Privacy Policy

Last updated: August 19, 2026

1. Introduction

This privacy policy sets out the rules for processing and protecting personal data provided by users in connection with the use of the kamikstudio.pl and kamikstudio.com websites.

The controller of personal data is:

Patryk Kowalski, conducting business activity under the name KamikStudio Patryk Kowalski

• Office address (for correspondence): Fabryczna 1, 62-800 Kalisz, Poland
• Tax ID (NIP): 6182187584
• Business Registry No. (REGON): 387776597
• E-mail: [email protected]
• Phone: +48 519 109 063

The Controller takes particular care to protect users' privacy and ensures that personal data is processed in accordance with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR)
• The Polish Personal Data Protection Act of 10 May 2018
• The Polish Act of 18 July 2002 on the Provision of Services by Electronic Means
• The Polish Telecommunications Law of 16 July 2004

2. Legal bases and purposes of data processing

The Controller processes users' personal data only where at least one of the following legal bases applies:

2.1. Purposes and bases of processing

Purpose of processing	Legal basis	Retention period
Handling contact inquiries	Art. 6(1)(b) GDPR (performance of a contract) - processing necessary to take steps prior to entering into a contract	Until the inquiry is resolved or the legal obligation to retain data expires (6 years for tax purposes)
Handling support requests (RMA system)	Art. 6(1)(b) GDPR (performance of a contract or steps prior to entering into one)	For the duration of handling the request and the limitation period for claims (up to 6 years)
Direct marketing of our own services	Art. 6(1)(f) GDPR (legitimate interest) - promoting our own services and products	Until the user objects, no longer than 3 years
Marketing based on consent	Art. 6(1)(a) GDPR (consent) - voluntary consent to receive a newsletter or marketing materials	Until the user withdraws consent
Conversion tracking and behavior analysis	Art. 6(1)(a) GDPR (consent) + Art. 173 of the Polish Telecommunications Law	Until consent is withdrawn (marketing cookies) or 26 months (analytics cookies)
Establishing, pursuing or defending claims	Art. 6(1)(f) GDPR (legitimate interest)	Limitation period for claims (up to 6 years under the Polish Civil Code)
Ensuring the proper operation of the website	Art. 6(1)(f) GDPR (legitimate interest) - maintaining technical infrastructure	Up to 3 years from last activity

3. Scope of collected data

3.1. Data provided voluntarily

When you use the forms on the website (contact form, quick contact window, support request form at /support-requests/), the following data is collected:

• First and last name
• E-mail address
• Phone number (optional)
• Message content
• Company name (optional)
• Industry/area of interest

3.2. Data collected automatically

While you use the website, the following data is collected automatically:

• IP address
• Browser type and version
• Operating system
• Device type (computer, tablet, smartphone)
• Screen resolution
• Traffic source (referrer)
• Time spent on the website
• History of viewed subpages
• Geographic location (country, region, city)
• Interactions with page elements (clicks, scrolling)

3.3. Conversion tracking

For analytics and marketing purposes we track the following events:

• Clicks on the phone number (+48 519 109 063)
• Contact form submissions
• Clicks on the e-mail address
• Interactions with service sections (which services are viewed most often)
• Material downloads (if available)
• Clicks on social media links

This data is used solely to optimize the website and tailor our offer to users' needs.

4. Cookies and tracking technologies

4.1. What are cookies?

Cookies are small text files saved on the user's device while browsing a website. They are used to remember preferences, analyze traffic and personalize content.

4.2. Types of cookies used

A) Essential cookies (no consent required)

• Session - enable the website to function correctly
• Security - protect against attacks
• User preferences - remember settings (e.g. language)

Validity period: until the end of the session or a maximum of 30 days

B) Analytics cookies (consent required)

Google Analytics 4 (GA4) - provided by Google Ireland Limited

• Purpose: website traffic analysis, statistics, UX optimization
• Data collected: user behavior, navigation paths, demographics
• Validity period: up to 26 months
• Opt-out: Google Analytics Opt-out

Main GA4 cookies:

• _ga - user identification
• _ga_* - session identification
• _gid - distinguishing users
• _gat - request rate limiting

C) Marketing cookies (consent required; currently inactive - used only during advertising campaigns)

Facebook Pixel (Meta Pixel) - provided by Meta Platforms Ireland Limited

• Purpose: measuring ad effectiveness, retargeting, building audiences
• Data collected: on-site activity, conversions, behavior
• Validity period: up to 90 days
• Management: Facebook ad settings

Main Facebook cookies:

• _fbp - activity tracking
• fr - ad delivery
• _fbc - storing campaign parameters

