onexo
PLLet’s launch
onexo
[email protected]+48 664 896 662

Legal documents

Privacy policy

Last updated: 27 September 2026

ONEXO.pl Adrian Sokół

with its business address at: ul. Wojska Polskiego 9/D211, 39-300 Mielec, NIP 8172211997, REGON 526100591, e-mail: [email protected], the controller of personal data collected through the onexo.pl website.

Definitions:

Controller
The entity indicated above, which determines the purposes and means of processing Users’ personal data.
Website
The website available at onexo.pl, together with all its subpages and forms.
User
Any person visiting the Website or contacting the Controller via a form, e-mail or telephone.
Cookies
Small pieces of information stored on the User’s device by the browser. In this policy, the term also covers similar technologies, such as the browser’s local storage (localStorage) and tracking pixels.
GDPR
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data.
Electronic Communications Law
The Act of 12 July 2024 – Electronic Communications Law (Prawo komunikacji elektronicznej), Article 399 of which sets out the rules for storing information and gaining access to information stored on the User’s device.

§1 General provisions

  1. This privacy policy sets out the rules for the processing and protection of the personal data of Users using the Website and the rules for the use of cookies.
  2. The Controller processes personal data in accordance with the law, in particular with:
    1. the GDPR;
    2. the Act of 10 May 2018 on the Protection of Personal Data (ustawa o ochronie danych osobowych);
    3. the Act of 12 July 2024 – Electronic Communications Law.
    1. Browsing the Website does not require providing personal data.
    2. Providing data in the forms is voluntary but necessary to respond to an inquiry or to book a consultation.
    3. The Controller has not appointed a data protection officer. In matters concerning personal data, the Controller can be contacted at [email protected] or in writing at the address indicated above.

§2 Scope of data collected

  1. The following data are collected through the Website’s forms:
    1. contact form: first and last name, e-mail address, telephone number (optional) and the content of the message;
    2. “Book a free consultation” form: first and last name, telephone number and the selected topic of the conversation.
  2. When a form is submitted, the following are also recorded automatically:
    1. IP address and browser information (User-Agent);
    2. the address of the page from which the submission was sent, and the date and time of sending.
    1. In the message, the User may additionally provide information about their project, budget and expectations. Please do not include any data that is not needed to handle the inquiry.
    2. When the Website is used, technical data (IP address, browser and device type, date and time of the visit) are processed automatically, as they are necessary to display the page and ensure its security. With the User’s consent, the Website also collects data on how it is used, as described in §4 and §5.
    3. The Controller does not collect special categories of data referred to in Art. 9 GDPR.

§3 Purposes and legal bases of processing

  1. Personal data are processed for the purpose of:
    1. responding to an inquiry, booking a consultation and preparing a quote – at the User’s request prior to entering into a contract (Art. 6(1)(b) GDPR);
    2. conducting correspondence and performing a concluded contract (Art. 6(1)(b) GDPR);
    3. complying with legal obligations, in particular tax and accounting obligations (Art. 6(1)(c) GDPR).
  2. Data are also processed on the basis of the Controller’s legitimate interest (Art. 6(1)(f) GDPR), which consists in:
    1. ensuring the security of the Website and protecting the forms against spam and abuse;
    2. establishing, pursuing or defending against claims.
    1. On the basis of the User’s consent (Art. 6(1)(a) GDPR in conjunction with Art. 399 of the Electronic Communications Law), data are processed for analytics purposes (visit statistics) and marketing purposes (measuring the effectiveness of ads and ad personalization), in accordance with §4 and §5.
    2. Data processed for marketing purposes may be subject to profiling, consisting in assigning the User to ad audience groups. The Controller does not make decisions regarding Users based solely on automated processing that would produce legal effects concerning them or similarly significantly affect them (Art. 22 GDPR).
    3. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

§4 Cookies

  1. The Website uses the following categories of cookies:
    1. essential – storing the User’s choice regarding cookies (in the browser’s local storage, key “onexo-cookie-consent”) and serving the security of the forms; they are used without consent, as they are necessary to provide the service requested by the User;
    2. statistics (Google Analytics) – e.g. _ga and _ga_*, stored for up to 2 years; used only with consent;
    3. marketing (Meta Pixel, Google advertising signals) – e.g. _fbp and _fbc, stored for up to 90 days; used only with consent.
  2. On the first visit, the Website displays a banner in which the User can:
    1. accept all categories of cookies;
    2. select “Essentials only”, rejecting statistics and marketing cookies;
    3. in “Settings”, choose consent to statistics and to marketing separately.
    1. Until consent is given, statistics and marketing cookies are not stored and Meta Pixel is not loaded. Refusing consent does not restrict access to the Website’s content.
    2. The User may change or withdraw consent at any time using the “Cookie settings” link in the Website’s footer, and may also delete cookies or block them from being stored in the browser settings.
    3. The User’s choice is remembered in the browser until it is changed or the browser data are cleared.

