prostrona.pl

Privacy Policy

Privacy Policy — prostrona.pl

Effective date: 13 October 2026

This Privacy Policy explains how we process the personal data of people who use the prostrona.pl service and its subpages (including the offer, payment, Panel, withdrawal and ticket pages), of our Clients, of people who contact us, and of businesses whose data we obtain from public sources in order to propose working together.

This Policy does not cover the processing of data about visitors to the websites we create and maintain for our Clients. The controller of that data is the owner of the website concerned, and we process it on their behalf under a data processing agreement (Annex 2 to the Terms). You will find information about that processing in the privacy policy of the website you are visiting.

§1. Controller

  1. The controller of your personal data ("Controller", "we") is Jan Czerwiński, a sole trader:
    • Polish tax ID (NIP): 5842816986
    • REGON: 521841905
    • Address: ul. Rubinowa 2, 09-400 Ludwikowo, Poland
  2. Contact on personal data matters:
    • e-mail: kontakt@prostrona.pl
    • phone: +48 663 099 054
    • postal address: ul. Rubinowa 2, 09-400 Ludwikowo, Poland
  3. The Controller has not appointed a data protection officer. You can contact the Controller directly about any personal data matter.

§2. Legal framework

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation — GDPR), the Polish Personal Data Protection Act of 10 May 2018 and the Polish Act of 18 July 2002 on the Provision of Electronic Services.

§3. Purposes, legal bases and scope of processing

  1. Using the Service and keeping it secure. When you visit the Service, our servers record technical request data: IP address, date and time, the address of the subpage, the referring page and browser and device data. We use it to display the page, detect errors and protect against attacks. Legal basis: the Controller's legitimate interest (Article 6(1)(f) GDPR).
  2. Visit statistics. We measure traffic with umami, which runs on our own infrastructure. It does not store cookies or any other identifiers on your device and does not store IP addresses — the address is used only momentarily to determine your approximate location and to create a pseudonymous visit identifier that changes periodically. We collect: pages visited, referring page, country, region and city (derived from the IP address), device type, operating system and browser. On demo websites prepared for prospective Clients (§4), the statistics also show us whether the website has been viewed. Statistics are not shared with any advertising platform. Legal basis: our legitimate interest in assessing how the Service and our offers perform (Article 6(1)(f) GDPR).
  3. Answering enquiries. When you write to us via a form or by e-mail, or call us, we process the data you give us (e.g. name, company name, phone number, e-mail address, message). A form submission reaches our e-mail inbox, our customer relationship system (CRM) and, as a notification, our internal messaging tool (Slack). Legal basis: our legitimate interest in replying to your message (Article 6(1)(f) GDPR) and, where the enquiry concerns a contract, steps taken at your request before entering into it (Article 6(1)(b) GDPR). The application form at /formularz is also protected against bots by Google reCAPTCHA (§9).
  4. Concluding and performing contracts. We process the data needed to prepare an offer and to conclude and perform a contract for the creation and maintenance of a website or for the sale of AI Credits: name or company name, address, tax number, e-mail address, phone number, payment data (amount, currency, status and transaction ID — no card details), the wording of the request to start performance made at payment together with its date, IP address and the version of the Terms, and our correspondence. We verify business tax numbers in public registers (the Polish REGON register kept by Statistics Poland, VIES). Legal basis: performance of the contract (Article 6(1)(b) GDPR).
  5. Account and Panel. We process your e-mail address, name, hashed password, chosen language, sign-in session data and the change history of your Website. Legal basis: performance of the contract (Article 6(1)(b) GDPR).
  6. AI Editing and building your Website. The instructions you type in the editing chat, the content and code of your Website and screenshots of it are sent to artificial intelligence model providers (Anthropic, OpenAI) in order to carry out your instructions. Please do not enter personal data in the chat that is not needed to change your Website. Legal basis: performance of the contract (Article 6(1)(b) GDPR).
  7. Invoices, taxes and accounting. We issue and keep invoices and accounting records. Legal basis: legal obligation (Article 6(1)(c) GDPR).
  8. Withdrawal and complaints. We process the data given in a withdrawal statement or complaint (name, e-mail address, the contract concerned, the content, and the date and IP address of submission) and the data needed to refund payments. Legal basis: legal obligation (Article 6(1)(c) GDPR) and performance of the contract (Article 6(1)(b) GDPR).
  9. Event tickets. The processing of ticket buyers' data is described in the Ticket Terms (§7).
  10. Establishing, exercising and defending legal claims. Legal basis: the Controller's legitimate interest (Article 6(1)(f) GDPR).