Google Ads / Google Tag Manager - provided by Google Ireland Limited

• Purpose: advertising campaigns, remarketing, conversion measurement
• Data collected: ad interactions, conversions
• Validity period: up to 540 days

Main Google Ads cookies:

• _gcl_au - conversion tracking
• test_cookie - checking cookie support
• IDE - remarketing and ad personalization

4.3. Consent management

The website uses its own consent tool (the KamikStudio cookie banner) to manage cookie consents in line with the GDPR and ePrivacy:

• Displaying an informational cookie banner
• Choice of cookie categories (essential, analytics, marketing)
• Saving user preferences
• Ability to change consents at any time

Preference storage:

• ks_consent_v1 (localStorage) - storing user preferences

4.4. How to manage cookies?

You can change your cookie settings at any time:

1. Via the banner on the website - click "Cookie settings" in the footer
2. In your web browser:
   • Chrome
   • Firefox
   • Safari
   • Edge

⚠️ Note: Disabling cookies may limit the functionality of the website.

5. Google Tag Manager (GTM)

The website uses Google Tag Manager - a tool for centrally managing tracking tags and marketing codes.

Purpose of using GTM:

• Implementing tracking codes (Google Analytics, Facebook Pixel)
• Event tracking (phone clicks, form submissions)
• Measuring the effectiveness of marketing campaigns
• Optimizing website performance

Data collected via GTM:

• On-page events (clicks, scrolling, filling in forms)
• URL parameters and referrers
• Technical data about the device and browser

Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(f) GDPR (legitimate interest in traffic analysis)

6. Conversion and event tracking

6.1. Monitored events

To optimize the website and better tailor our offer, we track the following conversions:

Contact events:

• Click on the phone number: tel:+48519109063
• Click on the e-mail address: mailto:[email protected]
• Contact form submission (Forminator)
• Click on the "Free consultation" button

Navigation events:

• Viewing service subpages (which service the user is interested in)
• Scrolling to the contact section
• Clicking on portfolio projects
• Visiting the blog

Social events:

• Clicks on social media icons (Facebook, LinkedIn, Instagram)

6.2. Purpose of conversion tracking

Conversion data is used exclusively to:

• Optimize the website structure
• Improve UX/UI
• Tailor the offer to clients' needs
• Measure the effectiveness of marketing activities
• Improve customer service quality

We do not use this data for automated decision-making or profiling that produces legal effects.

7. Sharing personal data

7.1. Data recipients

Personal data may be shared with the following categories of recipients:

IT service providers:

• Hosting: LH.pl sp. z o.o. (Poland) - data storage on servers
• WordPress: Automattic Inc. (USA) - CMS platform
• Forminator: WPMU DEV (USA) - contact form handling
• Own consent banner: cookie consents handled locally (own banner, no external provider)

Analytics and marketing services:

• Google Ireland Limited (Ireland/USA) - Google Analytics, Google Ads, Google Tag Manager
• Meta Platforms Ireland Limited (Ireland/USA) - Facebook Pixel, Facebook/Instagram ads

Communication services:

• Telegram Messenger Inc. (United Arab Emirates) - internal notifications about new support requests (request number, company name, contact details and a summary of the description sent to the Controller's internal channel)

• E-mail service providers (for the newsletter)
• SMS service providers (for notifications)

7.2. Transfers of data to third countries

Where data is transferred outside the European Economic Area (EEA), the Controller ensures an adequate level of protection through:

• Standard Contractual Clauses (SCC) approved by the European Commission
• Adequacy decisions of the European Commission
• Additional security measures (encryption, pseudonymization)

More information:

• Google: Data transfers
• Meta: Data transfers

8. Data security

The Controller applies the following security measures:

Technical:

• SSL/TLS encryption (HTTPS)
• Regular software updates
• Anti-spam protection on forms
• Data backups
• Web application firewall (WAF)
• Security monitoring

Organizational:

• Data access policies
• GDPR training
• Breach reporting procedures
• Regular security audits

9. Users' rights (data subjects' rights)

Under the GDPR you have the following rights:

9.1. Right of access (Art. 15 GDPR)

You have the right to obtain confirmation of whether we process your data and to receive a copy of your personal data.

9.2. Right to rectification (Art. 16 GDPR)

You may request that incorrect data be corrected or incomplete data be completed.

9.3. Right to erasure - "right to be forgotten" (Art. 17 GDPR)

You may request erasure of your data if:

• The data is no longer necessary for the purposes for which it was collected
• You have withdrawn consent and there is no other legal basis for processing
• You have objected to the processing
• The data was processed unlawfully

9.4. Right to restriction of processing (Art. 18 GDPR)

You may request restriction of processing in specific cases (e.g. while the accuracy of the data is being verified).

