1. Controller and contact
EXAMPLE DETAILS TO BE REPLACED: Robots2Work sp. z o.o., ul. Przykładowa 1, 00-000 Warsaw, Poland. This is not the confirmed identity or address of the controller. Example privacy address: privacy@example.com — it is not a contact address for Robots2Work.
Before publication, identify the actual website operator, its address and a working privacy contact. If a data protection officer has been appointed, include their contact details. This draft does not assume that an officer has been appointed.
2. Scope and categories of data
This policy covers the Robots2Work website and planned enquiries about our offering. Data protection principles are based on Regulation (EU) 2016/679 (GDPR). Cookies and similar technologies are also subject to Poland’s Electronic Communications Law of 12 July 2024, particularly Article 399.
The planned form collects a name, email address and message, with optional company name and phone number. Please do not include special-category data, such as health information, or unnecessary information about other people. Infrastructure logs, where enabled, may include IP addresses, request times, visited URLs and browser information.
The form currently does not deliver enquiries to the controller. Entering data and submitting the form displays a notice that the message has not been sent. The enquiry-handling provisions below describe a planned function, not an operational process.
3. Purposes and legal bases
Replying to enquiries, arranging consultations and managing correspondence: Article 6(1)(f) GDPR — the controller’s legitimate interest in business communication. Where the person contacting us is a prospective contracting party and requests pre-contractual steps, Article 6(1)(b) applies to those steps.
Website security, preventing misuse and establishing, exercising or defending legal claims: Article 6(1)(f), subject to necessity and the rights of individuals. Specific statutory obligations, such as retaining documentation for an actual contract, may require processing under Article 6(1)(c); this does not automatically apply to every enquiry.
An ordinary reply to an enquiry does not require marketing consent. A request for contact does not cover newsletters, direct advertising or optional analytics. If these are added, their actual scope must be disclosed and appropriate separate consent obtained where required by law.
4. Voluntary provision of information
You can browse the website without submitting a form. The planned form marks name, email and message as required. Without contact details and an enquiry, we cannot reply; additional fields remain optional.
A request for contact relates only to the stated enquiry and is not permission for unrestricted marketing. Before enabling submission, reassess the necessity of every mandatory field under the data minimisation principle.
5. Providers and recipients
The website is hosted on Railway. The infrastructure provider may process technical information as necessary to deliver and secure the service. Actual logging, processing regions, subprocessors and contractual terms must be verified for the configuration in use.
The planned contact process assumes a business email provider. Google Workspace is an example option to consider, not a confirmed Robots2Work service. Before launch, identify the actual provider and access scope and ensure an Article 28 processing agreement where the provider acts as a processor.
Authorised enquiry-handling personnel and, where necessary, IT providers or advisers may have access on an appropriate legal basis. Information may be disclosed to competent authorities where legally required. This draft does not assume data sales, forwarding enquiries to a robot manufacturer, or an implemented CRM, newsletter or recruitment process.
6. Transfers outside the EEA
Services provided by organisations outside the European Economic Area may involve transfers or access from third countries. Selecting a European hosting region does not by itself establish that no international transfers occur.
Before enabling the planned processing, determine whether transfers occur, identify their legal mechanism and provide required safeguards. Depending on the provider, these may include an applicable adequacy decision or standard contractual clauses with assessment and supplementary measures where needed. The EU–US Data Privacy Framework may only be cited after checking the recipient’s current certification and its scope. We do not assume every provider meets these conditions.
Once actual transfers are established, information about safeguards or copies must be available through the controller’s actual contact channel.
7. Proposed retention periods
Proposed retention for enquiries not resulting in a contract: up to 12 months after correspondence ends, with earlier deletion when no longer needed. The proposal for security logs is up to 30 days, with separate preservation of records necessary to investigate a specific incident. These are draft assumptions, not verified system settings.
Correspondence concerning an actual contract, statutory duties or legal claims may be retained for the applicable legal period or limitation period, only insofar as necessary for that purpose. Enquiries should not all be retained indefinitely as a precaution.
Before publication, agree retention with the controller and implement it across email, logs and backups. If consent-based processing is introduced, information for that purpose must be deleted or anonymised after withdrawal unless another legal basis justifies retention.
8. Your rights
Subject to GDPR conditions, you may request access and a copy, rectification, erasure and restriction of processing. Data portability applies to automated processing based on consent or a contract, within Article 20’s scope.
Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. You may object to direct marketing at any time. Consent must be as easy to withdraw as to give; withdrawal does not affect the lawfulness of earlier processing.
Requests should be sent to the actual controller contact that will replace this draft’s examples. A response is normally due within one month; extensions and limitations are governed by GDPR. Identity checks must be proportionate, without routinely requiring a copy of an identity document.
9. Complaints
If you believe processing infringes the law, you may complain to Poland’s President of the Personal Data Protection Office or another competent supervisory authority under Article 77 GDPR. Current contact and complaint information is available at uodo.gov.pl. Contacting the controller first is not a prerequisite for a complaint.
11. Security and automated decisions
The planned process should include encrypted transmission, access controls, authorised-user restrictions, updates and appropriate backup and deletion rules. Measures and risks must be assessed before enabling submission. No system can be guaranteed never to suffer a breach.
The contact scenario described here does not envisage decisions based solely on automated processing, including profiling, that have legal or similarly significant effects under Article 22 GDPR. Introducing such functions requires a new assessment and updated information.
12. Updates
Update the policy when the controller, tools, purposes or processing scope changes. A publication-ready version should state its effective date and contain no fictitious details or unverified claims. The separate GDPR notice summarises the planned contact process.