§5 Third-party tools

  1. Google Tag Manager and Google Analytics 4 (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland):
    1. Google Tag Manager is a tool for managing the Website’s scripts; it is loaded on every visit, which involves transferring to Google the IP address and browser data needed to deliver the script, but it does not itself store cookies;
    2. the Website uses Google Consent Mode (Consent Mode v2) – until the User gives consent, Google tools do not store analytics or advertising cookies;
    3. with consent to statistics, Google Analytics collects data about the visit: pages visited, page sections viewed and the time spent viewing them, traffic source, approximate location (based on the IP address), device and browser type; the Website does not transfer form data to Google;
    4. with consent to marketing, Google may use the data to measure the effectiveness of ads and to personalize ads.
  2. Meta Pixel (provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland):
    1. is loaded only after consent to marketing has been given;
    2. transfers to Meta information about the pages visited, together with cookie identifiers, the IP address and browser data, in order to measure the effectiveness of ads, build audience groups and display ads on Meta services (Facebook, Instagram);
    3. with regard to the collection and transfer of these data, the Controller and Meta Platforms Ireland Limited are joint controllers (Art. 26 GDPR); further processing of the data by Meta takes place on the terms described in Meta’s privacy policy: facebook.com/privacy/policy.
    1. Cloudflare Turnstile (provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA) protects the forms against spam and bots. When a form is submitted, it analyzes the IP address and browser and device data. It is not used for marketing purposes. The legal basis is the Controller’s legitimate interest (Art. 6(1)(f) GDPR).
    2. The rules for the processing of data by Google are described in Google’s privacy policy: policies.google.com/privacy. The User may also limit personalized ads in the settings of their Google account (adssettings.google.com) and Meta account.
    3. A project preview opened in a Website window loads the website of the Controller’s client. The privacy rules of its owner apply on that website.

§6 Data recipients and transfers outside the EEA

  1. Data may be transferred to entities processing them on behalf of the Controller (processors), in particular:
    1. providers of hosting for the Website and of the inquiry management system (CRM);
    2. providers of e-mail and IT services;
    3. Cloudflare, Inc. (form protection);
    4. Google Ireland Limited (Google Tag Manager, Google Analytics).
  2. Separate controllers or joint controllers of the data are:
    1. Meta Platforms Ireland Limited – to the extent described in §5;
    2. Google – to the extent that it uses the data for its own advertising purposes with the User’s consent;
    3. the accounting office and public authorities – where the obligation to disclose data arises from the law.
    1. Using the services of Google, Meta and Cloudflare may involve the transfer of data to the United States (Google LLC, Meta Platforms, Inc., Cloudflare, Inc.). These entities participate in the EU-US Data Privacy Framework, which, under Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, ensures an adequate level of data protection. In addition, standard contractual clauses approved by the European Commission are applied.
    2. The User may obtain a copy of the safeguards relating to the transfer of data by contacting the Controller.
    3. The Controller does not sell Users’ personal data.

§7 Data retention period

  1. Data from the forms are stored:
    1. if no contract is concluded – for the time needed to handle the inquiry, and then for no longer than 12 months from the last contact;
    2. if a contract is concluded – for the duration of its performance, and then until the limitation period for claims expires and for the period required by tax and accounting regulations (as a rule, 5 years from the end of the year in which the tax liability arose).
  2. Data processed on the basis of consent are stored until consent is withdrawn, but no longer than:
    1. the cookie validity period indicated in §4;
    2. the data retention period set in Google Analytics, not exceeding 14 months.
    1. Data processed on the basis of legitimate interest are stored until an effective objection is raised or that interest ceases to exist.
    2. Technical data in server and security system logs are stored for the time necessary to ensure security, in accordance with the settings of their providers.
    3. After the retention period expires, the data are deleted or anonymized.

§8 User rights

  1. The User has the right of access to their data, and the right to rectification, erasure or restriction of processing.
  2. The User also has the right to:
    1. object to the processing of data carried out on the basis of the Controller’s legitimate interest (Art. 21 GDPR);
    2. data portability, i.e. to have data processed on the basis of consent or a contract transferred to another controller.
    1. Where processing is based on consent, the User may withdraw it at any time – consent to cookies using the “Cookie settings” link in the Website’s footer, and other consents by sending a message to [email protected].
    2. To exercise these rights, simply send a message to [email protected]. The Controller responds without undue delay, and in any event within one month.
    3. The User has the right to lodge a complaint with the supervisory authority, the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warszawa).

§9 Final provisions

  1. The Controller applies technical and organisational measures protecting data against unauthorized access, including an encrypted connection (HTTPS).
  2. The policy may be amended, in particular in the event of changes to the law or to the tools used on the Website.
    1. The current version of the policy is always available on the Website, and the date of the last update is given at its beginning.