1. Data controller
EXAMPLE DETAILS TO BE REPLACED: Robots2Work sp. z o.o., ul. Przykładowa 1, 00-000 Warsaw, Poland. This is not the confirmed identity or address of the controller. Example privacy address: privacy@example.com — it is not a contact address for Robots2Work.
Before publication, identify the actual website operator, its address and a working privacy contact. If a data protection officer has been appointed, include their contact details. This draft does not assume that an officer has been appointed.
2. Current state versus planned processing
VERIFIED IN THE PROJECT: the public site and robot catalogue are hosted on Railway. The application has no user accounts, shopping cart, payments or operational enquiry delivery. Contact and product forms show a non-delivery notice; their code does not send names, email addresses or messages to an inbox or CRM. Browsers may independently apply their own autofill settings.
Visiting the site generates infrastructure requests that may involve technical information such as IP addresses, URLs and request times. Non-sending forms do not mean that visiting the website entails no data processing. Full Railway logging scope and retention, processing regions and subprocessor access have not been verified.
No implemented GA4, advertising tracking, CRM, newsletter or recruitment process was identified in application code. This does not replace checking actual responses or services added outside the application. Business email, enquiry responses and optional analytics described below are plans requiring separate implementation, not current operational claims.
3. Source and categories of data
The planned process will collect information directly from the person making an enquiry: name, email and message, and optionally company and phone number. Do not provide sensitive or unnecessary third-party information. The current form does not send enquiries; this notice does not confirm that delivery has been implemented.
4. Purposes, legal bases and legitimate interests
For technical delivery and security, this draft envisages Article 6(1)(f) GDPR — the controller’s legitimate interest in operating and protecting the site. Data must be necessary and proportionate, and the actual configuration must be verified. The enquiry-response provisions below concern future form activation or an actual, confirmed correspondence channel.
Replying to enquiries, arranging consultations and managing correspondence: Article 6(1)(f) GDPR — the controller’s legitimate interest in business communication. Where the person contacting us is a prospective contracting party and requests pre-contractual steps, Article 6(1)(b) applies to those steps.
Website security, preventing misuse and establishing, exercising or defending legal claims: Article 6(1)(f), subject to necessity and the rights of individuals. Specific statutory obligations, such as retaining documentation for an actual contract, may require processing under Article 6(1)(c); this does not automatically apply to every enquiry.
An ordinary reply to an enquiry does not require marketing consent. A request for contact does not cover newsletters, direct advertising or optional analytics. If these are added, their actual scope must be disclosed and appropriate separate consent obtained where required by law.
5. Recipients
The website is hosted on Railway. The infrastructure provider may process technical information as necessary to deliver and secure the service. Actual logging, processing regions, subprocessors and contractual terms must be verified for the configuration in use.
The planned contact process assumes a business email provider. Google Workspace is an example option to consider, not a confirmed Robots2Work service. Before launch, identify the actual provider and access scope and ensure an Article 28 processing agreement where the provider acts as a processor.
Authorised enquiry-handling personnel and, where necessary, IT providers or advisers may have access on an appropriate legal basis. Information may be disclosed to competent authorities where legally required. This draft does not assume data sales, forwarding enquiries to a robot manufacturer, or an implemented CRM, newsletter or recruitment process.
6. International transfers and safeguards
Services provided by organisations outside the European Economic Area may involve transfers or access from third countries. Selecting a European hosting region does not by itself establish that no international transfers occur.
Before enabling the planned processing, determine whether transfers occur, identify their legal mechanism and provide required safeguards. Depending on the provider, these may include an applicable adequacy decision or standard contractual clauses with assessment and supplementary measures where needed. The EU–US Data Privacy Framework may only be cited after checking the recipient’s current certification and its scope. We do not assume every provider meets these conditions.
Once actual transfers are established, information about safeguards or copies must be available through the controller’s actual contact channel.
7. Retention
Actual retention settings for hosting or future email have not been confirmed. Do not describe 30-day logs or 12-month correspondence as implemented periods. Until configuration is verified, the following are proposals to agree and implement technically.
Proposed retention for enquiries not resulting in a contract: up to 12 months after correspondence ends, with earlier deletion when no longer needed. The proposal for security logs is up to 30 days, with separate preservation of records necessary to investigate a specific incident. These are draft assumptions, not verified system settings.
Correspondence concerning an actual contract, statutory duties or legal claims may be retained for the applicable legal period or limitation period, only insofar as necessary for that purpose. Enquiries should not all be retained indefinitely as a precaution.
Before publication, agree retention with the controller and implement it across email, logs and backups. If consent-based processing is introduced, information for that purpose must be deleted or anonymised after withdrawal unless another legal basis justifies retention.
8. Rights and withdrawal of consent
Subject to GDPR conditions, you may request access and a copy, rectification, erasure and restriction of processing. Data portability applies to automated processing based on consent or a contract, within Article 20’s scope.
Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. You may object to direct marketing at any time. Consent must be as easy to withdraw as to give; withdrawal does not affect the lawfulness of earlier processing.
Requests should be sent to the actual controller contact that will replace this draft’s examples. A response is normally due within one month; extensions and limitations are governed by GDPR. Identity checks must be proportionate, without routinely requiring a copy of an identity document.
9. Complaints to a supervisory authority
If you believe processing infringes the law, you may complain to Poland’s President of the Personal Data Protection Office or another competent supervisory authority under Article 77 GDPR. Current contact and complaint information is available at uodo.gov.pl. Contacting the controller first is not a prerequisite for a complaint.
10. Voluntary provision and consequences
You can browse the website without submitting a form. The planned form marks name, email and message as required. Without contact details and an enquiry, we cannot reply; additional fields remain optional.
A request for contact relates only to the stated enquiry and is not permission for unrestricted marketing. Before enabling submission, reassess the necessity of every mandatory field under the data minimisation principle.
11. Automated decisions and profiling
The contact scenario described here does not envisage decisions based solely on automated processing, including profiling, that have legal or similarly significant effects under Article 22 GDPR. Introducing such functions requires a new assessment and updated information.
12. New purposes and publication readiness
Before using information for another purpose, the controller must provide the information required by Article 13(3) and establish an appropriate legal basis. An enquiry must not automatically feed newsletters or advertising campaigns.
Publication requires the actual controller’s details, a working contact, verified providers and transfers, implemented retention and a verified form process. This example-based draft does not replace those steps or legal assessment of actual processing.