Privacy policy

1. Controller

The controller responsible for data processing on this website is:

Jakub Gojło, WebNest Ideas Jakub Gojło
Sole proprietorship under Polish law, trading as Web Nest Ideas
ul. Kościuszki 16E lok. 14
47-330 Zdzieszowice, Poland
NIP: 1990132177 · REGON: 528780762
Email: team@webnest-ideas.pl
Phone: +48 696 244 878

We have not appointed a data protection officer because we are not required to under Art. 37 GDPR. You can contact us directly with any data protection question.

2. Overview

We process personal data only to the extent necessary to operate this website, answer your enquiries and conduct our business relationship. Without your consent, this website sets only one technically necessary cookie for the language choice, and its fonts are served from our own server. It loads Google Tag Manager; analytics and marketing services, including Google Ads, become active only when you agree in the consent banner (section 7). Your form entries are delivered to our mailbox by email by our own server; no external form service is involved.

The legal bases are in particular Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract and pre-contractual measures), Art. 6(1)(c) GDPR (legal obligations) and Art. 6(1)(f) GDPR (legitimate interests).

3. Hosting and server log files

The website is hosted by OVHcloud on servers in the European Union. We have a data processing agreement with the provider under Art. 28 GDPR.

When you visit the website, the servers process technically necessary data: IP address, date and time, the address requested, the amount of data transferred, the referrer and the browser identifier. We use this data to provide the website securely and without errors (Art. 6(1)(f) GDPR). The hosting provider keeps the log files only as long as this requires and as the legal obligations that apply to it demand, and deletes them afterwards.

4. Contact form, email and phone

When you write to us via the contact form, we process your details (name, email address, message and, optionally, company, phone number and topic) in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR.

The form is sent to our web server at OVHcloud, which delivers your details by email to our mailbox, also hosted by OVHcloud. No external form service is involved, and your details are not stored on the web server. We have a data processing agreement with OVHcloud under Art. 28 GDPR; the data stays in the EU. To keep the form from being misused on a large scale, the server keeps, for at most one hour per enquiry, a hash of your IP address formed with a secret key, from which the address cannot be recovered without that key (Art. 6(1)(f) GDPR).

To protect against spam, the form contains a field that is invisible to people. We do not use external captcha services. If you email us directly, we process your message in our mailbox at our email provider, with whom we also have a data processing agreement.

When you call us, we process your phone number, where it is transmitted, and the details from the conversation in order to deal with your request; the legal bases are the same as for the contact form. Our telephone provider also processes the connection data as telecommunications law requires.

We delete enquiries after 180 days unless they lead to a contractual relationship or statutory retention obligations apply.

5. Storage in your browser

So that the intro animation does not play again on every page change, the website stores a note in your browser’s session storage (sessionStorage) that the intro has already been shown. The entry contains no personal data and is deleted when you close the browser window.

When you choose a language in the language switcher or close the language notice on the home page, the website stores a cookie named “lang” with the language code (de, en or pl). This way you are not sent to another language automatically when you return to the home page. The cookie contains no personal data, is read only by this website and expires after one year.

When you switch between the light and the dark design, the website stores your choice (“light” or “dark”) in your browser’s local storage (localStorage) under the name “theme”. The entry contains no personal data, is read only by this website and stays until you delete it in your browser.

Your choice in the consent banner is stored in your browser’s local storage (localStorage) under the name “consent”: which categories you allowed and when. The entry is read only by this website and stays until you delete it in your browser or change your choice.

These entries are strictly necessary to show the website the way you have chosen and to respect your consent choices, and therefore do not require consent (§ 25(2) No. 2 TDDDG, Art. 5(3) of the ePrivacy Directive 2002/58/EC).

6. Fonts

All fonts are hosted on our own server. No connection to Google Fonts or any other font provider is made when you visit the website.

7. Google Tag Manager, Google Ads and consent

This website uses Google Tag Manager by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. With Tag Manager we embed and control further services on the website, such as audience measurement. It sets no cookies itself and does not analyse usage data. When it loads, however, your IP address is transmitted to Google, which may involve a transfer to the USA.

On your first visit a banner asks whether you agree to statistics and marketing services. Until then, and if you refuse, the analytics and advertising categories in Google Consent Mode are set to “denied”: services embedded through Tag Manager then set and read no cookies for these purposes. They become active only with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can change your choice at any time under “Cookie settings” at the bottom of every page, and so withdraw your consent with effect for the future.

If you agree to “Marketing”, we load the Google tag (gtag.js) for Google Ads, likewise a service of Google Ireland Limited; it is not loaded before. It lets us measure whether visitors who reach the website through one of our ads on Google then contact us, for example through the form or by phone (conversion tracking). Google sets cookies for this (such as “_gcl_au”, kept for up to 90 days), receives your IP address and details about your browser, and may use the data for interest-based ads. If you withdraw your consent, we delete these cookies as far as the website can access them. Google is certified under the EU-U.S. Data Privacy Framework; transfers to the USA are based on the European Commission’s adequacy decision (Art. 45 GDPR). More information in Google’s privacy policy and in how Google uses information from sites that use its services.

8. Applications

If you apply to us, we process the documents and information you send us in order to carry out the application process (Art. 6(1)(b) GDPR in conjunction with the applicable employment law). If no employment or collaboration follows, we delete your data six months after the process ends, so that we can defend ourselves against possible claims until then (Art. 6(1)(f) GDPR), unless you have consented to longer storage.

9. Recipients and third countries

Your data is received only by the people and service providers who need it for the purposes stated, in particular our hosting and email provider OVHcloud as a processor. For Google and a possible transfer to the USA, see section 7. Beyond that, we do not transfer data to countries outside the EU and the EEA.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3)). We make no decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). If you have agreed to ad personalisation, Google may analyse your use for interest-based ads (section 7).

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority where you live or the Polish authority responsible for us, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw).

For any data protection matter, you can reach us at team@webnest-ideas.pl.

11. Version and changes

Last updated: October 2026. We update this privacy policy when the website, our service providers or the legal situation change.