Providing data is voluntary, but without the data needed to conclude the contract and issue an invoice we cannot conclude it.

§4. Business data obtained from public sources (Article 14 GDPR)

  1. Who this concerns. We build websites for businesses before we contact them — the business can look at a finished website and only then decide whether to buy it. This concerns businesses, including sole traders, and agencies we would like to work with.
  2. Sources: public business profiles on Google Maps, public registers (the Polish CEIDG business register, the REGON register kept by Statistics Poland, the VIES system), business websites, public business profiles on social media (Facebook, Instagram) and web search results.
  3. Categories of data: business name, the owner's name (where it is part of the business name or appears in a register), business address, business phone numbers and e-mail addresses, website and social media profile addresses, tax ID and REGON number, opening hours, description of the business, photos, and ratings and reviews published in the business profile. Reviews may include the name or nickname of their author — in that case this information applies to them too.
  4. Purposes: preparing a draft website for the business (with the help of artificial intelligence models) and presenting an offer by e-mail, text message or phone, using the business's work contact details. The demo website is available at an address on the prostrona.pl domain, is not indexed by search engines and is not linked anywhere other than in the message sent to the business.
  5. Legal basis: our legitimate interest in direct marketing of our own services to businesses (Article 6(1)(f) GDPR).
  6. Right to object. You can object to this processing at any time — simply reply to our message or write to kontakt@prostrona.pl. Once you object, we stop contacting you and delete your data and the demo website, keeping only the information needed to make sure we do not contact you again.
  7. Retention: until you object or, if we do not end up working together, 24 months after the last contact (§10(8)).
  8. Recipients: the providers listed in §7, in particular the providers of tools for collecting public business data (Apify, Outscraper, Serper), artificial intelligence model providers (Anthropic, OpenAI), e-mail providers (Zoho, Google) and the SMS gateway (SMSAPI).
  9. The information in this section is always available in this Policy at prostrona.pl/polityka-prywatnosci. If you ask — for example by replying to our message — we will also send it to you directly.

§5. Offer links and visit recording

  1. We sometimes send an offer as a personal link (prostrona.pl/s/…). When you open it, we log the visit, its date and time, the device type, browser and referring page, so that we know whether the offer has arrived. Legal basis: our legitimate interest in following up the offer we sent (Article 6(1)(f) GDPR).
  2. On the page the personal link leads to, a notice asks whether we may record your visit. A recording is made only if you choose "I agree", and it covers scrolling, clicks, cursor movement and how the page looked during the visit. Anything you type into form fields is not recorded — the recording shows only asterisks in its place. If you choose "No" or do not answer, no recording is made. When you browse the Service normally, without a personal link, we do not ask for consent and do not record visits. The recording helps us improve the website we are proposing — to see which parts interested you and which were unclear. Legal basis: consent (Article 6(1)(a) GDPR).
  3. We store your answer, with its date, against that visit (as a record of consent given or refused) and in the pv_share_consent cookie (§9), so that we do not ask again on later visits from personal links for 180 days — your answer then applies to those visits too.
  4. You can withdraw your consent at any time: during a recorded visit, click "Stop" in the "This visit is being recorded" box in the corner of the page — recording stops immediately, and we remember your refusal for later visits from links too. You can also withdraw consent by writing to kontakt@prostrona.pl — we will then also delete the recordings of your earlier visits. You can delete the pv_share_consent cookie in your browser to be asked again the next time you open a link. Withdrawing consent does not affect the lawfulness of recording before the withdrawal.
  5. We keep recordings for 12 months after the visit and then delete them (§10(8)).

