PRIVACY POLICY

1. Data Controller

The controller of your personal data is:

• D ONE BRAND CONSULTING&DESIGN Sp. z o. o.
• Tax ID (NIP): 7011055735
• Business No. (REGON): 520224636
• Address: ul. ks. I. J. Skorupki 5, 00-546 Warszawa, Mazowieckie Voivodeship, Poland
• E-mail: hello@done-waw.com
• Phone: (+48) 501 268 268

‍

2. Scope and source of data

In connection with your use of the Website, we may process in particular:

• technical data automatically transmitted by your browser when the Website is displayed (IP address, browser type and version, operating system, date and time of the request) – processed in server logs and by the providers of the Website's infrastructure,
• logs and technical events related to the security and correct operation of the Website (e.g. date and time of the request, information about the device and browser).

If you contact us directly by e-mail or phone, we process the data provided in that correspondence (e.g. e-mail address, phone number, name, message content).

If you fill in the contact form available on the Website (e.g. on the „Contact” page), we process the data provided in the form (e.g. first and last name, e-mail address, phone number, company name, message content).

If you apply for a job through the recruitment form on the „Jobs” page, we process the data provided in the application: first and last name, contact details (e-mail, phone), information contained in your CV and any cover letter (education, professional experience, competencies), an optional portfolio, and other data you provide voluntarily.

Providing data in the contact or recruitment form is voluntary but necessary to, respectively, respond to your enquiry or consider your application.

‍

3. Purposes and legal bases of processing

We process data for the following purposes:

• Ensuring the operation, security and correct display of the Website (diagnostics, prevention of abuse). Legal basis: Art. 6(1)(f) GDPR (the Controller's legitimate interest).
• Contact and handling of enquiries sent by e-mail or phone. Legal basis: Art. 6(1)(f) GDPR, and where the contact concerns steps prior to entering into a contract – Art. 6(1)(b) GDPR.
• Displaying an interactive map showing the way to our offices on the „Contact” page (Google Maps) and protecting forms against abuse (Cloudflare Turnstile). Legal basis: Art. 6(1)(f) GDPR (the Controller's legitimate interest in enabling you to reach us and in protecting the Website against spam).
• Handling enquiries sent via the contact form. Legal basis: Art. 6(1)(f) GDPR (the Controller's legitimate interest in communicating with persons interested in our offer), and where the contact concerns steps prior to entering into a contract – Art. 6(1)(b) GDPR.
• Recruitment processes – considering the application for the position the candidate is applying for. Legal basis: Art. 6(1)(b) GDPR (steps aimed at concluding an employment or cooperation contract) and Art. 6(1)(c) GDPR in conjunction with Art. 22¹ of the Polish Labour Code (as regards data required by law). For data going beyond what is required by law (e.g. a photograph, interests, data provided voluntarily in the CV) – Art. 6(1)(a) GDPR (the candidate's consent given by submitting the application). If the candidate gives separate consent to take part in future recruitment processes – Art. 6(1)(a) GDPR (consent).

‍

4. Cookies and similar technologies

The Website does not store any cookies on your device – neither its own nor third-party ones. We do not use analytics or marketing tools, and therefore the Website does not display a cookie consent banner.

In your browser's local storage (localStorage) we save only technical data necessary for the correct display of the Website – the cached set of interface colour themes. In session storage (sessionStorage) a marker of the page-transition animation is kept for the duration of the transition and removed automatically once it ends. This information is not used to identify or track users, is not shared with third parties, and its storage is strictly necessary to provide the service you request by visiting the Website.

You can delete this data at any time in your browser settings.

If we implement analytics or marketing tools in the future, we will update this Policy and, where necessary, introduce a consent management mechanism.

‍

5. Google Maps

On the „Contact” page we embed an interactive Google Maps map (provider: Google Ireland Limited). When it is displayed, your browser connects to Google's servers and transmits technical data, in particular your IP address and information about your browser and device. This data may also be processed outside the European Economic Area. The map does not store cookies on your device.

Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in providing you with clear information about the location of our offices. If you do not wish to connect to Google, you may refrain from visiting the „Contact” page – our addresses are also provided in text form.

Google's privacy policy: https://policies.google.com/privacy

‍

6. Cloudflare Turnstile

The forms on the Website (contact and recruitment) are protected against abuse by Cloudflare Turnstile (provider: Cloudflare, Inc.). It processes technical data necessary to distinguish a human from an automated script (including IP address and browser information). The tool does not store cookies on your device and is not used to track users.

Legal basis: Art. 6(1)(f) GDPR – legitimate interest in protecting the Website against spam and abuse.

Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

‍

7. Data recipients

Data may be transferred to the following categories of recipients:

• Webflow – provider of the hosting and platform for the Website.
• Google Ireland Limited – provider of the map service (Google Maps) embedded on the „Contact” page.
• Cloudflare, Inc. – provider of form protection (Turnstile) and of the content delivery network from which the libraries required to display the Website are loaded.
• Entities authorised under the law – if they submit a binding request.

‍

8. Transfers of data outside the EEA

In connection with the use of tool providers' services (e.g. Webflow, Google, Cloudflare), data may be processed outside the European Economic Area (e.g. in the USA), depending on the infrastructure and configuration of the services.

In such cases, data transfers take place using the mechanisms provided for by the GDPR, such as an adequacy decision (e.g. the EU–US Data Privacy Framework – where applicable) or standard contractual clauses.

‍

9. Data retention period

• Technical data and logs – for the period necessary to ensure security and diagnostics, as a rule no longer than 90 days, unless longer storage is necessary to establish, pursue or defend claims.
• Contact form data – for the time necessary to respond and conduct correspondence, and thereafter for the limitation period of any claims.
• Recruitment data – until the completion of the recruitment process for the given position, and where consent is given to take part in future recruitment – for the period indicated in the consent (typically up to 12 months) or until it is withdrawn.

‍

10. Your rights

Within the limits of the GDPR, you have the right to:

• access your data and obtain a copy of it,
• rectify your data,
• erase your data,
• restrict processing,
• data portability (where applicable),
• object (where we process data on the basis of Art. 6(1)(f) GDPR),
• withdraw consent at any time (where processing is based on consent).

You have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (PUODO).

‍

11. Automated decision-making and profiling

We do not carry out profiling of Website users. The Controller does not make automated decisions concerning users that produce legal effects concerning them or similarly significantly affect them (Art. 22 GDPR).

‍

12. Changes to the Privacy Policy

This Policy may be updated in particular in the event of changes to the Website, the tools (Webflow, Google Maps, Cloudflare) or the law. The current version is always available on the Website.