Your data.
Clear rules.

01 / Controller

Who is responsible for your data?

The controller of your personal data is CyberPixel Vitalii Kubrak, a sole trader operating under that business name.

Postal address

Myśliborska 72A, unit 16, 03-185 Warsaw, Poland

Tax ID / Business register number

5243035047 / 541271444

Email

[email protected]

Messaging services

WhatsApp · Telegram

You can send data requests by email or post to the address above. You do not need an account or a messaging app. The controller handles data protection enquiries directly.

02 / Data we process

What information do we process?

• Contact and enquiries: your name, email address, voluntarily provided phone number, message, comment and information about the planned project.
• Calculator: the chosen solution type, features, answers about the project and timeline, information about an existing website or system, and a budget if you provide one. Questions depend on the service.
• Submission processing: the submission reference and date, and the page it was sent from. This address is stored without query parameters or the fragment after #.
• Enquiry source after analytics consent: utm_source, utm_medium, utm_campaign and utm_id tags, the entry path without parameters, recording date and privacy choice identifier. Campaign tags last for the tab session, up to 24 hours; when attached to an enquiry, correspondence retention periods apply. We do not collect arbitrary URL parameters, click identifiers or search terms for this purpose.
• Technical data: the IP address and request information needed to deliver and protect the website, processed by the hosting infrastructure.
• After analytics consent: random visitor and session identifiers, pages visited, entry source, campaign, WhatsApp clicks, device type, browser, operating system, language, time zone, screen size and approximate location (country, region, city).
• After marketing consent: Meta Pixel event data, including visits, WhatsApp clicks and successfully accepted enquiries, browser identifiers, visited page URLs and technical information sent to Meta.

Analytics identifiers are pseudonymous, not anonymous. We do not store raw IP addresses in our analytics database. This does not mean that your IP address is not processed by our hosting provider or, with your consent, an advertising provider.

03 / Forms and quotes

What happens to your message?

The footer form and quote calculators send enquiries through Cloudflare infrastructure to our business mailbox [email protected], hosted in Google Workspace. We use your answers to prepare a proposal and discuss your project.

Providing data is voluntary and is not a statutory requirement. A name and valid email are needed to submit an enquiry and receive a reply; the contact form also requires a message. The phone number and calculator comment are optional. Without the required data, you cannot submit the form, but you can still browse the website and contact us through another channel.

Your answers remain in the form as you move between steps; we do not store draft enquiry contents in localStorage. Before submission, we do not send these answers to the mailbox. Duplicate prevention retains only a technical confirmation and submission hash, without message contents or contact data.

Do not enter special-category data, such as health information, passwords, payment card details or other people's data that we do not need for the conversation. Sending an enquiry does not constitute consent to a newsletter or unrelated marketing offers.

04 / Purposes and legal bases

Why do we use data?

Answering enquiries and preparing proposals

Article 6(1)(b) GDPR — steps taken at your request before entering into a contract, or performance of a contract. When you contact us on behalf of a business or about a matter unrelated to entering into a contract: Article 6(1)(f) GDPR — our legitimate interest in handling correspondence and business contacts.

Website operation and security

Article 6(1)(f) GDPR — our legitimate interest in ensuring website availability, preventing abuse, protecting the administration area and avoiding duplicate form submissions.

Website analytics

Article 6(1)(a) GDPR — your analytics consent. We use it to understand traffic and improve the website's content and usability.

Meta advertising measurement

Article 6(1)(a) GDPR — your marketing consent. The Pixel helps assess campaign effectiveness and create or tailor advertising audiences.

Remembering and demonstrating consent choices

Article 6(1)(c) GDPR in conjunction with Articles 5(2) and 7(1) GDPR — accountability and demonstrating consent. An essential browser setting also allows us to respect a refusal.

Legal obligations and claims

Article 6(1)(c) GDPR — where a statutory document retention duty arises, for example under accounting rules. Article 6(1)(f) GDPR — our legitimate interest in establishing, exercising or defending specific legal claims.

Storing information on or accessing information from your device is also governed by Article 399 of the Polish Electronic Communications Law. Optional technologies require prior consent; the exception covers technologies strictly necessary for transmission or a function you request.

05 / Data recipients

Which providers do we use?

