Privacy policy

Version: September 2026

1. Data controller

2. General approach

This website is deliberately built to be data-sparing. It embeds no content from third-party servers: fonts, images, stylesheets and scripts are served exclusively from our own domain. We use no analytics, tracking or advertising services, no social networks, no map services and no embedded videos. There is no profiling and no automated decision-making.

3. Visiting the site (server logs)

When you visit, your browser transmits technically necessary data to the hosting provider's server, stored in log files: IP address, date and time, requested file, transferred data volume and status, browser type and operating system, and – if transmitted – the referring page.

Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in the secure and reliable operation of the site.
Retention: logs are deleted after seven days at the latest, unless they are needed longer to investigate a specific security incident.

4. Hosting

The site is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (“Cloudflare”) and delivered through its global content delivery network. Cloudflare processes the data listed in section 3 exclusively on our behalf; a data processing agreement under Art. 28 GDPR is in place. Data may be transferred to the USA. Cloudflare is certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR); in addition, standard contractual clauses apply (Art. 46(2)(c) GDPR).

5. Contact

5.1 Contact form

The form transmits no data to our server or to third parties. Your input is processed only in your browser and, on submission, placed into an e-mail that opens in your local e-mail client. Sending only happens once you trigger it yourself. From that moment, section 5.2 applies.

5.2 E-mail, phone and post

When you contact us, we process the information you provide – typically name, contact details and the content of your request – to handle the matter.

Legal basis: Art. 6(1)(b) GDPR for contract-related requests, otherwise Art. 6(1)(f) GDPR.
Retention: as long as handling the request and statutory retention duties require.

6. Browser storage (localStorage)

After you close the cookie notice, we store only your choice in the browser (localStorage) so the notice does not reappear. The entry stays on your device, is transmitted nowhere and expires after 12 months at the latest.

7. Recipients

We pass on data only where necessary for contract performance, with your consent, or where the law requires it. Recipients may be: our hosting provider (processor, section 4), our accounting office and – where legally required – public authorities. Transfers outside the EEA occur only as part of hosting (section 4).

8. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on Art. 6(1)(f) (Art. 21).

Contact us at kontakt@nexbase.pl. You also have the right to lodge a complaint with a supervisory authority – for us this is the President of the Polish data protection office (PUODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or the authority at your place of residence.