Privacy policy

01Data controller

The controller of your personal data is Witold Waśko, who runs the Aztral design studio (“Aztral”, “we”).

For anything related to your data, write to signal@aztral.space. We have not appointed a data protection officer, as it isn’t required at our scale.

02What data we process

• Contact form: your full name, email address, phone number (if you provide it), the content of your message and any attached files.
• Email: your email address, signature and anything you include in your message to us.
• Technical data: on every visit, the hosting server logs the IP address, date and time, the requested page, and the browser and operating system type. We use this only to run and secure the site.
• Visit statistics: anonymous data about a visit (the page viewed, the referring page, device, browser and operating system type, and an approximate country derived from the IP address). Umami doesn’t store IP addresses in its statistics, doesn’t use cookies and doesn’t follow you across other websites.

We don’t ask for special categories of data (such as health information), and we ask you not to include them in messages or attachments.

03Purposes and legal bases

• Replying to your message and discussing a collaboration, including preparing a quote or proposal: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and, if you write on behalf of a company, our legitimate interest in contacting it (Art. 6(1)(f) GDPR).
• Correspondence on other matters: our legitimate interest in replying to messages (Art. 6(1)(f) GDPR).
• Performing a contract, if we work together: Art. 6(1)(b) GDPR and, for invoices and accounting, our legal obligations (Art. 6(1)(c) GDPR).
• Establishing, pursuing or defending legal claims: Art. 6(1)(f) GDPR.
• Visit statistics (how many people visit the site and which parts they view, in aggregate, anonymous form): our legitimate interest in improving the site (Art. 6(1)(f) GDPR).
• Site security and protecting the form from spam (server logs, message limits, anti-spam verification): Art. 6(1)(f) GDPR.

04Providing data is voluntary

Providing your data is voluntary, but without your name, email address and message we can’t reply. The phone number is optional.

05Recipients

We entrust data only to service providers who process it on our instructions under data processing agreements:

• website hosting, form handling and email: seohost.pl (a Polish hosting provider);
• visit statistics: Umami Software, Inc. (Umami Cloud);
• protecting the form from bots: Cloudflare, Inc. (Turnstile), if verification is enabled;
• if we work together: an accounting office, a law firm and IT service providers, to the extent necessary.

Public authorities may also receive data where the law requires it.

06Transfers outside the European Economic Area

The site, the form and our email are handled by a Polish provider, so data from the form and from correspondence generally stays within the European Economic Area.

Visit statistics are provided by Umami Software, Inc., based in the United States, so anonymous statistical data may be processed outside the EEA under the safeguards in Umami’s data processing agreement (standard contractual clauses, Art. 46(2)(c) GDPR). Data from the form and from correspondence never goes to Umami.

The other exception is Cloudflare Turnstile anti-spam verification, if enabled: Cloudflare, Inc. is based in the United States, and technical data is transferred there under the European Commission’s adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses (Art. 46(2)(c) GDPR). You can request a copy of these safeguards at signal@aztral.space.

07How long we keep data

• correspondence that didn’t lead to a collaboration: up to 12 months after the last message (in case we pick the conversation up again), unless you ask us to delete it sooner;
• contract-related data: for the duration of the contract, then until the limitation periods for claims and the retention periods for accounting records expire (usually 5 years from the end of the tax year);
• attachments larger than 10 MB in total: on the hosting server (outside the public part of the site) for up to 30 days, while we receive a download link; after that they are deleted automatically (copies we keep for the conversation follow the rules above);
• server logs: according to the hosting settings, no longer than 30 days;
• visit statistics: up to 6 months, in aggregate form;
• data processed on the basis of legitimate interest: until you successfully object.

08Your rights

You have the right to access your data and receive a copy, to rectification, erasure, restriction of processing, data portability (where processing is based on a contract) and to object to processing based on legitimate interest (Art. 15–21 GDPR). Just write to signal@aztral.space; we’ll reply without undue delay, within one month at the latest.

If you believe we process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl) or with the supervisory authority in your EU country of residence.

09Automated decisions

We don’t make decisions about you based solely on automated processing, and we don’t profile. The form’s spam filter can only reject a message sent by a bot; if that happens, you can write to us directly.

10Cookies and browser storage

The site doesn’t use cookies for analytics or marketing and doesn’t use tracking tools. Visit statistics (Umami) work without cookies and don’t store anything in your browser. If your browser sends a “Do Not Track” signal, your visit is left out of the statistics.

In your browser’s local storage we save only your choices: sound on or off, and permission for the camera to follow your phone’s movement (keys az-sound and az-tilt), so the site remembers them. This information is strictly necessary for features you request yourself, so it doesn’t require consent (Art. 399 of the Polish Electronic Communications Law of 12 July 2024). You can delete it in your browser settings.

If the form is protected by Cloudflare Turnstile, the verification loads only once you start filling in the form and may store data in your browser that is needed to tell people from bots.

11Changes to this policy

When we change how we process data (for example, by adding an analytics tool), we’ll update this page and the date at the top. If a change requires your consent, we’ll ask for it separately.

This is an English version of the Polish privacy policy. In case of any discrepancy, the Polish version prevails.