Privacy policy

1. Data controller

The controller of your personal data is Actum Krzysztof Ploch, registered at ul. Irzykowskiego 3/15, 01-317 Warsaw, Poland, VAT ID PL5222208821, REGON 015269213.

For any matter concerning personal data you can reach us at contact@ploch.ai or by telephone on +48 533 051 519.

2. What data we process

This site requires no account. We process the following data:

• Correspondence data — if you e-mail us, call us or send a message through the contact form: your e-mail address, telephone number (optional in the form), name, the content of your message and — if you fill them in — the optional answers about the process you want to improve. A message from the form goes only to our mailbox — we do not store it in any database on the site's server. To limit spam, the server records a hash of the IP address on every attempt to send, and — if you have JavaScript enabled — already from the moment you start filling it in; it keeps the hash for one hour after the last use; the hash does not reveal the address (the key needed to compute it never leaves the server), and once the hour has passed it is deleted at one of the next uses of the form by anyone.
• Analytics data — if you consent to statistics: the pages you visited, approximate location, device and browser type, how you arrived at the site, and interactions on the site such as clicking the telephone number, the e-mail address or a button leading to the contact section, or sending the contact form (only the fact that it was sent, not its content).
• Marketing data — if you consent to marketing: the fact that you reached the site from one of our Google ads (the click identifier: gclid, gbraid or wbraid), the pages you visited and the actions you took on the site (clicking the telephone number, the e-mail address or a button leading to the contact section, and sending the contact form — only the fact that it was sent, with a random identifier of that submission that stops it being counted twice), and Google Ads cookies that let our ads be shown to people who have visited the site. We do not pass your e-mail address, telephone number or the content of your form message to Google.
• Marketing data — Microsoft Advertising — under the same marketing consent: the fact that you reached the site from one of our ads on Bing or the Microsoft Advertising Network (the msclkid click identifier), the pages you visited and the actions you took on the site (clicking the telephone number, the e-mail address or a button leading to the contact section, and sending the contact form — only the fact that it was sent), and Microsoft Advertising cookies that let our ads be shown to people who have visited the site. We do not pass your e-mail address, telephone number or the content of your form message to Microsoft.
• Server technical data — IP address and basic request information, recorded automatically in server logs by the hosting provider.

3. Purposes and legal bases

• Replying to your message (e-mail, telephone or the contact form) and handling correspondence — Art. 6(1)(f) GDPR, our legitimate interest in communicating with people interested in our services. Where we take steps at your request prior to a contract (for example, prepare an offer) or the correspondence leads to a contract, the basis is Art. 6(1)(b) GDPR.
• Protecting the contact form from spam — Art. 6(1)(f) GDPR, our legitimate interest in limiting the number of uses of the form and of submissions from one IP address (a hash of the address kept for one hour after the last use of the form, see section 2).
• Visit statistics (Google Analytics 4) — Art. 6(1)(a) GDPR, your freely given consent expressed through the consent banner. You may withdraw it at any time.
• Ad measurement and remarketing (Google Ads) — Art. 6(1)(a) GDPR, your freely given consent expressed through the consent banner, separately from the statistics consent. You may withdraw it at any time.
• Ad measurement and remarketing (Microsoft Advertising) — Art. 6(1)(a) GDPR, the same freely given marketing consent expressed through the consent banner, separately from the statistics consent. You may withdraw it at any time.
• Keeping the site secure and working correctly — Art. 6(1)(f) GDPR (server logs).

4. Cookies, statistics and marketing

Until you give consent, the site writes no statistics or marketing cookie and sends no request to Google or Microsoft servers — we use Google Consent Mode v2 (the mechanism that passes on your choice) in basic mode, in which all consent signals default to denied. Consent is asked for separately in two categories: Statistics (Google Analytics 4) and Marketing (Google Ads and Microsoft Advertising). You can grant both, one or neither; the boxes are unchecked by default.

Regardless of consent the site may store the language version you choose (pl or en) in your browser's local storage (localStorage, key ploch-lang-choice) — only when you choose it yourself: via the language toggle, the ?lang= parameter in the address, or the suggestion that an English version exists (closing the suggestion records Polish). The entry holds no personal data, is not used for tracking and is not sent to our server or anyone else; it only stops the suggestion from reappearing. The site never switches language versions automatically. The former site_lang cookie is no longer set, and if it is still in your browser the site removes it.

Every asset needed to render the site — the typeface, the stylesheets and the interface scripts — is served from our own server, so no third-party provider (such as Google Fonts or a content delivery network) is contacted and your IP address is not disclosed to any of them. The only external connections the site can make are the Google script (gtag.js) and the Microsoft script (bat.js) described below. Each loads only where you have consented to its category — the Google script to at least one of the two, the Microsoft script to marketing only — including automatically on later visits, for as long as that consent remains stored in your browser.

