Last updated: 8 October 2026

1. Data controller

This policy explains how we process personal data when you use kamikstudio.com and kamikstudio.pl and the forms and tools available on these websites.

The controller of your personal data is Patryk Kowalski, conducting business under the name KamikStudio Patryk Kowalski:

registered business address (CEIDG): ul. Rodzinna 1/39, 62-800 Kalisz, Poland
office and correspondence address: ul. Fabryczna 1, 62-800 Kalisz, Poland
VAT EU: PL6182187584, REGON: 387776597
e-mail: [email protected], phone: +48 519 109 063

We have not appointed a data protection officer. For all matters relating to personal data, write to [email protected].

2. Purposes, legal bases and retention periods

Purpose	Legal basis	Retention period
Replying to your enquiry and preparing an offer (contact form, "Call me back" window, pricing calculator, e-mail, phone)	Art. 6(1)(b) GDPR: steps taken at your request prior to entering into a contract	Up to 12 months from the last contact if no contract is concluded. After a contract is concluded: for the duration of the contract and until claims become time-barred
Sending the checklist ("Download the checklist" form)	Art. 6(1)(b) GDPR: providing the service you request	Up to 12 months from submitting the form
Marketing information by e-mail (only if you tick the optional consent box)	Art. 6(1)(a) GDPR (consent) in conjunction with Art. 398 of the Polish Electronic Communications Law	Until you withdraw your consent
Handling support requests (form at /support-requests/ and /zgloszenia/) and request status checks	Art. 6(1)(b) GDPR: performance of a contract or steps prior to entering into it	For the duration of handling the request and until claims become time-barred
Performance of contracts and billing	Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR (tax and accounting obligations)	Billing documents: for the period required by tax and accounting law, as a rule 5 years from the end of the calendar year in which the tax payment deadline expired
Website statistics (Google Analytics 4, analytics cookies)	Art. 6(1)(a) GDPR (consent) in conjunction with Art. 399 of the Polish Electronic Communications Law	`_ga`, `_ga_*` cookies up to 2 years or until you withdraw consent; data in Google Analytics for a maximum of 14 months
Basic cookieless traffic measurement (Google Consent Mode signals sent before consent, see section 4.3)	Art. 6(1)(f) GDPR: legitimate interest in aggregated measurement of visits and traffic sources	Data in Google Analytics for a maximum of 14 months
Website and form security (spam and attack protection, server logs)	Art. 6(1)(f) GDPR: legitimate interest in keeping the website secure	IP address stored with a form submission: 30 days; server logs: no longer than 12 months
Establishing, pursuing or defending legal claims	Art. 6(1)(f) GDPR: legitimate interest	Until claims become time-barred under the Polish Civil Code

After these periods, data is deleted or anonymised. Contact form and checklist form submissions are deleted automatically after 12 months, and the IP addresses stored with them after 30 days. Other data (calculator, support requests, e-mail correspondence) is deleted during a periodic review carried out at least once a year.

3. What data we collect

3.1. Data you provide

contact form: company name or full name, e-mail address, phone number (optional), message
"Call me back" window: phone number and the address of the page the request was sent from
pricing calculator: selected options and the calculated amount, e-mail address and, optionally, name, phone number and message
"Download the checklist" form: e-mail address and whether you consent to marketing information
support requests: company name or full name, e-mail address, phone number (optional), website or system concerned, type and description of the request

Providing data is voluntary, but without an e-mail address (or a phone number in the "Call me back" window) we cannot reply to your enquiry or handle your request.

3.2. Data collected automatically

IP address and basic technical information (browser, operating system, device type), recorded in server logs and when a form is submitted
after you consent to analytics cookies: information about your use of the website collected by Google Analytics 4 (pages visited, traffic source, approximate city-level location, events listed in section 4.4)

4. Cookies and similar technologies

4.1. Strictly necessary (no consent required)

ks_consent_v1 in browser storage (localStorage): your choice in the cookie banner, the date of consent and its expiry date
Cloudflare cookies protecting forms and the website against attacks (e.g. cf_clearance, __cf_bm), set according to Cloudflare settings, usually from 30 minutes to 1 year
your accessibility widget settings and the information that the "Call me back" window was closed (browser storage)

4.2. Analytics cookies (consent required)

Google Analytics 4 (Google Ireland Limited). The _ga and _ga_* cookies distinguish users and sessions and last up to 2 years. They are set only after you consent to the "Analytics" category.

