Axart Group Sp. z o.o., the owner of axartmedia.com, takes care to keep your personal data secure and confidential. This policy explains what we collect when you visit the website or contact us, why, on what legal basis, for how long, who can see it and what rights you have. We act in accordance with Regulation (EU) 2016/679 (the “GDPR”).
Who is the controller of your personal data?
The controller is Axart Group Sp. z o.o., ul. Kapelanka 12, 30-347 Kraków, Poland (KRS 0000657726, NIP 6762520095, REGON 366295859). For any question about your data, write to contact@axartmedia.com.
The contact form
When you send the form we receive what you enter: your name, email address and, if you give them, your company, your answers to the short questions (what you need, team size, timing), your message and whether you would like an NDA. We use these details only to answer your enquiry and prepare a proposal.
- The enquiry is delivered to our company mailbox hosted by Zoho and is also saved as a record in private storage at our hosting provider, Netlify, outside the public website.
- We keep enquiries indefinitely, so that we can refer back to earlier conversations with returning clients. You can ask us to delete your enquiry at any time by writing to contact@axartmedia.com, and we will do so unless the law requires us to keep it.
- To limit spam, we record a hash of your IP address and the time of each attempt to send the form. These records are kept in the same private storage and are used only for rate limiting.
- The website has no user accounts, newsletter or tracking of the form contents in analytics.
The legal basis is steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) or, for other correspondence, our legitimate interest in answering messages and keeping business relations (Article 6(1)(f) GDPR). Sending the form does not require consent to analytics.
The confirmation email
After you send the form we email you a short confirmation to the address you gave, so you know the enquiry reached us. It contains a fixed text and does not repeat your message. We send at most one confirmation to the same address in 24 hours, and we keep a record of the address and time for that period only to apply this limit. The legal basis is our legitimate interest in confirming receipt of your enquiry (Article 6(1)(f) GDPR).
Cookies, analytics and your consent
Google Analytics is off by default. The small bar at the bottom of the page lets you accept or reject it. Rejecting does not limit anything else on the site: the pages, email and contact form all work the same. You can change or withdraw your choice at any time under Privacy settings in the footer. Withdrawal does not affect the lawfulness of processing before it.
- Remembering your choice (necessary): a
localStorageentry in this browser holds your choice, the version of this notice, a receipt reference and an expiry date. We honour it for 180 days before asking again. It is not an advertising identifier. If browser storage is unavailable, the choice applies only to the current visit. - Google Analytics 4 (optional, Google): loads only after you accept. The
_gaand_ga_*cookies distinguish browsers and sessions, with a lifetime of at most 180 days. Google receives browser, device, page-visit and event data, such as which buttons and form steps were used. Our events never include your name, email address or the content of your enquiry. Advertising features are disabled. The legal basis is your consent (Article 6(1)(a) GDPR).
Withdrawing consent stops Google Analytics at once and deletes the _ga cookies this website can reach. It cannot delete cookies on Google’s own domains or undo data already sent; you can manage those in your browser and Google account settings.
Records of your consent choice
To be able to show that analytics ran only with consent, we record a receipt each time you accept, reject or withdraw: random receipt and request identifiers, the choice, the time it was recorded, the page path without parameters and the version of the notice shown. A previous receipt may be referenced. These records contain no IP address, contact details or browser fingerprint, and only authorised site operators can access them.
We keep receipts for as long as necessary to demonstrate consent-based processing and to establish, exercise or defend legal claims. Deletion and backups are handled manually: receipts are reviewed when we handle a withdrawal or data request and when we make a backup, and removed once they are no longer needed for that purpose. The 180-day period in your browser is not the server retention period. The legal basis is compliance with our accountability obligations (Article 6(1)(c) with Articles 5(2) and 7(1) GDPR). Your last receipt reference is shown in Privacy settings and can be quoted in a data request.
Hosting logs
Separately from the consent records, our hosting provider, Netlify, keeps access and error logs with IP addresses, requested URLs, times, response codes, referrers and browser information. Authorised administrators use them to run the service, investigate faults and prevent abuse (Article 6(1)(f) GDPR). The logs are kept for a limited period set by Netlify and then deleted automatically.
Who receives your data?
We share personal data only where needed to run the business, and only with recipients who guarantee adequate protection and confidentiality:
- Netlify, which hosts the website and stores enquiries and consent receipts for us as a processor, and Zoho, which delivers and stores our email;
- Google, if you accept analytics;
- our authorised employees and associates who need the data for their work;
- competent public authorities, where the law requires it.
Do we transfer data outside the EEA?
Our hosting provider, Netlify, is based in the United States, so enquiries, consent receipts and hosting logs may be processed there. Google Analytics may also involve processing outside the European Economic Area, including in the United States. The safeguards are the EU–US Data Privacy Framework for certified recipients and standard contractual clauses in the providers’ data processing terms. Without your analytics consent, the website sends no data to Google.
Automated decisions
We do not make automated decisions, including profiling, that produce legal effects for you or affect you in a similarly significant way.
How do we protect your data?
We use TLS encryption, access-controlled private storage, backups, access only for authorised persons, regular software updates and strong, regularly changed passwords.
Your rights
You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability and to withdraw consent. These rights are not absolute, and in some cases the law allows us to refuse a request. We answer requests without undue delay and within one month; if a request is complex we may extend this by two further months and will tell you in advance.
If you believe we process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland.
Changes to this policy
We may update this policy as our services or the technology change. The current version is always on this page, with the date it was last updated.