Privacy Policy

1. Personal Data Controller

The personal data controller is Michał Rutkowski, operating a business under the name LabLogic Consulting Michał Rutkowski, with the business address at ul. Wolności 15, 81-327 Gdynia, hereinafter referred to as “LabLogic” or “Controller”.

For matters concerning the processing of personal data, you can contact the Controller at: gdpr@LabLogic.pl

This policy describes the principles of personal data processing in connection with:

• using the lablogic.pl website;
• sending inquiries via the contact form;
• contact by email, phone, or during a meeting;
• preparation, conclusion, and performance of contracts;
• maintenance, analysis, and security of the website;
• using remote support services provided by LabLogic.

This policy does not describe in detail the processing of data that LabLogic carries out on the documented instructions of its clients as a processor, particularly during audits, incident handling, DPO services, IT support, or work in the client’s systems. In such cases, the purposes and essential methods of processing are determined by the client, who is the data controller, and the terms of cooperation result from relevant agreements and instructions.

2. What data may be processed

Data related to inquiries and correspondence

• first and last name;
• company or organization name;
• position or function held;
• email address;
• phone number, if provided;
• selected area of support;
• content of the inquiry and further correspondence;
• other information voluntarily provided by the sender;
• technical data related to sending the form and protection against abuse.

Data related to cooperation

• identification and contact data;
• data of the represented organization;
• data contained in contracts, orders, offers, and correspondence;
• information necessary for the organization and provision of services;
• data of individuals participating in project implementation;
• billing, accounting, and tax data;
• information needed to demonstrate contract performance.

Technical data related to the website

• IP address;
• date and time of connection;
• visited URL address;
• referring page address;
• information about the browser, operating system, and device;
• information about errors, login attempts, and security events;
• cookie identifiers and analytical data – to the extent dependent on user settings and granted consents.

3. Where data comes from

Data is primarily obtained directly from the data subject, particularly via form, email, phone, meeting, or documents related to cooperation.

• the organization that the individual represents;
• a client or contractor who has indicated the individual as a representative, employee, contact person, or project participant;
• another person involved in organizing cooperation.

In such cases, typically processed data includes: first and last name, position or function, business contact details, organization name, and information related to the scope of cooperation.

Information about processing is provided at the latest at the first contact with the individual, unless they already possess this information or another exception provided in the GDPR applies.

4. Contact, inquiries, and offer preparation

Data provided in the form or correspondence is processed for the purpose of:

• providing a response;
• assessing needs and potential scope of support;
• preparing an offer;
• conducting further correspondence;
• taking steps prior to entering into a contract.

The legal basis for processing is:

• Art. 6(1)(b) GDPR – when actions are taken at the request of a person who may become a party to the contract;
• Art. 6(1)(f) GDPR – when contact is made on behalf of a company or organization, or does not directly lead to the conclusion of a contract with the person sending the inquiry.

The Controller’s legitimate interest is to conduct communication, respond to inquiries, prepare offers, and establish and maintain business relationships.

Data related to a general inquiry that did not lead to the initiation of cooperation is stored for a period not longer than 12 months from the end of correspondence.

If an individual offer was prepared, terms were negotiated, or other significant actions were taken before concluding a contract, data may be stored for a period not longer than 24 months from the last significant contact.

Data may be stored longer if necessary for the establishment, exercise, or defense of legal claims or for compliance with a legal obligation.

5. Conclusion and performance of contracts

Data is processed for the purpose of:

• conclusion and performance of the contract;
• organization of services;
• conducting project communication;
• documenting agreements and performed actions;
• ensuring accountability of services rendered;
• settlement of cooperation.

With regard to the person who is a party to the contract, the legal basis is Art. 6(1)(b) GDPR.

Data of employees, representatives, proxies, and other contact persons of the parties are processed on the basis of Art. 6(1)(f) GDPR. The Controller’s legitimate interest is the organization and implementation of cooperation, communication between the parties, and documentation of its course.

Data is stored for the duration of the contract, and then:

• for the period required by tax, accounting, or other legal provisions;
• until the expiry of the relevant limitation periods for claims;
• in the event of a dispute – until its final resolution and execution of the decision.

Tax and accounting documentation is stored for the period resulting from the relevant regulations, generally for 5 years counted according to the rules applicable to the given document and obligation.

