Privacy Policy

Controller

The controller of personal data is Quartis Sp. z o.o., Aleja Jana Pawła II 27, 00-867 Warsaw, Poland.

For any matter concerning personal data you can reach us at: quartis@quartis.pl.

We have not appointed a Data Protection Officer — data protection matters are handled directly through the e‑mail address above.

Contact form — the data we process

When you send an enquiry through the contact form, we receive the data you enter yourself:

• e‑mail address — required, because without it we could not reply to your enquiry,
• message content — required, because it is the enquiry itself,
• name — optional,
• company name — optional,
• phone number — optional.

Purposes and legal bases

We process contact‑form data in order to answer your enquiry and handle the correspondence that follows.

• Article 6(1)(b) GDPR — where processing is necessary to take steps at your request before a possible contract is concluded, for example preparing information about the scope of service or terms of cooperation,
• Article 6(1)(f) GDPR (our legitimate interests) — where processing serves ordinary business correspondence, continuity of communication, protection of the website and the form against abuse, and establishing, pursuing or defending claims,
• Article 6(1)(c) GDPR — to the extent the law imposes documentation or settlement obligations on us if the contact leads to cooperation.

The checkbox next to the form

The checkbox in the form only confirms that you have read this Privacy Policy. It is not consent to processing within the meaning of Article 6(1)(a) GDPR — answering an enquiry is not based on consent, but on the legal bases set out above.

We do not collect marketing consent and we do not use contact‑form data to send commercial information you have not asked for.

How the message is stored

A message sent through the form is delivered as an e‑mail to the Quartis business mailbox, operated within the Google Workspace / Gmail service.

The website does not store enquiry content in a website database, in a CRM system, in cookies or in browser storage (localStorage, sessionStorage). Form data exists solely as e‑mail correspondence in the Quartis mailbox.

Form security and abuse prevention

To protect the form against automated spam and abuse, the server validates submitted data and limits how many submissions can be sent from the same source in a short period. For this purpose the server may process technical information accompanying the request, including a network identifier such as an IP address.

We use this information solely to secure the form and the website. We do not build profiles from it, do not combine it with advertising profiles and do not make automated decisions producing legal effects.

The legal basis is Article 6(1)(f) GDPR — our legitimate interest in the security and correct operation of the service.

Website statistics — Cloudflare Web Analytics

To obtain aggregate information about how the website is used and about its technical performance, including real‑user performance metrics, we use Cloudflare Web Analytics. The service is provided by Cloudflare.

The tool works without cookies and without storing measurement data in browser storage (localStorage, sessionStorage). We do not assign tracking identifiers to visitors, do not identify individual people and do not use this data for advertising profiles. We receive aggregate data only, for example the number of page views, page addresses, country, device and browser type, and load times.

The legal basis is Article 6(1)(f) GDPR — our legitimate interest in understanding how the website is used and in keeping it working correctly and performing well.

Technical logs

The website keeps no visit log of its own. Standard technical logs (for example request and error information) may be created and retained by the server infrastructure provider to the extent necessary for maintenance, diagnostics and security of the service.

Error events recorded server‑side serve only to diagnose the operation of the form and are not used to analyse user behaviour.

Recipients of the data

We do not sell data and do not share it for advertising purposes. It may be entrusted only to entities necessary to operate the website and handle correspondence:

• hosting and technical infrastructure providers running the website (the Lovable platform and Cloudflare — edge infrastructure and aggregate website statistics),
• the e‑mail provider — Google (Google Workspace / Gmail), which operates the Quartis business mailbox,
• entities supporting the maintenance and security of the website, within the services they actually provide,
• advisers and bodies authorised under applicable law, where necessary.

Transfers outside the EEA

Some infrastructure and e‑mail providers are global entities, so data may also be processed outside the European Economic Area.

In such cases we expect providers to apply the safeguards required by Chapter V of the GDPR. Details of the transfer mechanism used by a specific provider are available on request sent to quartis@quartis.pl.

Retention

We process correspondence for as long as necessary to handle the enquiry and the communication that follows from it.

Afterwards we may continue processing where necessary for our legitimate interests, in particular to establish, pursue or defend claims — until such claims become time‑barred.

If the enquiry leads to a contract, further processing follows the rules applicable to the contractual and client relationship and to our statutory obligations.

Your rights

To the extent provided by the GDPR, you have the right to:

• access your data and obtain a copy of it,
• have inaccurate or incomplete data rectified,
• erasure of data, in the cases provided for by law,
• restriction of processing,
• data portability, to the extent processing is carried out by automated means on the basis of Article 6(1)(b) GDPR,
• object to processing based on Article 6(1)(f) GDPR,
• lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

Providing your data

Providing data is voluntary, but the e‑mail address and the message are necessary for us to receive and consider your enquiry. The remaining fields — name, company and phone — are optional and only make contact more convenient.

Instead of the form you can contact us directly: quartis@quartis.pl or by phone.

Cookies

In its current state the website sets no cookies and uses no marketing tools, and Cloudflare Web Analytics measures usage without cookies and without measurement entries in your browser. Details, including the single necessary technical entry in session storage, are described in the Cookie Policy.

Changes to this policy

We update this policy whenever the scope of actual processing or the technical solutions in use change. The current version is always available on this page.