DRAFT · TO BE REVIEWED BEFORE PUBLICATION
Information about data processing
This document still requires approval. Saving projects and forwarding studio enquiries to the CRM are available. The earlier order form remains disabled. Retention periods and information on infrastructure providers’ agreements and processing regions still need to be completed.
1. Data controller and contact
The data controller is JKLM Firma Usługowa Łukasz Kaczmarek, Polish tax ID 7532159822, ul. Brzozowa 6A, 48-385 Otmuchów, Poland. For privacy enquiries, please write to biuro@jklm.eu.
2. What data we process
Contact and company details, delivery address, configuration parameters, notes, project files, estimate and order identifiers, and limited technical data needed to protect the form against misuse. The shop does not collect payment card details or take online payments at this stage.
3. Purposes and legal bases
- preparing a quotation and taking steps before entering into a contract — Article 6(1)(b) GDPR;
- fulfilment, billing and legal obligations after entering into a contract — Article 6(1)(b) and (c) GDPR;
- protecting the form, establishing or defending claims and maintaining integration continuity — legitimate interests under Article 6(1)(f) GDPR;
- marketing is not part of the current form, and marketing consent is not collected.
4. Data recipients
Data may be entrusted to providers of application hosting, databases and private file storage (Vercel and Supabase), and forwarded to JKLM’s internal CRM. Files are checked by a scanner on JKLM’s server at Hetzner. After the work is confirmed, accounting and transport providers may receive data necessary for billing and delivery. The final document will identify the selected providers, data regions and mechanisms for any transfers outside the EEA.
5. Retention plan requiring approval
- enquiries that do not become orders and related files — a proposed maximum of 12 months after the last contact;
- abandoned or rejected uploads — automatic deletion when the technical session expires;
- limited anti-abuse identifiers — from 2 hours to 2 days, depending on the rate-limited action;
- order, billing and claims data — for the periods required by applicable regulations and limitation periods;
- CRM integration events — until delivery is confirmed and errors resolved, and for the approved audit retention period.
6. Your rights
Within the limits of the GDPR, you have rights of access, rectification, erasure, restriction, data portability and objection to processing based on legitimate interests. You may also lodge a complaint with the President of the Polish Personal Data Protection Office.
7. Voluntary provision and automation
Providing data is voluntary, but an enquiry cannot be prepared and processed without the details marked as required. The indicative price is calculated automatically from the selected parameters, but does not create a contract or a decision producing legal effects.
8. Security and files
Files are stored privately, and public file addresses are not included in the order. Access to studio files is controlled, and sending a file to the CRM requires a scanner check. Please do not include personal data that is unnecessary for the quotation.