• Cloudflare, Inc. — hosting, website delivery and protection, form and email handling, analytics event database and technical delivery confirmations. Cloudflare privacy policy.
• Google Ireland Limited / Google entities providing Google Workspace — business email and correspondence storage and, after analytics consent, Google Analytics 4 and delivery of the Google Tag Manager container. When downloading the container, Google receives technical request data including IP address and browser information. Google Workspace data processing terms.
• Meta Platforms Ireland Limited — after marketing consent: Meta Pixel. Collection and transmission of event data to Meta involve joint controllership under Meta Business Tools joint processing agreement. Meta is responsible for subsequent processing in its services under its own policy; you can also contact us about your rights in relation to the joint processing stage.
• Your chosen messaging providers — only when you open WhatsApp or Telegram and use that service; details below.
• Authorised persons and service providers — only as necessary, for example technical, legal or accounting support relating to a specific matter. Authorities legally entitled to the data may also receive it.

We do not sell form data. The website uses our own analytics and Google Analytics 4 (G-XTFXYHKV9D), loaded through Google Tag Manager (GTM-F5X6R26S) after analytics consent. Meta Pixel starts after marketing consent. We also measure successfully accepted enquiries: generate_lead in GA4 and Lead in Meta. Clicking submit or encountering a form error does not count as such an event. Our integration sends a technical event identifier, form type and project category, without names, email addresses, phone numbers or message contents. Google ad_user_data remains denied; we do not grant consent for Google to use user-provided data for advertising. We do not load a direct Google Ads tag. Any change to the tools used requires appropriate consent settings and updated information.

06 / Data transfers

Is data transferred outside the EEA?

Cloudflare, Google and Meta use international infrastructure, so their services may involve processing data outside the European Economic Area, particularly in the USA. Using an external messaging service may also involve processing data outside the EEA.

For transfers involving services that process data on our behalf, safeguards described in provider terms apply: European Commission-approved standard contractual clauses with required supplementary measures, or an adequacy decision only where it covers the recipient and transfer. We do not assume every service or country provides the same protection.

You can find information and copies of safeguards in Cloudflare DPA, Google Workspace terms and Meta's data transfer addendum. You can also ask the controller about safeguards applicable to your data. Messaging providers describe their independent processing in their privacy policies.

07 / Retention

How long do we keep data?

Enquiry without a contract

For the duration of the conversation, then up to 12 months after it ends. Longer only where necessary for an existing legal obligation or a specific claim.

Contract-related correspondence

For contract performance, then for the statutory retention period for the relevant documents or until the applicable limitation period expires. Duration depends on the matter and document; we do not retain all correspondence merely because some records must be kept.

Form delivery confirmation

A technical identifier, hash and delivery status — up to 8 days after confirmation creation. This is not a submission content database; submissions are delivered to email.

Our own analytics events

Up to 14 months after the event; older records are deleted as part of database maintenance. Withdrawing consent stops further collection. You can ask the controller to delete previously stored data.

Privacy choice records

Up to 5 years after recording — choice identifier, selected categories, date and policy version, without form contents.

Administration login protection

Technical login attempt hashes — normally up to 24 hours; administration sessions up to 8 hours. Hosting data is also subject to the provider's service terms and retention periods.

When deletion is requested, we assess whether there is a basis for further retention. We do not keep data just in case. Browser storage periods are described below; they differ from advertising provider retention and mailbox correspondence retention.

08 / Your rights

You have control over your data.

• You may request access to your data and a copy of it, rectification, erasure or restriction of processing, subject to the conditions set out in the GDPR.
• Where processing is based on consent or a contract and is automated, you may request data portability to the extent provided in Article 20 GDPR.
• You may lodge an objection on grounds relating to your situation, to processing based on legitimate interests. An objection to direct marketing takes effect without giving a reason.
• You may withdraw consent at any time, as easily as you gave it. This does not affect the lawfulness of earlier processing. Choose “Privacy settings” and reject the optional categories.
• You may lodge a complaint with the President of Poland's Personal Data Protection Office (UODO). Instructions for making a complaint are available on UODO's page on individual rights. You do not need to contact us before making a complaint.

Send your request to [email protected]. We will respond without undue delay, normally within one month. For complex or numerous requests, this period may be extended by a further two months; we will explain why within the first month. If we have reasonable doubts about your identity, we may ask only for information needed to verify it.

You do not need to provide unnecessary data to exercise your rights. For pseudonymous events, a browser identifier or consent choice may help; if we cannot identify your records, we will explain this in our response. Rights may be subject to GDPR restrictions, such as a duty to retain a specific document.

09 / Cookies

You choose the categories.

Cookies are small pieces of information stored by your browser. We also use localStorage (website storage) and sessionStorage (session storage). Optional tools start only after you select the relevant category. Scrolling or closing a window does not constitute consent.

