Privacy Policy

1. Personal data controller

The controller of your personal data is:

2. Scope of personal data collected

We collect personal data in the following cases:

2.1 Contact form

When you send us a message through the contact form, we collect:

• first and last name (if provided),
• e-mail address,
• phone number (if provided),
• the content of the message,
• company name (if provided).

2.2 Data collected automatically

While you browse the site, the following are collected automatically:

• IP address (anonymised),
• browser type and operating system,
• time and date of the visit,
• pages viewed on the site,
• country and city the request originates from.

2.3 Data provided voluntarily

If you contact us by phone or e-mail, we process the data provided during that communication to the extent necessary to respond and deliver the service.

3. Legal bases for processing

We process your personal data on the following legal bases (Article 6 GDPR):

4. Cookies

Cookies are small text files stored on your device by your browser. We use them in three categories:

4.1 Managing cookies

At any time you can:

• change your cookie settings by clicking “Cookie settings” in the site footer,
• clear existing cookies in your browser settings,
• block cookies from being saved in your browser settings (this may affect how the site works).

5. Data recipients

Your data may be shared with the following entities:

• Google LLC — Google Analytics, Google Tag Manager, Google Ads (if you have consented to analytics/marketing cookies). Google LLC processes data on servers located, among others, in the USA. The transfer takes place on the basis of Standard Contractual Clauses (SCC). Google Privacy Policy.
• Cloudflare, Inc. — the Turnstile service protecting our forms from spam (it processes, among others, your IP address and browser signals to tell humans from bots). Transfers outside the EEA rely on Standard Contractual Clauses (SCC). Cloudflare privacy policy.
• Hosting provider — the company providing hosting for the site, located within the EEA and bound by a data processing agreement.
• Accounting office — to the extent of the data necessary to fulfil tax and accounting obligations.
• Law firm — solely where it is necessary to pursue or defend against claims.

We do not sell your personal data to any third parties.

6. Your rights

Under the GDPR, you are entitled to the following rights:

To exercise your rights, contact us at: biuro@nomatec.pl. We will respond without undue delay, no later than within 30 days.

7. Data retention period

• Contact form data — for the time necessary to handle the contact, and thereafter for the limitation period of any potential claims (up to 6 years).
• Data for invoices and accounting documents — 5 years from the end of the tax year in accordance with tax law.
• Analytics data (Google Analytics) — in line with your consent, by default 26 months (GA4 configuration).
• Marketing data — for the duration of the campaign or until consent is withdrawn.

8. Data security

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or destruction:

• encryption of the connection (HTTPS/TLS protocol),
• access to data restricted to authorised employees only,
• regular backups,
• data anonymisation in Google Analytics (IP masking).

9. Changes to the privacy policy

We reserve the right to make changes to this privacy policy. Changes will be published on this page together with the update date. In the event of significant changes, we may notify you via a prominent notice on the home page.

We recommend reviewing the policy regularly.

10. Contact regarding personal data

If you have questions about the processing of personal data or wish to exercise your rights, contact us: