← cncexe.pl

Privacy policy of the cncexe.pl website

Effective from 16 October 2026. This is a translation of the Polish privacy policy; in case of any discrepancy, the Polish version prevails.

§ 1. General provisions and definitions

  1. This Privacy policy sets out the rules for processing and protecting the personal data of Website Users and fulfils the information obligation referred to in Article 13 GDPR.
  2. The terms used in this Policy mean:
    1. Controller: Jakub Jasiński, running a sole proprietorship under the business name CNC.exe Jakub Jasiński, as specified in § 2;
    2. Website: the website available at https://cncexe.pl, including its language versions;
    3. User: a natural person using the Website or contacting the Controller, including a person acting on behalf of a business;
    4. Form: the enquiry form available on the Website;
    5. GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

§ 2. Data controller

  1. The controller of personal data is Jakub Jasiński, running a business under the name CNC.exe Jakub Jasiński, ul. Źródlana 57, 57-100 Gościęcice, Poland, entered in the Polish Central Register and Information on Economic Activity (CEIDG), tax ID (NIP) 6751352174, REGON 542080835.
  2. For all matters relating to the processing of personal data, the Controller can be contacted:
    1. by e-mail: biuro@cncexe.pl;
    2. in writing, at the address given in section 1.
  3. The Controller has not appointed a data protection officer.

§ 3. Scope, purposes and legal bases of processing

  1. The Controller processes personal data provided by the User via the Form, e-mail or phone, namely: full name, company name, phone number, e-mail address, information about machines and controls, and the content of the enquiry.
  2. Personal data is processed for the following purposes and on the following legal bases:
    1. replying to the enquiry and contacting the User: on the basis of the User’s consent (Article 6(1)(a) GDPR) and the Controller’s legitimate interest in handling enquiries addressed to it (Article 6(1)(f) GDPR);
    2. preparing an offer and taking steps prior to entering into a contract at the request of the data subject (Article 6(1)(b) GDPR);
    3. concluding and performing a contract (Article 6(1)(b) GDPR);
    4. complying with the Controller’s legal obligations, in particular under tax law (Article 6(1)(c) GDPR);
    5. establishing, pursuing or defending claims, which is the Controller’s legitimate interest (Article 6(1)(f) GDPR).
  3. For persons acting on behalf of a business (e.g. employees or associates of a Client), the legal basis for processing is the Controller’s legitimate interest in communicating about the enquiry or the performance of a contract (Article 6(1)(f) GDPR).

§ 4. Voluntary provision of data

Providing personal data is voluntary but necessary to reply to an enquiry, prepare an offer or conclude a contract. The Form cannot be sent without the fields marked as required.

§ 5. Recipients of data

  1. Personal data may be transferred to entities processing it on behalf of the Controller, only to the extent necessary for the purposes set out in § 3, in particular:
    1. FormSubmit (formsubmit.co): the provider of the service that forwards the content of the Form to the Controller’s e-mail address and may use the Google reCAPTCHA security check before the enquiry is sent;
    2. Google Ireland Limited / Google LLC: the provider of Google Workspace, which the Controller uses for e-mail correspondence;
    3. GitHub, Inc.: the provider of the Website hosting service (GitHub Pages);
    4. entities providing accounting, legal and IT services to the Controller.
  2. Data may be disclosed to public authorities only where required by law.
  3. The Controller does not sell personal data or share it with third parties for marketing purposes.

§ 6. Transfers of data to third countries

  1. Because the services of the entities listed in § 5(1)(a)–(c) are used, personal data may be transferred outside the European Economic Area, in particular to the United States of America.
  2. Data is transferred to Google LLC and GitHub, Inc. on the basis of the European Commission’s adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses approved by the European Commission (Articles 45 and 46 GDPR).
  3. The User may obtain information about the safeguards applied, and a copy of them, by contacting the Controller as described in § 2(2).

§ 7. Data retention period

  1. Data processed to handle an enquiry is kept for as long as necessary to handle it and, if no contract is concluded, for no longer than 12 months from the date of the last contact.
  2. Data processed on the basis of consent is kept until consent is withdrawn, but no longer than the period specified in section 1.
  3. Data processed in connection with concluding and performing a contract is kept for the duration of the contract, then for the period required by tax law and until the limitation period for claims under the Polish Civil Code expires.

§ 8. Rights of data subjects

  1. The User has the right to:
    1. access their personal data and receive a copy of it (Article 15 GDPR);
    2. rectification of data (Article 16 GDPR);
    3. erasure of data (Article 17 GDPR);
    4. restriction of processing (Article 18 GDPR);
    5. data portability (Article 20 GDPR);
    6. object to processing based on the Controller’s legitimate interest (Article 21 GDPR);
    7. withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Article 7(3) GDPR).
  2. To exercise these rights, please contact the Controller as described in § 2(2). The Controller replies without undue delay and in any event within one month of receiving the request (Article 12(3) GDPR).
  3. The User has the right to lodge a complaint with the supervisory authority, i.e. the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland (Article 77 GDPR).

§ 9. Automated decision-making and profiling

Personal data is not used for automated decision-making, including profiling, as referred to in Article 22 GDPR.

§ 10. Cookies and server logs

  1. The Website does not use cookies or analytics and marketing tools; in particular, it does not use Google Analytics or tracking pixels.
  2. The Website stores only the User’s chosen colour mode (light or dark) in the browser’s local storage (localStorage). This information is not sent to the Controller or to third parties and can be deleted in the browser settings.
  3. The hosting provider (GitHub, Inc.) logs the IP addresses of Website visitors for the security of the service.
  4. After sending the Form, the User may be redirected to the FormSubmit website, where the rules set by that provider apply, including its rules on cookies and the reCAPTCHA service.

§ 11. Data security

The Controller applies technical and organisational measures that protect the personal data processed and are appropriate to the risks, in particular an encrypted connection (HTTPS/TLS) on the Website and access to data restricted to the Controller only.

§ 12. Final provisions

  1. The Controller may amend this Policy, in particular if the law or the services used on the Website change. The current version of the Policy is always available on the Website.
  2. Matters not covered by this Policy are governed by the GDPR and the Polish Personal Data Protection Act of 10 May 2018.