Privacy Policy

Effective date: 16 July 2026. 1. Who is responsible for personal data The controller of personal data is Szymon Lech, conducting business under the name Lech Forge - Szymon Lech, NIP: 5223331943, address: ul. Masztowa 13, 78-132 Grzybowo. For matters concerning personal data, you may contact: - by e-mail: kontakt@lech-forge.pl, - by post: ul. Masztowa 13, 78-132 Grzybowo. 2. Scope of the Privacy Policy This Policy describes the rules for processing data related to the use of the Lech Forge website, in particular: - the contact form, - the private mini-chat, - website and administrator panel security measures, - essential cookies and browser storage. The website does not use Google Analytics, advertising pixels, marketing cookies, or tools for profiling user behaviour. 3. Contact form The contact form is used to submit an enquiry and to arrange further contact regarding a project or Lech Forge services. Through the form, the following may be processed: - first and last name or company name, - e-mail address or telephone number, - preferred contact method, - message subject, - optionally the type of service, - message content, - submission reference number, - website language, - IP address hash used for spam protection, - information about the version of the clause displayed when the form was submitted. Providing a first and last name or company name and at least one contact method — e-mail or telephone — is required, because without these data it will not be possible to provide a response. Other data are provided voluntarily. After the form is submitted: - the submission is stored in the database, - its content is sent to kontakt@lech-forge.pl, - the user receives confirmation only on screen together with the submission reference number — Lech Forge does not send an automatic confirmation e-mail. The form does not allow attachments to be sent. The legal bases for processing are: - Article 6(1)(b) GDPR — where the enquiry concerns steps taken prior to entering into a contract or the performance of a contract, - Article 6(1)(f) GDPR — where processing is necessary to handle correspondence, protect against spam, ensure security, establish the history of contact, or protect against claims, - Article 6(1)(c) GDPR — where retention of data is required by law. Lech Forge’s legitimate interest is to conduct communication related to its offering, ensure website security, prevent abuse, and be able to demonstrate the course of correspondence. 4. Private mini-chat The mini-chat enables a short question to be asked without providing an e-mail address or telephone number. It is not a live chat, so a reply may appear later. In the mini-chat, the following are processed: - the chosen nickname, - message content, - conversation identifier and private access token, with only the token hash stored in the database, - IP address hash and minimal data needed to protect against spam and abuse, - information about the accepted version of the terms and the clause. The user is not required to provide their e-mail, telephone number, or other contact details in the conversation. The mini-chat was designed specifically to enable contact without leaving such data. If the user themselves enters personal data in the message content, those data will be processed as part of the conversation. After creating a conversation, the user receives a private link. The link is the only way to return to the conversation. Lech Forge cannot reconstruct a lost token, because it is not stored in the database in plaintext form. Lech Forge may receive a notification of a new message at info@lech-forge.pl containing the nickname, message content, and a link to the administrator panel. The legal bases for processing are: - Article 6(1)(f) GDPR — a legitimate interest consisting in answering questions, conducting secure communication, and preventing abuse, - Article 6(1)(b) GDPR — if the conversation concerns steps taken at the user’s request prior to entering into a contract. 5. Website security and administrator panel To secure the website, the following are used, among others: - CSRF protection, - a honeypot field for bots, - rate limiting of submissions, - Cloudflare Turnstile, - technical logs and security alerts. The full IP address is not stored in the submissions and conversations database; only its hash is stored. The full IP address may, however, be processed briefly by the server, the hosting provider, or Cloudflare to the extent necessary to handle the connection, enforce limits, and perform anti-bot verification. The administrator panel is not a public service for clients. In connection with securing it, administrator account data, login information, optional 2FA, and security alerts containing the IP address and browser or device identifier may be processed. The legal basis for this processing is Article 6(1)(f) GDPR — a legitimate interest consisting in protecting the website, data, the administrator account, and continuity of operation. 6. Data retention period Form submissions are retained by default for 60 days. The administrator may: - delete a submission earlier, - extend the retention period to a specified date, - disable automatic deletion by setting “Do not delete”. The “Do not delete” setting may be used only where a specific purpose and legal basis for retention still exist, for example ongoing arrangements, cooperation, a legal obligation, or the need to establish, pursue, or defend claims. It does not change the rule that data should not be retained longer than necessary. Mini-chat conversations are retained by default for 14 days. The administrator may delete them earlier, extend the period, or disable automatic deletion if further handling of the matter or another legitimate purpose so requires. After expiry, the conversation is deleted or anonymised. Technical data related to security are retained only for as long as needed to detect abuse, protect the website, and investigate incidents. If data are needed to fulfil a legal obligation or to establish, pursue, or defend claims, they may be retained until that obligation expires or the applicable limitation period ends. 7. Recipients of data Data may be processed by entities supporting the operation of the website: - OVH — provider of hosting, database, and business e-mail, - Cloudflare — provider of the Turnstile service protecting forms against automated spam, - authorised public authorities, where an obligation to disclose data arises from law. Technical providers process data to the extent needed to deliver their services and on the basis of applicable agreements or terms. Cloudflare operates within a global infrastructure, so some technical data may be processed outside the European Economic Area, in particular in the United States. Cloudflare declares the use of mechanisms provided for in Chapter V GDPR, including the EU–US Data Privacy Framework and standard contractual clauses — depending on the specific case. 8. Essential cookies and browser storage The website uses only mechanisms needed for operation, form protection, and session maintenance. A detailed description is set out in the document “Cookie Notice”. In particular, the following may be used: - session cookie, - CSRF/XSRF cookie, - optional “remember me” solely for the administrator panel, - localStorage “lf_cookies_accepted” storing confirmation that the cookie notice has been read, - sessionStorage “lf_locale_notice_seen” storing, for the current session, information that the machine-translation notice has been displayed. The website language is determined by the URL, for example /pl or /de, and not by a language-preference cookie. 9. Rights of the data subject The data subject may — to the extent provided by the GDPR: - obtain access to the data and a copy thereof, - request rectification of the data, - request erasure of the data, - request restriction of processing, - object to processing based on Article 6(1)(f) GDPR, - request data portability where the statutory conditions are met, - lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). To exercise these rights, please contact kontakt@lech-forge.pl. Before fulfilling a request, the controller may ask for information allowing the identity of the person making the request to be verified. 10. Automated decisions Data are not used for automated decision-making or profiling that produces legal effects or similarly significantly affects the user. Automated anti-spam mechanisms may, however, reject or limit submission of a form or message if they detect abuse, exceeding a limit, or failed Turnstile verification. 11. Changes to the Privacy Policy The Policy may be updated in the event of a change in how the website operates, the scope of processed data, technical providers, or applicable law. The current version is published on the website together with the effective date.