Statistics. With this consent Google Analytics 4 runs and writes the _ga and _ga_<identifier> cookies (up to 2 years), which distinguish sessions and users.

Marketing. With this consent the Google Ads tag runs and writes, on the ploch.ai domain, cookies prefixed _gcl_ (including _gcl_au, _gcl_aw, _gcl_gb, _gcl_gs, _gcl_ag) and — if you have also consented to statistics — _gac_gb_<identifier> (all up to 90 days). They establish that a visit — and a later click on the telephone number, the e-mail address or a button leading to the contact section, or a later submission of the contact form — followed a click on one of our Google ads (conversion measurement), and allow our ads to be shown to people who have visited the site, on Google services (Search, YouTube, Gmail, Discover) and on Google ad-partner sites (remarketing).

The reference number in your message. We additionally keep the click identifier from the page address, together with the click date (the day the page you reached from the ad was loaded — normally the day of the click), in your browser's session storage (until the tab is closed, for at most 90 days from that date). When you start an e-mail by clicking the address or send the contact form, we append it, with that date, to the message we receive (from session storage or, once that is empty, from the _gcl_* cookie) as a reference line, so that we can match your enquiry to the ad it came from. In your mail application you can delete that line before sending; for the form, withdraw Marketing consent first using Privacy settings in the footer.

What we may report to Google after a conversation or an offer. If your enquiry leads to a conversation or an offer, we may report the click identifier alone, together with the fact that this happened, its date and a fixed nominal value we assign to that kind of event (not the amount of your offer) — never your name, e-mail address or telephone number — back to Google Ads to measure the ad, no later than 90 days after the click.

What happens when you withdraw consent. Withdrawing consent removes stored browser identifiers and the reference in the contact form before submission. It cannot remove the reference from an open e-mail draft, a separate confirmation page or a message already sent. If a confirmation page is open, close it and return to the contact form after withdrawing consent, before sending your enquiry. Delete the reference line from an open e-mail draft before sending. If you do not want an enquiry already sent to be matched to the ad, tell us.

Without marketing consent none of these cookies is written and the ad_storage, ad_user_data and ad_personalization signals remain denied. Once consent is given, Google may additionally set its own cookies on its own domains (google.com, googleadservices.com, doubleclick.net — e.g. Conversion up to 90 days, RUL up to 12 months), which ploch.ai does not control and cannot remove; Google publishes the full list at business.safety.google/adscookies and you can manage ad preferences at myadcenter.google.com.

Marketing — Microsoft Advertising. The same consent also runs the Microsoft Advertising tag (UET), which writes, on the ploch.ai domain, the _uetsid (1 day) and _uetvid (13 months) cookies, which distinguish sessions and users, and — if you reached the site from one of our ads on Bing or the Microsoft Advertising Network — _uetmsclkid (90 days), holding the identifier of that click (msclkid). They establish that a visit, and a later click on the telephone number, the e-mail address or a button leading to the contact section, or sending of the contact form (only the fact that it was sent, not its content), followed a click on one of our Microsoft ads (conversion measurement), and allow our ads to be shown to people who have visited the site, on Bing and the Microsoft Advertising Network (remarketing). Under this consent the page views and these actions are sent to Microsoft whether or not you came from one of our ads; Microsoft counts them as conversions of our ads only when they follow a click on one of our ads or, within one day, a display of one. The tag also keeps backup copies of these cookies in your browser's local storage (localStorage, under the same names); withdrawing consent removes both the cookies and those copies. Without marketing consent the Microsoft script is not loaded at all, none of these cookies is written and the ad_storage consent signal passed to Microsoft remains denied. Once consent is given, Microsoft may additionally set its own cookies on its own domains (bing.com — including MUID, up to 13 months), which ploch.ai does not control and cannot remove; the Microsoft Privacy Statement (privacy.microsoft.com) describes them, and you can manage Microsoft ad preferences at account.microsoft.com/privacy/ad-settings.

We also keep msclkid with the landing date in session storage (until the tab is closed, for at most 90 days) and attach it to an e-mail or form enquiry on the same terms as the Google reference. After a conversation or offer we may send Microsoft Advertising the identifier, event type and date, and nominal value, without contact details. The register deletion and consent withdrawal rules above apply to this identifier too.

