solely on behalf of a client through their system or website, the client acts as data controller and that processing is governed by their documented instructions and a data processing agreement. The client's privacy notice explains how their customers' or users' data is used.

2. What data we collect

• Contact and enquiry data: name, email address, phone number, company name, business type, selected services or plan, project requirements, references, preferred timeline and the content of your message, when you use our contact form, email us or message us on WhatsApp.
• Client and billing data: name or company name, billing address, VAT/tax identification number and payment references, when you become a client.
• Client system data, where applicable: account details, customer contact information, quotes, orders, bookings, uploaded files or other business records handled through the features agreed for a client's system. Where processed on the client's behalf, these data are handled under the arrangements described in section 1.
• Technical data: IP address, browser and device information, pages visited and approximate location, collected through cookies and analytics tools (see section 7).
• Cookie consent records: when you make a choice in the cookie banner, we record your selected preferences together with an anonymised IP address, date and time, browser and device information and the page where the choice was made, to be able to demonstrate your consent.
• Automated assistant conversations: messages you type into the automated chat assistant on this website, processed in real time to generate responses. We do not permanently store these conversations on our servers.

3. Why we process your data and on what legal basis

• To respond to enquiries and prepare quotes — legitimate interest (Art. 6(1)(f) GDPR) and pre-contractual steps (Art. 6(1)(b) GDPR).
• To design, build, operate and maintain agreed systems and websites, manage projects and invoice clients — performance of a contract (Art. 6(1)(b) GDPR) and legal obligations regarding accounting and tax (Art. 6(1)(c) GDPR).
• To analyse website traffic and improve our services — your consent (Art. 6(1)(a) GDPR), given through the cookie banner.
• To operate the automated chat assistant — your consent, given by choosing to use the assistant and through the cookie banner.
• To keep a record of your cookie consent choices — compliance with our legal obligation to demonstrate consent (Art. 6(1)(c) and Art. 7(1) GDPR).

For personal data processed solely on behalf of a client within their system or website, the client determines the appropriate legal basis and we process the data under their documented instructions and the applicable data processing agreement.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects concerning you.

4. Who we share data with

We do not sell personal data. We share data only with service providers necessary to run this website and deliver, host and maintain the agreed systems and websites:

• Hosting: Hostinger International Ltd., which hosts this website and stores form submissions, and hosts client systems and websites where provided on our hosting infrastructure.
• Website and system software: WordPress and related plugins running on our hosting infrastructure.
• Analytics: Google Analytics (Google Ireland Ltd. / Google LLC), used only with your consent.
• Automated assistant: external automated-assistant technology providers whose language processing technology powers our chat assistant and whose servers may be located in the United States. Conversations are processed by these providers to generate responses. Do not share sensitive personal information in the chat.
• Messaging: WhatsApp (Meta Platforms Ireland Ltd.) if you choose to contact us through it.
• Agreed system integrations: providers of payment, booking, messaging or other business tools expressly included in a client's project. Access to client-controlled personal data is subject to the applicable data processing arrangements.
• Domain registration: accredited domain registrars, where a domain is registered, renewed or transferred as part of a client's service, to the extent registrant contact details are required by the registrar.
• Invoicing and accounting: Fundacja Firma Dla Każdego, as the invoicing entity, and its accounting providers.

5. International transfers

Some of the providers listed above process data outside the European Economic Area, in particular in the United States. Where this happens, transfers are protected by the European Commission's Standard Contractual Clauses or an applicable adequacy decision, such as the EU–US Data Privacy Framework.

6. How long we keep data

• Enquiries that do not become projects: up to 12 months.
• Client and billing data: for the duration of the contract and afterwards for the period required by Polish accounting and tax law (generally 5 years from the end of the relevant tax year).
• Personal data processed on behalf of a client within their system or website: according to the documented retention, return and deletion arrangements in the applicable service and data processing agreements, subject to legal retention requirements.
• Analytics data: according to the retention period configured in Google Analytics (maximum 14 months).
• Cookie consent records: up to 2 years from the date of your choice, after which they are automatically deleted.
• Automated assistant conversations: not stored permanently on our servers; processing by our external technology providers is governed by their own retention policies.

7. Cookies

This website uses the following categories of cookies, which you can manage at any time through the cookie banner:

• Essential cookies: required for the website to function. They cannot be switched off.
• Performance cookies: help the website load quickly (caching and internal performance).
• Functionality cookies: enable features such as the automated chat assistant, the contact form and the WhatsApp button. Only the chat assistant relies on external technology providers whose servers may be located in the United States; contact form submissions are stored on our hosting in the EU.
• Analytics and marketing cookies: used to measure traffic and conversions (Google Analytics), as described in section 3.

Non-essential cookies are set only with your consent, which you can give, refuse or change at any time through the cookie banner. Refusing non-essential cookies does not limit your access to the website.

For a client's own system or website, the relevant privacy notice and cookie controls must reflect the features and providers used in that particular project.

8. Your rights

Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time without affecting prior processing. To exercise any of these rights, write to contact@wtdigital.studio. You also have the right to lodge a complaint with the Polish supervisory authority: President of the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, uodo.gov.pl, or with the supervisory authority of your own EU country.

If your request concerns data held within one of our clients' systems or websites, contact that business as data controller. Where we process the data on its behalf, we assist it with the request under the applicable data processing agreement.

9. Changes to this policy

We may update this policy to reflect changes in our services or legal requirements. The current version, with its date, will always be published on this page.