Privacy Policy

This policy explains what personal data we process, why, for how long and who we share it with. It covers webmotion.io, the desk.webmotion.io ticket system, the snappass.webmotion.io tool and your correspondence with us.

Data controller

The controller of your data is Paweł Kościak, a sole proprietor doing business as webmotion Paweł Kościak, Cieszacin Wielki 43, 37-500 Jarosław, Poland, tax ID (NIP) 7922330560, REGON 543659514, registered in the Polish Central Register of Business Activity (CEIDG) (“webmotion”, “we”). For anything related to personal data, write to [email protected]. We have not appointed a data protection officer, as we are not required to.

What data we process

Email data — your name, email address, phone number (if you give it) and your message. Emails sent to [email protected] go into our ticket system at desk.webmotion.io, where we continue the conversation.
Client and client representative data — company details, names, positions and business contact details of the people we prepare estimates and deliver projects with, and the data needed for invoicing.
Technical data — IP address, browser and device type, time and address of the pages visited. Our servers and security tools record them.
Statistics — information about how the site is used, collected by Google Analytics, only after you consent to statistics cookies.

Purposes, legal bases and retention

Answering your enquiry and correspondence — our legitimate interest in replying to messages (Article 6(1)(f) GDPR), and when you ask for an offer — steps taken before entering into a contract (Article 6(1)(b) GDPR). We keep correspondence until the matter is closed, then until any claims become time-barred, for no longer than 6 years.
Preparing estimates, concluding and performing contracts — the contract or steps before it (Article 6(1)(b) GDPR); for client representatives and staff — our legitimate interest in communicating about the contract (Article 6(1)(f) GDPR). For the term of the contract and until claims become time-barred.
Invoicing, accounting and taxes — legal obligation (Article 6(1)(c) GDPR). For 5 years from the end of the year in which the tax became due.
Establishing and defending claims — legitimate interest (Article 6(1)(f) GDPR). Until the claims become time-barred.
Site security and abuse prevention — legitimate interest (Article 6(1)(f) GDPR). Server logs are kept for up to 30 days, longer only when they are evidence of an incident.
Visitor statistics (Google Analytics, ID G-XRELMTQDKT) — your consent (Article 6(1)(a) GDPR). Until you withdraw consent; data in Google Analytics is kept for no longer than 14 months.

Providing data is voluntary, but without an email address we cannot reply, and without company details we cannot prepare a contract or an invoice.

snappass.webmotion.io

This tool is for sharing a password or other confidential information once. The content is encrypted, and the key to read it exists only in the link — we do not store it. The message is deleted after it is first read or when the chosen time runs out. We do not know the content shared this way and do not link it to the person who sent it.

Who we share data with

We use service providers that process data on our behalf under data processing agreements:

OVH SAS — server hosting — France (EU)
Cloudflare, Inc. — CDN and attack protection — USA; transfer based on the EU-US Data Privacy Framework and standard contractual clauses
Namecheap, Inc. (Private Email) — email — project correspondence; USA, transfer based on standard contractual clauses
Google Ireland Limited and Google LLC — visitor statistics (Google Analytics, Google Tag Manager), only with your consent; USA, transfer based on the EU-US Data Privacy Framework
our accounting office — bookkeeping, limited to data from contracts and invoices

Data may also be disclosed to authorities entitled to it by law, such as courts and tax authorities, when they request it. We do not sell personal data.

Transfers outside the European Economic Area

Some providers (Cloudflare, Namecheap, Google) are based in the USA or process data there. Transfers rely on the European Commission’s decision on the EU-US Data Privacy Framework for certified companies, or on standard contractual clauses approved by the Commission. We will send details of the safeguards on request.

Your rights

to access your data and receive a copy,
to have inaccurate or incomplete data corrected,
to have your data erased when there is no longer a basis for processing it,
to restrict processing,
to data portability for data processed on the basis of consent or a contract,
to object to processing based on our legitimate interest,
to withdraw consent at any time — without affecting the lawfulness of processing before withdrawal; you can change your cookie consent under “Cookie settings” in the site footer.

To exercise these rights, write to [email protected]. We will reply within one month. You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warsaw), or with the supervisory authority in your country.

Automated decisions

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

Cookies

How we use cookies is described in the Cookie policy.

Changes to this policy

We update this policy when the law or the way we process data changes. The current version is always on this page. Last updated: 1 October 2026.