9.5. Right to data portability (Art. 20 GDPR)

You have the right to receive your data in a structured format (e.g. CSV, JSON) and to transmit it to another controller.

9.6. Right to object (Art. 21 GDPR)

You may object to the processing of your data at any time:

• Direct marketing - unconditional objection (always honored)
• Legitimate interest - objection with justification

9.7. Right to withdraw consent (Art. 7 GDPR)

If processing is based on consent, you may withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.

9.8. Right to lodge a complaint (Art. 77 GDPR)

You have the right to lodge a complaint with the supervisory authority:

President of the Personal Data Protection Office (UODO)

• ul. Stawki 2, 00-193 Warsaw, Poland
• Phone: 22 531 03 00
• E-mail: [email protected]
• www.uodo.gov.pl

9.9. How to exercise your rights?

To exercise any of the above rights, contact us:

• E-mail: [email protected]
• Phone: +48 519 109 063
• Mail: Fabryczna 1, 62-800 Kalisz, Poland

We will respond to your request within 30 days (in special cases the deadline may be extended to 60 days, with the reason communicated to you).

10. Profiling and automated decision-making

10.1. Do we profile data?

Yes, to a limited extent we profile data for marketing purposes:

Examples of profiling:

• Analyzing user interests based on the services they view
• Matching ads to on-site behavior
• Segmenting users for remarketing campaigns

What we do not do:

• ❌ We do not make automated decisions that produce legal effects
• ❌ We do not refuse to enter into a contract based on profiling
• ❌ We do not discriminate against users based on their profile

10.2. Your right

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

11. Data retention periods

We store personal data for the following periods:

Data category	Retention period
Contact inquiries	6 years (tax and accounting requirements)
Newsletter	Until consent is withdrawn + 1 year in case of claims
Server logs	12 months
Analytics cookies (GA4)	26 months
Marketing cookies (Facebook)	90 days
Billing data	5 years (Polish Accounting Act)
Legal claims	Until the limitation period expires (up to 6 years)

After these periods, data is securely deleted or anonymized.

12. Changes to this privacy policy

The Controller reserves the right to make changes to this privacy policy in the event of:

• Changes in the law
• Introduction of new website features
• Changes in the analytics tools used
• Organizational changes in the company

Users will be informed of significant changes via:

• A notice on the home page
• E-mail (if we have your address)
• An update to the "Last updated" date at the top of this document

13. Additional information

13.1. Links to external websites

The website may contain links to external services (e.g. Facebook, LinkedIn, Google Maps). The Controller is not responsible for the privacy policies of those websites. We recommend reviewing their policies before providing any personal data.

13.2. Do you have to provide your data?

Providing personal data is:

• Voluntary - in the case of contact forms
• A contractual requirement - if you want to receive a reply or an offer
• Automatic - in the case of cookies (you can manage your consents)

Not providing data may prevent you from using some website features (e.g. the contact form).

13.3. Is data shared for marketing purposes?

Your data is not sold or shared with external companies for their own marketing. We work exclusively with trusted technology partners (Google, Meta) as part of our own marketing activities.

13.4. Children's safety

The website is not directed at persons under 16 years of age. If you are under 16, please consult a parent or legal guardian before using the website.

14. Contact regarding personal data

If you have questions about the processing of your personal data or exercising your rights, contact us:

KamikStudio Patryk Kowalski

• Address: Fabryczna 1, 62-800 Kalisz, Poland
• E-mail: [email protected]
• Phone: +48 519 109 063
• Tax ID (NIP): 6182187584
• Business Registry No. (REGON): 387776597

We respond to inquiries on business days between 9:00 AM and 5:00 PM (within a maximum of 30 days).

15. Legal basis - list of regulations

Personal data is processed in accordance with:

1. GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
2. Personal Data Protection Act - Polish Act of 10 May 2018 (Journal of Laws 2019, item 1781)
3. Act on the Provision of Services by Electronic Means - Polish Act of 18 July 2002 (Journal of Laws 2020, item 344)
4. Telecommunications Law - Polish Act of 16 July 2004 (Journal of Laws 2021, item 576) - in particular Art. 173 on cookies
5. Accounting Act - Polish Act of 29 September 1994 (Journal of Laws 2021, item 217) - document retention periods
6. Civil Code - Polish Act of 23 April 1964 (Journal of Laws 2020, item 1740) - limitation periods for claims

Cookie consent management

We use Google Consent Mode v2. We divide cookies into categories:

• Essential - always active (security, form handling).
• Analytics - Google Analytics 4; activated only after consent is given.
• Marketing - Google Ads and remarketing; activated only after consent is given.

By default, categories other than essential are blocked until you give consent in the cookie banner. You can change your choice at any time by clicking "Cookie settings" in the page footer or by deleting cookies in your browser settings.