Privacy policy

Controller

The controller of your personal data is ITWILLROCK Sp. z o.o., with its registered seat at ul. Czereśniowa 6, 55-020 Mędłów, Poland, entered in the register of entrepreneurs of the National Court Register under KRS number 0000848392, NIP 8992881797, REGON 386425973. For any matter concerning your personal data, write to privacy@itwillrock.com or to the postal address above.

What we process and why

Contact form. When you write to us through the form on the Contact page, we process the data you enter: your name, your work email address, your company (optional), the topic you select, and your message. We use it to answer your message and, where a commercial relationship follows, to prepare and perform a contract. Legal basis: Article 6(1)(b) GDPR (steps prior to entering into a contract at your request) and Article 6(1)(f) GDPR (our legitimate interest in handling business inquiries). The form also records the time it was opened and contains a hidden field that visitors never fill; we use these only to reject automated submissions. Legal basis: Article 6(1)(f) GDPR.

Server logs. Our hosting provider records technical data about each request: IP address, date and time, requested URL, referring page, browser and operating system identifiers, and the response status. We use these logs to operate the site securely, to diagnose faults, and to defend against abuse. Legal basis: Article 6(1)(f) GDPR.

Analytics. We use analytics only if you accept analytics cookies in the consent banner. Analytics data is used to understand how the site is used, in aggregate. Legal basis: Article 6(1)(a) GDPR (your consent), together with the Polish rules on storing information on end-user devices. You can withdraw consent at any time through "Cookie settings" in the footer; withdrawal does not affect processing that took place before it. Where no analytics provider is configured, no analytics data is collected regardless of your choice.

Direct email and telephone. If you contact us by email or telephone, we process the data you provide to handle your request. Legal basis: Article 6(1)(b) or (f) GDPR, as above.

Recipients and processors

We share personal data only with providers that process it on our behalf under data processing agreements, and only to the extent needed for the purposes above:

• Hosting and content delivery: Vercel Inc. (hosting and content delivery).
• Email delivery for contact-form messages: Zoho Corporation (email hosting and delivery of contact-form messages).
• Analytics, only with your consent: none at present; if an analytics tool is enabled it will be named here and loaded only after consent.

We do not sell personal data, and we do not share it with third parties for their own marketing. We may disclose data where the law requires it, or to establish, exercise, or defend legal claims.

Transfers outside the EEA

We process personal data in the European Economic Area by default. Where a provider listed above processes data outside the EEA, the transfer relies on a European Commission adequacy decision or on the Standard Contractual Clauses under Article 46(2)(c) GDPR, with supplementary measures where needed. You can ask us for a copy of the safeguards in place by writing to the address in the Controller section.

Retention

Contact-form messages and the related correspondence are kept for 12 months after our last exchange. If a contract follows, the data is kept for the duration of the contract and for the limitation periods that apply to it. Server logs are kept by the hosting provider for the period named in its documentation and are not extended by us. Analytics data is kept for the period set by the analytics provider and named in the Cookie policy. Consent records are kept for as long as the consent applies and for the limitation period after it is withdrawn.

Your rights

Under the GDPR you have the right to access your personal data; to have it rectified or erased; to restrict its processing; to receive it in a portable format; and to object to processing based on legitimate interest. Where processing is based on consent, you can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise a right, write to privacy@itwillrock.com. We respond within 1 month. For complex requests this period can be extended by 2 further months, in which case we tell you within the first month.

You also have the right to lodge a complaint with a supervisory authority: in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa; or the authority of the EU member state in which you live or work.

No automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects.

Changes

We may update this policy when our processing, our providers, or the law changes. The effective date and version number at the top of this page identify the current version, and the current version is the one published here.