Google Analytics 4: _ga, _ga_*Analytics · cookies · Google

Measuring visits, sessions and events after analytics consent, including successful enquiries. Cookies may last up to 2 years under Google's default settings; browsers may shorten this period. Event data retention depends on Google Analytics property settings. You can withdraw consent in privacy settings or contact us to exercise your rights.

cp_campaign_v1Analytics · sessionStorage · Cyber Pixel

Minimal campaign tags, entry path, date and consent identifier. Stored for the tab session, no longer than 24 hours. Deleted when consent is withdrawn or expires.

cp_lead_eventsAnalytics or marketing · sessionStorage · Cyber Pixel

Identifiers of sent success events, to avoid counting the same conversion twice. No contact data or form contents; up to 60 entries per tab session, deleted when consent is withdrawn or expires.

Google Tag ManagerAnalytics · GTM-F5X6R26S container · Google

Loaded only after analytics consent. The container itself does not set analytics or advertising cookies; separately configured tags may do so and require appropriate information and consent. Without JavaScript, we do not load a fallback iframe, so privacy choices are not bypassed. Google privacy policy.

cp_privacy_v2Essential · localStorage · Cyber Pixel

Remembers categories, date, consent identifier and policy version. Up to 12 months after your choice, unless you delete website data earlier or a change requires a new choice.

cp_visitor_idAnalytics · localStorage · Cyber Pixel

A random visitor identifier created after analytics consent. Deleted when consent is withdrawn or expires, at the latest on the next visit after expiry. You can delete it earlier in your browser.

cp_session_idAnalytics · sessionStorage · Cyber Pixel

A random session identifier created after analytics consent, lasting for the tab session. Also deleted when consent is withdrawn or expires. Your browser may restore the session with the tab.

_fbp / _fbcMarketing · cookies · Meta

Meta Pixel: recognising a browser and linking a visit to an ad click. Usually up to 90 days, depending on the tool and browser settings. _fbc may be created after arriving from a Meta ad. These cookies are blocked before marketing consent; when consent is withdrawn, we delete accessible cookies in this category from our domain.

cp_admin_sessionEssential · cookie · administrator login only

Administration session, lasting up to 8 hours or until logout. Not created during normal public browsing. The cookie uses Secure, HttpOnly and SameSite=Strict.

cp_themeEssential · localStorage · Cyber Pixel

Stores only your chosen theme (light or dark) and the date of your choice for up to 12 months. This is an appearance preference, without a user identifier or any connection to forms or analytics tools. Dismissing the theme suggestion is stored separately in sessionStorage under cp_theme_prompt, only for the browser tab session.

cp_languageEssential · cookie · Cyber Pixel

Remembers only your manually selected language (Polish or English) for up to 12 months. Without a saved choice, we select a version based on your preferred browser language and the request country supplied by Cloudflare. We do not record a separate location history for this purpose or link your language setting to form data.

You can also delete or block website data and cookies in your browser settings. Deleting the consent setting will display the choices again. We cannot delete cookies set directly on another provider's domain; manage them in your browser or that service's settings. Read more in Meta's cookie policy.

10 / External contact

WhatsApp and Telegram.

Links lead to an external service. We do not embed messaging chats on the website. Only opening a link connects you to that provider; independently, Meta Pixel may run after marketing consent.

After a calculator submission, the WhatsApp link contains a prepared message with the enquiry reference. Opening WhatsApp passes this text to that service; does not automatically send a message to us. The Telegram link opens the contact @vitaliiwebdev. Conversation contents, your phone number or profile name are processed according to the channel you choose and the information you share.

Providers also process data as independent controllers under their own terms: WhatsApp Ireland Limited — privacy policy and Telegram — privacy policy. You do not have to use them — you can email us directly.

11 / Automation

We do not make decisions for you.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects within Article 22 GDPR. The calculator collects project requirements; we prepare the final proposal individually.

After marketing consent, Meta may combine events with other data it holds, including accounts in its services, and use them for measurement, audience creation or personalised advertising. This may constitute marketing profiling. Details and settings are described in Meta's privacy policy. We do not send names, email addresses, phone numbers or form contents to the Pixel.

12 / Document

Updates and legislation.

This policy applies to cyber-pixel.com and the contact channels described. It may change when our features or providers change or legislation requires it. The date and version appear at the top. If a change affects the scope of consent, we will ask you to choose again before activating the relevant tools. Changing this policy's wording does not expand consent already given.

The principal legislation is Regulation (EU) 2016/679 — GDPR and the Act of 12 July 2024 — Polish Electronic Communications Law. If we need to provide additional information before using data for a different purpose, we will do so before that processing begins.