Privacy policy

For the purposes of this Policy:

• Controller — the natural person identified below who determines how and why personal data is processed when you use the site.
• Personal data — any information relating to an identified or identifiable natural person, including e.g. name, e-mail, IP address, device identifiers and data collected via cookies and similar technologies, where they identify or can identify you.
• GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council.
• Site — the codeflo.pl website and its functionality.
• User — any natural person using the site.

The controller of your personal data under the GDPR is Karol Gałan, a natural person offering services under the trade name Codeflo.

[Gliniana 15/76] [30-732] [Kraków] Poland

Correspondence on privacy matters: kontakt@codeflo.pl.

When you use the site, we process personal data only to the extent necessary to provide the features you use: contacting us (brief form), booking a meeting (embedded calendar), basic technical operation and security, and — depending on your choices — cookies and similar technologies described on our cookie page.

We do not sell your personal data. We do not run behavioural newsletters or mass marketing lists on this site beyond communication directly tied to your enquiry, unless we introduce such features and update this Policy.

Handling enquiries and the contact/brief form. We process at least your name, e-mail and optional message to respond to your request and follow up about a possible engagement (GDPR Art. 6(1)(b) — steps at your request prior to a contract / performance of a contract; and where applicable Art. 6(1)(a) — consent indicated in the form).

Meeting scheduling (Calendly). You enter data in Calendly's interface (e.g. name, e-mail, time slot). Calendly acts as an independent controller or processor according to its terms — see their privacy documentation (Art. 6(1)(b) where it is necessary to arrange a meeting at your request).

Cookies and similar technologies. As described in the Cookie policy, we use Cookiebot for consent and declarations; specific legal bases (e.g. consent or legitimate interest) depend on the category of technology.

Security, analytics within cookie choices, IT operations. Limited technical data (e.g. IP address, HTTP logs, timestamps) may be processed to operate and secure the infrastructure (GDPR Art. 6(1)(f) — legitimate interests in security and reliable provision of the site), and for analytics only as allowed by your cookie settings.

Claims. We may process data to establish, exercise or defend legal claims (GDPR Art. 6(1)(f)).

Automated decisions. We do not carry out automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you within the meaning of GDPR Art. 22.

Data from the brief form is transmitted to Formspree, which may process data outside the EEA using GDPR transfer tools (e.g. Standard Contractual Clauses) as described in their documentation.

Booking a meeting involves Calendly (potentially outside the EEA — see their documentation).

Cookie consent and technology declarations are managed by Cookiebot (Usercentrics).

If you allow statistics cookies, the site may load Google Analytics 4 (Google Ireland Limited / Google LLC) and Microsoft Clarity (Microsoft Corporation) to measure aggregate use of the site (for example traffic, interactions, and basic product diagnostics). These providers may process technical or online identifiers and related usage data, potentially including outside the EEA under GDPR transfer tools described in their privacy documentation.

The site is hosted and distributed using IT infrastructure providers (e.g. cloud / edge hosting), who may process data on our instructions as processors.

We may disclose information to public authorities where required by applicable law and a valid legal basis.

Contact/brief data is kept for as long as needed to handle the thread and any proportionate follow-up, then deleted or minimised except where a longer period is required by law or to establish, exercise or defend claims.

Technical logs are kept for shorter periods according to hosting and security configuration.

As a rule we collect data directly from you. Providing data in the contact/brief form is voluntary but necessary if you want us to respond through that channel; without it we may be unable to handle your enquiry the same way. You can adjust cookie and similar settings via your browser or device and through the cookie banner/preferences where available.

Subject to conditions in the GDPR and local law, you may have the right to:

• access your data and receive a copy;
• rectify inaccurate data;
• erase data where grounds in GDPR Art. 17 apply;
• restrict processing where grounds in GDPR Art. 18 apply;
• data portability where processing is automated and based on contract or consent;
• object to processing based on legitimate interests;
• withdraw consent at any time, without affecting lawfulness of processing before withdrawal where consent was the basis.

You may lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (uodo.gov.pl).

To exercise rights, contact: kontakt@codeflo.pl.

Details of cookies and similar technologies, vendor list after consent, and preference management are on the Cookie policy page. You can also adjust identifiers in your device or browser settings; see your vendor's help pages for your platform.

Subject to your cookie choices, we use Google Analytics 4 (measurement ID G-PDJQ1YL9JC) and Microsoft Clarity (project ID wsnu9heq5k). Those tools load only after you consent to the relevant statistics category in Cookiebot (or equivalent preference); you can change or withdraw consent at any time via the cookie banner or preference centre.

We may update the Policy to reflect changes in processing or the law. The latest version will be published on the site with an updated “Last updated” date.