Privacy policy

Data controller

The controller is Jakub Pałys, conducting business as Cloudflex Jakub Pałys, NIP: 6871981582, REGON: 526789300, address: Niebieszczany 490, 38-504 Sanok, Poland. Contact: contact@mail.cloudflex.pl.

Contact form

Data submitted in the form — name or company, email address, optional phone and store URL, topic, indicative budget and project description — is processed on the basis of consent to answer the enquiry, initially qualify the project and arrange further contact. Required data is voluntary, but without it we cannot handle the enquiry. Consent may be withdrawn at any time; withdrawal does not affect the lawfulness of earlier processing.

We disclose data to processors supporting the landing page: home.pl S.A., based in Szczecin, Poland — hosting and infrastructure, with no planned transfer outside the EEA — and Mailgun, a Sinch service — transactional email delivery and contact confirmations. Mailgun may use global infrastructure, so data may be transferred outside the EEA.

Transfers outside the EEA

For transfers to the United States or another country outside the EEA, we use the mechanism applicable to the specific flow, including the EU–U.S. Data Privacy Framework where the relevant entity and transfer are covered by current certification, or the European Commission Standard Contractual Clauses together with additional safeguards from the DPA and provider documentation. We periodically verify certifications and safeguards; the DPF alone does not remove every transfer risk.

Mailgun/Sinch information: https://www.mailgun.com/legal/privacy-policy/ and https://documentation.mailgun.com/docs/mailgun/api-reference/api-overview. DPF register: https://www.dataprivacyframework.gov/.

Google Analytics 4

Google Analytics 4 runs only after analytics consent. It may process a cookie client identifier, device and browser information, approximate location and visit or interaction events. Advertising features, remarketing, Google Signals, User-ID and Google Ads remain disabled according to the account configuration. GA4 data retention is set to 2 months and verified in the service console.

Google Analytics is provided by Google Ireland Limited for EEA users. Any transfers are described according to Google’s current status and the legal mechanism used.

Google reCAPTCHA v3

reCAPTCHA v3 loads only when the form is submitted and protects against spam and bots. It may set the _GRECAPTCHA cookie and process technical data needed for risk analysis. The legal basis and necessity are verified for the current configuration; the form links to Google’s privacy policy and terms.

Consent records

We record a pseudonymous consent identifier, decision, mechanism version, configuration hash and recording time to demonstrate correct operation of the consent mechanism. Records older than 13 calendar months are removed automatically when the application starts and then once a day.

Retention and rights

Enquiries and correspondence are kept for the time needed to handle the enquiry and then for the period necessary to defend against claims or comply with legal duties. Mailgun log retention depends on the account plan and configuration. You have rights of access, rectification, erasure, restriction, portability, objection, consent withdrawal and complaint to the Polish supervisory authority (UODO). We do not make decisions producing legal effects based solely on automated processing.

DPA and security

Before production launch, the controller enters into or accepts data processing agreements with home.pl S.A. and Mailgun/Sinch and verifies the sending region, retention, DPA, SPF, DKIM and DMARC.