§6. Call recordings

  1. We record conversations with Clients and prospective Clients (online meetings or phone calls) only after informing the other person at the start of the conversation, and only if they agree. Legal basis: consent (Article 6(1)(a) GDPR).
  2. The recording is automatically transcribed (ElevenLabs), and an artificial intelligence model (Anthropic) prepares a note of what was agreed based on the transcript. We use recordings to keep track of what was agreed and to improve our service.
  3. You can withdraw your consent at any time — during the conversation or afterwards, by writing to kontakt@prostrona.pl. We will then delete the recording, the transcript and the note.
  4. We keep recordings, transcripts and notes for 12 months after the conversation and then delete them (§10(8)).

§7. Recipients

  1. We do not sell personal data or share it with others for marketing purposes.
  2. To the extent necessary to provide our services, the following providers (processors) process data on our behalf under data processing agreements or data processing terms:
    • Railway Corporation (USA) — hosting of the Service, database and files, including the umami statistics tool; data centre in the Netherlands,
    • Cloudflare, Inc. (USA) — CDN, DNS, protection against attacks and traffic routing, including on Clients' domains,
    • GitHub, Inc. (USA) — storage of website source code, including its content,
    • Stripe Payments Europe, Limited (Ireland) — processing payments for offers and AI Credits,
    • PayU S.A. (Poland) — processing payments for event tickets,
    • Fakturownia sp. z o.o. (Poland) — issuing and storing invoices,
    • Resend, Inc. (USA) — sending e-mails generated by the Service (e.g. confirmations, invoices, password resets, form submissions),
    • Google Ireland Limited (Ireland) — e-mail and office tools (Google Workspace),
    • Zoho Corporation B.V. (Netherlands) — mailboxes used to send offers to businesses (Zoho Mail, EU data centre),
    • LINK Mobility Poland sp. z o.o. (Poland) — sending text messages (SMSAPI gateway),
    • Slack Technologies (USA) — internal notifications about enquiries, payments and replies to offers,
    • Anthropic (USA) and OpenAI (USA) — artificial intelligence models used to prepare and edit websites and to draft texts and call notes,
    • ElevenLabs (USA) — automatic transcription of call recordings,
    • Apify Technologies s.r.o. (Czech Republic), Outscraper (USA) and Serper (USA) — collecting public business data from Google Maps, social media and web search,
    • fal.ai (USA) — automatic image processing (e.g. background removal).
  3. Data may also be received by: the firm that provides our accounting services, a law firm (in the event of a dispute), banks and payment operators as independent controllers, the event organiser (data of participants in ticketed events) and public authorities where the law requires it.
  4. Google reCAPTCHA (§9) and Stripe, for payment pages hosted by Stripe, also process some data as independent controllers, under their own privacy policies.

§8. Transfers outside the European Economic Area

  1. Some providers are established in the United States or process data outside the European Economic Area (EEA).
  2. Such transfers are based on the European Commission's adequacy decision (the EU–US Data Privacy Framework) for organisations certified under it, or on the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR). You can obtain a copy of these safeguards by writing to kontakt@prostrona.pl.

