Your information.
Handled with care.

1. Who is responsible?

The controller is “MIKRA” Zdybicki Mikołaj, trading as ProtoGlass, NIP 9482620561. Studio address: ul. Małęczyńska 31, 26-603 Radom, Poland. Contact us about personal information at studio@protoglass.eu.

2. What information do we use?

When you contact us, we receive your email address, project description and any optional name or company information you provide. Subsequent correspondence may include information needed to discuss a quotation or project. Please avoid sending sensitive personal information or information about other people unless it is needed for your enquiry.

The website and email infrastructure also process technical information needed to handle requests and protect the service, such as IP addresses, request times and diagnostic records. The form stores keyed, pseudonymous identifiers, request times and delivery-attempt states for abuse prevention. Those records do not contain the enquiry text or email address.

3. Why do we use it?

We use enquiries to understand the proposed project and respond. When you personally request steps towards a contract with us, the basis is Article 6(1)(b) GDPR. When you contact us for a company or about another business matter, the basis is our legitimate interest in handling correspondence under Article 6(1)(f).

We also rely on legitimate interests to protect website availability, prevent spam and misuse, and establish, exercise or defend relevant legal claims. If an enquiry becomes an order, further processing may be necessary to perform the contract and meet applicable accounting or other legal obligations.

An enquiry does not subscribe you to marketing. We do not use this form for automated decisions that produce legal or similarly significant effects.

4. Is providing information required?

Providing information is voluntary. We need an email address and a description of your project to process an online enquiry and reply. Name and company are optional. You can contact the studio by email instead of using the form.

5. Who receives information?

We use SEOHOST Sp. z o.o. for website hosting and the studio mailbox under a data-processing agreement. The form forwards your enquiry to studio@protoglass.eu through the hosting provider’s mail service. We use Microsoft Outlook on desktop and mobile devices alongside a Microsoft 365 Business subscription. The studio mailbox remains hosted by SEOhost; Outlook synchronises copies of its email with Microsoft’s cloud. Email content, attachments received in correspondence and associated addressing information may therefore also be processed by Microsoft. Authorised persons handling enquiries can access correspondence as needed for their work. Information may also be disclosed to public authorities when legally required.

SEOhost’s listed subprocessors provide infrastructure and support services: DATASPACE P.S.A., EXEA S.A., OVH Sp. z o.o. and Quality Unit, s. r. o. Their involvement depends on the service provided; this does not mean that every enquiry is sent to every listed company. Microsoft cloud synchronisation is a separate service we use, rather than a service covered by our agreement with SEOhost.

Microsoft states that personal data may be processed outside the European Economic Area, including in the United States, and describes transfer safeguards such as standard contractual clauses in its Privacy Statement. We do not represent this mailbox as being processed exclusively in Poland or the EEA.

6. How long is information kept?

Enquiries that do not result in an order are kept for up to six months after the last substantive contact, unless a documented need to retain relevant evidence requires longer storage. This rule applies to correspondence under our control in the studio mailbox and synchronised Outlook copies, as well as any separately saved copies. We take deletion steps across those locations; provider backup and technical retention are addressed separately below.

For enquiries that become projects, retention depends on the duration of the relationship, applicable record-keeping duties and the need to retain relevant evidence for legal claims. These purposes do not justify keeping every enquiry indefinitely.

Form security tokens are valid for one hour. The active rate-limit history covers approximately one hour; files older than 24 hours since their last update are eligible for removal during subsequent valid form processing. A daily cleanup task is also scheduled. Expiration of a token is not the same as deletion of a file, and scheduled cleanup does not mean that a record is removed exactly 24 hours after creation.

Under the SEOhost agreement, entrusted data are to be removed without undue delay after the service ends, unless retention is required by law. Backup copies are to be removed no later than six months after the data-processing agreement ends. This termination rule is separate from our six-month enquiry retention rule and does not establish a six-month period after each mailbox deletion during the ongoing service.

7. Your rights

Depending on the circumstances, you may request access, correction, erasure or restriction of processing. Data portability applies when its legal conditions are met. You may object, on grounds relating to your particular situation, to processing based on legitimate interests.

Write to studio@protoglass.eu to make a request. We may need proportionate information to confirm identity before disclosing personal data. We normally respond within one month; if a lawful extension is necessary, we will explain it within that initial period.

You may complain to the President of Poland’s Personal Data Protection Office (UODO) or another competent supervisory authority.

8. Analytics and privacy choices

With your consent, we use Google Analytics 4, provided by Google Ireland Limited, to understand visits, traffic sources and use of the website. Analytics remains off until you choose “Accept analytics”. You can reject it without affecting the website or enquiry form. Use “Cookie settings” in the footer to change your choice or withdraw consent at any time. Withdrawal does not affect the lawfulness of earlier processing.

Analytics processes technical information, cookie identifiers, page visits and selected interactions: opening the contact page, starting a form, clicking an email link and a successfully submitted enquiry. We do not send form contents, names, company names or email addresses to Analytics. We remove arbitrary URL parameters and fragments from the page addresses sent by our code. We do not enable advertising personalisation or advertising pixels.

The basis for optional analytics processing is consent under Article 6(1)(a) GDPR. When allowed, Google may set _ga and _ga_* cookies, configured here for up to 180 days without renewal on every visit. We store your analytics preference in your browser under pg-consent-v1 for up to 180 days; this preference is needed to remember your choice and is not an analytics identifier. Rejecting analytics stops our measurement and removes accessible Google Analytics cookies for this site.

Google may process information outside the EEA. See Google's Privacy Policy and data-processing terms for processing and transfer safeguards. Our GA4 property is configured to retain user-level and event-level data for two months, with retention not reset by new activity. This setting does not apply to most aggregated standard reports. Consent-based reports are incomplete: visitors who reject analytics or block it are not measured by our implementation.

Fonts and images are hosted with the website. The enquiry form uses a security token without a tracking cookie. No social-media embeds or advertising pixels are included.