6. Establishment, exercise, and defense of claims

Data may be processed for the purpose of:

• securing evidence of established facts;
• demonstrating due performance of obligations; pursuing receivables;
• clarifying disputes;
• defending against claims.

The legal basis is Art. 6(1)(f) GDPR.

The Controller’s legitimate interest is the protection of its rights and the ability to demonstrate the correctness of actions taken.

Data is stored until the expiry of the relevant limitation period for claims, and in the event of proceedings – until their conclusion and the execution of the issued decision.

7. Website security and maintenance

Technical data and information contained in logs are processed for the purpose of:

• ensuring the proper functioning of the website;
• detecting and removing errors;
• protection against spam, malware, hacking attempts, and other abuses;
• protection of forms and email;
• backup management;
• detecting, analyzing, and documenting security incidents; identifying sources of unauthorized activity.

The legal basis for processing is Art. 6(1)(f) GDPR.

The Controller’s legitimate interest is to ensure the confidentiality, integrity, availability, and resilience of the website, and the protection of data, systems, and users.

Wordfence only records security-related traffic. Data in the Live Traffic function is stored for a period not longer than 30 days.

Data related to a detected threat, block, or incident may be stored longer – for the period necessary to clarify the event, implement corrective measures, prevent similar events, and establish, exercise, or defend claims.

The hosting provider performs daily backups of website files and databases. Backups are stored for 30 days, and then deleted or overwritten.

8. Form protection using reCAPTCHA

Forms available on the website are protected using the Google reCAPTCHA service.

The service is used for:

• distinguishing human activity from automated submissions;
• reducing spam;
• detecting fraud and abuse;
• protecting the form, website, and email.

In connection with reCAPTCHA’s operation, the following may be processed, in particular:

• IP address;
• device and browser information;
• connection data;
• information about interaction with the form;
• token and risk assessment score;
• information needed to detect automated or malicious activity.

The legal basis for processing by the Controller is Art. 6(1)(f) GDPR. The legitimate interest is the protection of the Controller’s form and systems against spam, fraud, and other abuses.

With regard to data transferred by reCAPTCHA, LabLogic is the controller, while Google processes the data as a processor in accordance with the Google Cloud service terms and the data processing addendum.

Data is processed for the time necessary to perform verification, security assessment, and protection against abuse. Statistics provided to the Controller in the reCAPTCHA console cover a period of up to 90 days.

Information about cookies or similar technologies used by reCAPTCHA can be found in the Cookie Policy.

9. Google Analytics

After consenting to analytical cookies, the website uses the Google Analytics 4 service.

Data is processed for the purpose of:

• creating visit statistics;
• understanding how the website is used;
• assessing the effectiveness and usability of the site;
• detecting navigation and content problems;
• improving the structure and content of the website.

The legal basis is Art. 6(1)(a) GDPR, i.e., user consent.

Google Analytics is launched in conjunction with the Complianz consent management mechanism, WP Consent API, and Google Consent Mode. Analytical data is collected after the user makes an appropriate choice.

Consent can be given, refused, or withdrawn at any time using the consent management tool available on the website. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

User-level and event data is stored in Google Analytics for 14 months. This setting does not include standard aggregated reports, which may be stored by Google for a longer period.

Google Analytics is not used by LabLogic to make decisions concerning users that produce legal effects or similarly significantly affect them.

10. Cookies and similar technologies

The website may use cookies and similar technologies for the purpose of:

• ensuring the proper functioning of the website;
• protection against abuse;
• remembering consent decisions;
• conducting statistics – after obtaining user consent.

Cookies necessary for the operation of the website, security, or remembering consent preferences may be used without consent, to the extent permitted by applicable regulations.

Analytical cookies and other optional technologies are used after obtaining user consent.

Detailed information about the services used, cookies, their providers, purposes, and operating periods can be found in the Cookie Policy.

The user can change their decision at any time using the consent management function available on the website.

11. Data recipients

Data may be transferred or entrusted only to the extent necessary to achieve the described purposes:

• persons authorized by the Controller;
• LH.pl Sp. z o.o. – hosting, email, and backup provider;
• providers of IT, administrative, and security services;
• Defiant, Inc. – provider of the Wordfence solution;
• Google group entities – in connection with reCAPTCHA, Google Analytics, and Site Kit services;
• providers of accounting, legal, banking, and settlement services;
• operators of tools used for remote support – when an individual starts such a session;
• subcontractors and experts participating in the provision of a specific service, if their involvement is necessary;
• postal and courier operators, if required by the cooperation;
• public authorities, courts, and other authorized entities, when the obligation to transfer data results from law.