4.3. Google Consent Mode v2 (advanced mode)

The Google script (gtag.js) loads on every page. Before you give consent, Google does not store analytics cookies on your device, but the script sends cookieless signals to Google: the consent status, the address of the page visited (including campaign parameters in the URL) and browser and device information, and Google receives your IP address. Google uses these signals for aggregated, modelled statistics. If you do not want these signals to be sent, you can block Google scripts in your browser (e.g. with the Google Analytics Opt-out add-on).

4.4. Events we measure

Through Google Analytics 4 we measure clicks on the phone number, e-mail address, social media links and contact buttons, as well as form submissions. We do not send form contents to Google.

4.5. Marketing cookies

We currently do not use marketing cookies (Google Ads, Meta Pixel). If we enable them, we will first update this policy and ask for your consent in the banner.

4.6. Managing your consent

The cookie banner lets you accept all cookies, choose essential cookies only or select categories.
Consent is valid for 12 months. After that, we will ask again.
You can change or withdraw your consent at any time by clicking "Cookie settings" in the website footer. When you withdraw consent to analytics cookies, we delete the _ga and _ga_* cookies from your browser.
You can also delete or block cookies in your browser settings (Chrome, Firefox, Safari, Edge).

4.7. Google map on the Contact page

The Google map loads only after you click "Show Google map". Google then receives your IP address and may set its own cookies under the Google Privacy Policy. Until you click, the page does not connect to Google Maps.

5. Recipients of data

LH.pl sp. z o.o. (Poland): hosting of kamikstudio.com and kamikstudio.pl and e-mail in the kamikstudio.pl domain
OVH (EU): e-mail in the kamikstudio.com domain
Cloudflare, Inc. (USA, also processing in the EU): CDN, attack protection, form spam protection (Turnstile) and e-mail address obfuscation
Google Ireland Limited (Ireland) and Google LLC (USA): Google Analytics 4 (cookies only after consent, cookieless signals described in section 4.3) and the Google map on the Contact page (only after you click "Show Google map")
AnyDesk Software GmbH (Germany): only during remote assistance started by you
Telegram: the internal notification about a new support request contains only the request number, type and priority, with no personal data
our accounting office and bank: for client billing
public authorities: only where required by law

The website fonts and script libraries are hosted on our own server, so loading them does not send your IP address to third parties. We do not sell data or share it with other companies for their own marketing.

6. Transfers outside the European Economic Area

Google LLC and Cloudflare, Inc. may process data in the USA. Transfers are based on Commission Implementing Decision (EU) 2023/1795 on the adequate level of protection under the EU-US Data Privacy Framework and, to the extent it does not apply, on standard contractual clauses approved by the European Commission. You can obtain a copy of the safeguards by writing to [email protected].

7. Profiling and automated decisions

We do not profile users for marketing purposes and do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. The pricing calculator computes an indicative amount in your browser. It is neither an offer nor a decision.

8. Data security

encrypted connection (HTTPS)
form spam protection (Cloudflare Turnstile, honeypot field, submission limits)
web application firewall (Cloudflare WAF) and regular software updates
backups
access to data only for people who need it to handle enquiries and requests

9. Your rights

You have the right to:

access your data and obtain a copy (Art. 15 GDPR)
rectify your data (Art. 16 GDPR)
erase your data (Art. 17 GDPR)
restrict processing (Art. 18 GDPR)
data portability for data processed on the basis of consent or a contract (Art. 20 GDPR)
object to processing based on legitimate interest (Art. 21 GDPR)
withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal (Art. 7(3) GDPR)
lodge a complaint with the Polish supervisory authority, Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or with the supervisory authority in your EU country (Art. 77 GDPR)

To exercise your rights, write to [email protected] or to ul. Fabryczna 1, 62-800 Kalisz, Poland. We will respond without undue delay and in any event within one month of receiving the request. Where necessary, this period may be extended by two further months; we will inform you of any extension within one month, stating the reasons.

10. Changes to this policy

We update this policy when the law, the tools used on the website or the way we process data change. The current version and the date of the last change are published on this page.

11. Legislation

Regulation (EU) 2016/679 (GDPR); Polish Personal Data Protection Act of 10 May 2018 (consolidated text: Journal of Laws 2019, item 1781); Polish Act of 18 July 2002 on Providing Services by Electronic Means (consolidated text: Journal of Laws 2024, item 1513, as amended); Polish Electronic Communications Law of 12 July 2024 (Journal of Laws 2024, item 1221, as amended), in particular Art. 399 (cookies) and Art. 398 (direct marketing); Polish Civil Code (consolidated text: Journal of Laws 2026, item 795).