Note on language. This is an English translation provided for convenience. The legally binding version of this policy is the Polish one, available at prosm.pl/polityka-prywatnosci.html. In the event of any discrepancy between the two versions, the Polish text prevails.
1. General information
This Privacy Policy sets out the rules for processing personal data by Prosm – Agencja Interaktywna Wrocław, operating as part of the business Wojciech Oleszko Creative Team, registered at ul. Kminkowa 43/18, 51-180 Wrocław, Poland, VAT ID (NIP): 8951808958, REGON: 021403397 (hereinafter: the "Controller").
This Policy applies to the website prosm.pl, including its English-language section at prosm.pl/en/.
2. Data controller
The controller of your personal data is Wojciech Oleszko Creative Team, ul. Kminkowa 43/18, 51-180 Wrocław, Poland.
For matters relating to the protection of personal data you can contact us by email at kontakt@prosm.pl or by phone at +48 509 052 773.
3. Scope of personal data collected
The Controller may collect the following personal data:
- First name and surname
- Email address
- Phone number
- Company name (optional)
- Device IP address
- Data relating to user activity on the website
- Information contained in cookies
4. Purposes of processing
Your personal data is processed for the following purposes:
- Delivery of the services ordered: web design, SEO services, online marketing, Google Business Profile optimisation
- Handling enquiries, client communication and settlement of accounts
- Direct marketing of the Controller's own products and services
- Analysis of website traffic and improvement of the site's functionality
5. Legal basis for processing
Personal data is processed on the basis of:
- Article 6(1)(b) GDPR – performance of a contract or steps taken prior to entering into a contract
- Article 6(1)(f) GDPR – the legitimate interest of the Controller, namely marketing its own products and services and analysing and optimising the website
6. Sharing data with other entities
Personal data may be shared with:
- Providers of IT, hosting and analytics services (e.g. Google Analytics)
- Providers of marketing services (e.g. Google Ads, Facebook Ads)
- Public authorities, where such an obligation arises from the law
7. Cookies
The Controller uses cookies — small text files stored on the user's device — for the following purposes:
- ensuring the correct operation of the website
- adapting the content of the website to user preferences
- traffic analysis and statistics
On your first visit a consent banner is displayed, where you can choose the scope: strictly necessary cookies only, necessary together with analytics, or all cookies (including marketing). Until consent is given, no cookies other than strictly necessary ones are stored. You can change your choice at any time by clicking the "Cookie settings" icon in the bottom-left corner of the page. Cookies can also be managed in your browser settings.
Tools loaded after consent is given
- Google Analytics 4 (Google Ireland Limited) — visit statistics: which pages are viewed, where visitors come from, how many people submit the form or tap the phone number. Loaded with the "Necessary + analytics" and "Allow all" choices. Before consent the tool runs without cookies and without a user identifier (Consent Mode v2), collecting only anonymous, aggregated traffic signals.
- Meta Pixel (Meta Platforms Ireland Limited) — measuring the performance of Facebook and Instagram ads and showing ads to people who have visited the site. Loaded only with the "Allow all" choice. With any other choice the Meta script is not loaded at all, so no connection to Meta servers takes place. The pixel records a page view and two events: submitting the contact form and tapping the phone number. Form contents are not passed to Meta — automatic advanced matching (name, email, phone) is switched off.
Withdrawing consent stops any further events from being sent, and on your next visit the tools are not loaded at all. We keep a record of your choice (the consent level, the date and a random identifier — without your IP address) in order to demonstrate consent in accordance with Article 7(1) GDPR.
8. Chat on the website (AI assistant)
The website features an assistant that answers questions about our services automatically. The conversation is handled by a language model provided by Google. The assistant is not a human, does not conclude contracts and does not make decisions concerning the user — its role is to provide information and, where needed, direct the user to contact the Controller.
- Data: the content of messages entered by the user and the assistant's replies, the address of the page where the conversation started, the advertising campaign identifier (if the user arrived from an ad) and a random conversation identifier assigned for the duration of a single visit.
- What we do not collect: the assistant does not ask for a name, phone number or e-mail address — the contact form serves that purpose. It does not ask for passwords or access credentials and is instructed not to accept them. If a user provides such data on their own initiative, it will be stored together with the conversation — please do not enter it in the chat.
- Purpose: answering the question asked and improving the quality of answers based on what users actually ask about.
- Legal basis: Article 6(1)(f) GDPR — the legitimate interest of the Controller in handling enquiries from people interested in the offer and in improving the service provided.
- Recipients: Google (processing of conversation content by the language model and storage of conversation records in Google Sheets) and the website hosting provider (a copy of the record on the server).
- Abuse protection: to limit the number of requests from a single device, a cryptographic hash of the IP address is stored. The IP address itself is not stored.
- Retention period: conversation records are kept for 12 months from the date of the conversation and then deleted.
- Objection: you have the right to object to processing based on legitimate interest — a message to the address given in section 2 is sufficient.
9. Your rights
You have the right to:
- access your personal data
- request rectification or completion of your data
- request erasure of your personal data
- request restriction of processing
- data portability to another controller
- object to the processing of your personal data
- lodge a complaint with the President of the Personal Data Protection Office (UODO), the Polish supervisory authority
You can exercise these rights by contacting us by email at kontakt@prosm.pl.
10. Data retention period
Personal data is stored for the period necessary to fulfil the purposes set out above, and subsequently for the period required by applicable law or until claims become time-barred.
11. Data protection measures
The Controller applies appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or disclosure.
12. Transfers outside the EEA
As a rule, personal data is processed within the European Economic Area. In connection with the use — solely after consent has been given in the cookie banner — of analytics and marketing tools provided by Google and Meta, some data (e.g. cookie identifiers, IP address) may be transferred to the United States. These providers participate in the EU-U.S. Data Privacy Framework, which ensures an adequate level of data protection in accordance with the European Commission's adequacy decision.
13. Profiling and automated decision-making
The Controller does not apply profiling or automated decision-making in relation to users.
14. Changes to this Privacy Policy
The Controller reserves the right to update this Privacy Policy. The current version of the document will be published on the Controller's website.