§9. Cookies and similar technologies

  1. The Service stores on your device only cookies that are necessary for it to work or to provide a service you have asked for. We do not use advertising, tracking or profiling cookies, so we do not ask for your consent to cookies — the law (the Polish Electronic Communications Law implementing Article 5(3) of Directive 2002/58/EC) exempts strictly necessary cookies from this requirement.
  2. Cookies set by the Service:
    • auth_session — keeps you signed in to the Panel; set when you sign in, valid for up to 30 days, inaccessible to scripts (HttpOnly),
    • prostrona-lang — remembers the language you chose for the Service and websites; set when you choose a language, valid for 1 year,
    • admin_locale — remembers the language of the Panel; set when you choose a language, valid for 1 year,
    • pv_share — links a visit from a personal offer link (§5) to the page opened; set only when you arrive from such a link, valid for 5 minutes, HttpOnly,
    • pv_share_consent — remembers your answer to the question about recording a visit from a personal link (§5(3)); set only once you answer, valid for 180 days, HttpOnly,
    • bilety_bramka — opens guest check-in mode for an event; set only on the devices of people handling entry, valid for 14 days, HttpOnly.
  3. Third-party cookie: on the application form page (/formularz) we load Google reCAPTCHA, which stores the _GRECAPTCHA cookie and sends Google your IP address and browser data to tell humans from bots. reCAPTCHA is not loaded on any other page. Stripe payment pages (checkout.stripe.com) use Stripe's own cookies.
  4. We use browser storage (localStorage) only to remember interface settings (e.g. colour theme or a dismissed notice). This information does not leave your device.
  5. You can delete or block cookies at any time in your browser settings. Without the auth_session cookie you will not be able to sign in to the Panel, and without prostrona-lang the Service will not remember your chosen language.

§10. Retention

  1. Contract data — for the duration of the contract and then until the limitation period for claims expires (as a rule 6 years, and 3 years for claims related to running a business, counted to the end of the calendar year).
  2. Invoices and accounting records — for 5 years from the end of the calendar year in which the tax payment deadline passed.
  3. Enquiries that did not lead to a contract — 12 months after the last contact.
  4. Business data from public sources — as set out in §4(7).
  5. Offer-link visit recordings and call recordings — as set out in §5(5) and §6(4).
  6. Server logs — for a short period determined by our hosting providers' settings, usually no longer than 30 days.
  7. Data processed on the basis of consent — until consent is withdrawn; on the basis of legitimate interest — until an objection is upheld, but in each case no longer than the periods above.
  8. We delete or anonymise data whose retention period has expired during a periodic review that we carry out at least once a quarter. Data may therefore actually be deleted up to 3 months after the relevant period ends.

§11. Your rights

  1. You have the right to:
    • access your data and receive a copy,
    • rectify inaccurate or outdated data,
    • erase your data (the "right to be forgotten"),
    • restrict processing,
    • data portability for data you have provided to us, where we process it on the basis of a contract or consent,
    • object to processing based on legitimate interest — including, at any time, to direct marketing,
    • withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.
  2. To exercise these rights, write to kontakt@prostrona.pl or call +48 663 099 054. We will reply without undue delay and in any event within one month of receiving your request.
  3. You have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl). If you live or work in another EU Member State, you may also lodge a complaint with the supervisory authority of that country.

§12. Automated decision-making

We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Artificial intelligence models help us prepare websites, texts and notes, but decisions about working together are made by a person.

§13. Security

  1. We apply technical and organisational measures appropriate to the risk, in particular:
    • encryption of data in transit using TLS (HTTPS),
    • access to data limited to authorised persons and protected by passwords and authentication mechanisms,
    • regular backups,
    • data minimisation — for example, payment card details go directly to the payment operator and we never see them.
  2. Processors acting on our behalf are required to apply appropriate protection measures.

§14. Changes to this Policy

  1. This Policy may change as the law or our services change. The current version, with its effective date, is always available at prostrona.pl/polityka-prywatnosci.
  2. We will notify Clients by e-mail of material changes affecting ongoing processing.
  3. This Policy is available in Polish and English. Matters not covered by it are governed by the GDPR and Polish law.
Jan Czerwiński · Polish tax ID (NIP) 5842816986 · ul. Rubinowa 2, 09-400 Ludwikowo, Poland prostrona.pl