Entities processing data on behalf of the Controller may use it only on the basis of an appropriate agreement, in accordance with documented instructions and applicable regulations.

LabLogic does not sell personal data.

Data submitted via the general contact form is not saved in the WPForms Lite Connect service. The form is used to send messages to the Controller’s mailbox.

12. Transfer of data outside the European Economic Area

The use of certain technological services, particularly Google Analytics, reCAPTCHA, and Wordfence, may involve processing data outside the European Economic Area, especially in the United States, or accessing data from such a country.

Depending on the relevant recipient and the currently applied legal mechanism, data transfer takes place on the basis of:

• an adequacy decision by the European Commission, including decisions concerning organizations participating in the EU–US Data Privacy Framework;
• standard contractual clauses approved by the European Commission; additional technical, organizational, or contractual measures;
• another mechanism permitted under Chapter V of the GDPR.

Information about the mechanism applied in a specific case and the possibility of obtaining a copy of the safeguards used can be obtained by contacting: gdpr@LabLogic.pl

13. Voluntariness of providing data

The provision of data is voluntary.

However, providing information marked as required in the form is necessary to send the form, identify who is submitting the inquiry, assess the expected scope of support, and prepare and provide a response. Failure to provide the required data may prevent sending the form or proper handling of the inquiry.

The provision of data necessary for the conclusion and performance of a contract is voluntary, but its absence may prevent the initiation or implementation of cooperation.

Consent to analytical and other optional cookies is voluntary. Refusal does not restrict access to the basic content of the website or the ability to send an inquiry.

14. Rights of individuals

In cases specified in the GDPR, the data subject has the right to:

• obtain confirmation as to whether their data is being processed;
• access data and receive a copy thereof;
• rectify inaccurate data;
• complete incomplete data;
• erase data;
• restrict processing;
• data portability, if processing is based on consent or a contract and carried out by automated means;
• object to processing based on Art. 6(1)(f) GDPR;
• withdraw consent at any time;
• lodge a complaint with the President of the Personal Data Protection Office.

These rights are not absolute. Their exercise depends on the circumstances, legal basis, and applicable regulations. Further processing may be necessary, in particular, for compliance with a legal obligation or for the establishment, exercise, or defense of legal claims.

Requests regarding the exercise of rights can be sent to: gdpr@LabLogic.pl

The Controller may request information necessary to confirm the identity of the person submitting the request.

The Controller responds to requests without undue delay, generally no later than within one month. In cases provided for in the GDPR, this period may be extended, of which the person will be informed along with the reason.

15. Right to object

If data is processed on the basis of a legitimate interest, the individual may object at any time on grounds relating to their particular situation.

Upon receipt of an objection, the Controller shall cease processing the data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the individual, or for the establishment, exercise, or defense of legal claims.

16. Automated decision-making

The Controller does not make decisions concerning users based solely on automated processing, including profiling, which would produce legal effects concerning them or similarly significantly affect them.

The automatic analysis performed by reCAPTCHA serves solely to assess the risk of abuse and protect the form. It may necessitate additional verification or rejection of an automated submission, but it is not used to make decisions regarding the conclusion or performance of a contract.

17. Data security

The Controller applies technical and organizational measures adapted to the nature of the data, the scope of processing, and the identified risk, including in particular:

• transmission encryption;
• access control;
• authentication mechanisms;
• software updates;
• backup creation;
• protection against malicious traffic and unauthorized access attempts;
• restricting data access to persons who need it to perform specific tasks;
• analyzing and handling security incidents.

Passwords, access codes, cryptographic keys, special categories of personal data, full incident or breach documentation, or confidential organizational files should not be sent via the general contact form.

If the matter requires the transfer of such materials, an appropriate and secure communication channel should first be agreed upon with LabLogic.

18. Policy changes

The policy may be updated, particularly in the event of changes to:

• legal provisions;
• scope or purpose of processing;
• website operation method;
• services and providers used;
• security, statistics, or cookie settings.

The current version of the policy is published on this page along with its effective date.

The Controller may additionally inform about significant changes via a message on the website or another appropriate channel.