Whatwedowithyourdata,inplainterms.

1. Who is responsible for your data

The controller of your personal data is ORLENA spółka z ograniczoną odpowiedzialnością, with its registered office at Aleje Jerozolimskie 133 / 2, 02-304 Warszawa, Poland, entered in the National Court Register (KRS) under number 0001248614, NIP 7011320195, REGON 545098066.

For anything concerning your personal data — including the requests described in section 7 — write to info@orlena.pl or to the registered office above. We have not appointed a Data Protection Officer; your message goes directly to the people who can act on it.

2. What we collect, and why

We only collect what a given interaction actually needs. There is no account to create and nothing here is sold on.

Giving us your data is voluntary, but without contact details we cannot reply to an enquiry or deliver a free check.

3. Data about your own customers

Our work includes building websites and lead panels that collect enquiries for our clients. Where we handle personal data belonging to a client's customers, that client is the controller and we act as a processor on their written instructions, under a data processing agreement. This notice does not govern that data — the client's own privacy policy does.

4. Who else sees it

We do not sell personal data and we do not share it for anyone else's marketing. We do rely on service providers who process data on our behalf, under contract and only on our instructions:

• hosting, domain and infrastructure providers that run this site;
• email, calendar and file-storage providers we use day to day;
• the CRM system in which we record enquiries;
• our accountants and, where necessary, legal advisers — and public authorities where the law requires it.

Transfers outside the EEA

Some of these providers are based outside the European Economic Area, chiefly in the United States. Where data is transferred there, it is done on the basis of the European Commission's adequacy decisions or Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for a copy of the safeguards that apply.

5. Cookies and measurement

This website measures its own traffic. We use Umami — analytics software we run on our own server, rather than a service that resells what it learns. It sets no cookies and stores nothing on your device, so nothing here follows you to another site or builds an advertising profile of you. What it records is the page you opened, the site that linked you to it, your approximate location, and your browser and device type. The approximate location is worked out from your IP address, which Umami does not store.

We also record how pages are used. The same tool captures anonymised session replays and heatmaps — where you scroll, where the cursor goes, what you click. It is how we find the parts of the site that confuse people. Anything you type is masked before it leaves your browser: your name, email address, message and the website address you enter into the free check are never recorded, and a replay is not tied to an enquiry you send us.

None of this asks for consent, because none of it stores anything on your device or identifies you personally — it rests on our legitimate interest in knowing whether the site works, under Art. 6(1)(f) GDPR, and you can object at any time. What would identify you — the Meta and Google tags used to attribute advertising campaigns — is not in use here, and would be set only after you agree, under Art. 6(1)(a) GDPR and Art. 173 of the Polish Telecommunications Act. This page is updated before any such change goes live.

Your browser settings let you block or delete cookies at any time. Withdrawing a consent you have given does not affect processing already lawfully carried out on it.

6. How long we keep it

• Enquiries that go nowhere: up to 12 months from your last message, then deleted.
• Client records: for the duration of the engagement, then for as long as claims arising from it can still be brought under the Polish Civil Code.
• Invoices and accounting records: 5 years from the end of the tax year they relate to, as Polish tax law requires.
• Data processed with your consent: until you withdraw it.

7. Your rights

Under the GDPR you have the right to:

• be told what data we hold about you, and get a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased, where one of the grounds in Art. 17 applies;
• have our processing restricted while a dispute is resolved;
• receive data you gave us in a portable format, or have it sent to another controller;
• object to processing based on our legitimate interest, on grounds relating to your particular situation;
• withdraw consent at any time, without affecting processing already carried out on it.

Write to info@orlena.pl and we will respond within one month. If you think we have handled your data badly, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa.

8. Automated decision-making

We do not make decisions about you by automated means alone, and we do not profile you in any way that produces legal effects or similarly significant consequences for you.

9. Security

We apply technical and organisational measures appropriate to the risk — encrypted connections, access limited to people who need it, and providers selected for their own security posture. No system is perfect, and we will tell you and the supervisory authority if a breach is likely to put your rights at risk.

10. Changes to this notice

If what we do with data changes, this page changes with it and the date at the top is updated. Material changes affecting existing clients will also be sent by email.

See also our terms of service and our company details.