Your choice is stored locally in your browser (localStorage, key ploch-consent-v3) together with the date, and the version and language of the text you saw — that record never leaves your device. The record is valid for 12 months; after that — and whenever the wording you were shown changes — we ask again. This applies to a refusal as much as to a grant. The consent state itself is, however, communicated to Google and Microsoft through Consent Mode once the relevant script has loaded.

You can change your choice at any time — per category — using the Privacy settings button in the site footer. Withdrawing a consent stops data being sent to that Google or Microsoft service immediately, without reloading the page, and removes that service's cookies set on the ploch.ai domain. Cookies Google or Microsoft set on their own domains are governed by those companies' privacy policies — we cannot remove them, but you can clear them in your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

5. Recipients of the data

Recipients of your data are the following categories of entities:

• Google Ireland Limited and Google LLC — Google Analytics 4 (after statistics consent) — as a processor to whom we entrust the data to produce visit statistics for us (Art. 28 GDPR).
• Google Ireland Limited and Google LLC — Google Ads (after marketing consent) — as an independent controller for ad measurement and remarketing, under the Google Ads Controller-Controller Data Protection Terms. Google also processes this data under its own rules, described in Google's privacy policy.
• Microsoft Ireland Operations Ltd — Microsoft Advertising (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; after marketing consent) — as an independent controller for ad measurement and remarketing, under the Microsoft Advertising Agreement and its data-protection terms. Microsoft also processes this data under its own rules, described in the Microsoft Privacy Statement.
• Hosting provider (GoDaddy) — as a processor: operation of the server hosting this site.
• Email and office-tools provider — as a processor: handling of email correspondence and our register of enquiries.

6. Transfers outside the EEA

Using Google Analytics 4 and Google Ads may involve transferring data to the United States. Google LLC participates in the EU-U.S. Data Privacy Framework, and Standard Contractual Clauses approved by the European Commission apply in addition. If you grant neither consent, no data is transferred to Google.

Microsoft Advertising is provided to us by Microsoft Ireland Operations Ltd, established in Ireland, but data may also be transferred to Microsoft Corporation in the United States. Microsoft Corporation participates in the EU-U.S. Data Privacy Framework, and Standard Contractual Clauses approved by the European Commission apply in addition. Without marketing consent no data is transferred to Microsoft.

7. Retention periods

• Correspondence — for as long as needed to reply and handle the matter, and thereafter until any related claims become time-barred.
• Analytics data — a maximum of 14 months in Google Analytics 4. Withdrawing consent stops further collection and removes the Google Analytics cookies set on our domain (ploch.ai), but it does not erase data already collected — that remains in Google Analytics until the retention period expires. If you want it deleted sooner, write to us at contact@ploch.ai.
• Marketing data — Google Ads cookies set on the ploch.ai domain for up to 90 days (for Google's own cookies on its domains, see section 4), membership of Google Ads remarketing lists for at most 90 days from your last visit to the site that meets that list's criteria, and the click identifier (with the click date) in session storage until the browser tab is closed, for at most 90 days from the recorded click date. Google keeps conversion data as an independent controller, under its own privacy policy. The reference line attached to your e-mail or form enquiry (the click identifier together with the click date) is kept with the correspondence; we delete the click identifier from our register of enquiries 90 days after the click date recorded in that reference line.
• Marketing data — Microsoft Advertising — Microsoft Advertising cookies set on the ploch.ai domain for up to 13 months (_uetvid; _uetsid 1 day, _uetmsclkid 90 days; for Microsoft's own cookies on its domains, see section 4), membership of Microsoft Advertising remarketing lists for at most 90 days from your last visit to the site that meets that list's criteria. Microsoft keeps conversion data as an independent controller, under its own privacy statement.
• Server logs — in line with the hosting provider's policy.

8. Your rights

In connection with the processing of your data you have the right to:

• access your data and obtain a copy of it,
• rectify (correct) your data,
• erase your data,
• restrict processing,
• data portability,
• object to processing based on legitimate interest,
• withdraw consent at any time — for statistics and marketing, use the Privacy settings button in the footer.

To exercise these rights, write to us at contact@ploch.ai. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland) if you believe we process your data unlawfully.

9. Provision of data and automated decisions

Providing data is voluntary. Not providing contact details only means we cannot reply to your message. We do not take decisions about you based solely on automated processing, including profiling. If you consent to marketing, Google and Microsoft may choose the ads they show you based on your visits to this site (ad personalisation); this involves no decision producing legal effects concerning you or similarly significantly affecting you.

10. Changes to this policy

If the scope of processing changes, we will update this policy and change the date shown at the top of the page. We encourage you to review it periodically.

This English text is a translation provided for convenience. The Polish version at ploch.ai/polityka-prywatnosci/ is authoritative and governs in the event of any discrepancy.

Home