This English version is provided for convenience; the Polish version is legally binding.
1. Data controller
The controller of personal data is a natural person conducting unregistered business activity (Article 5(1) of the Polish Act on Entrepreneurs (Prawo przedsiębiorców) of 6 March 2018) who uses the TwojeSystemy brand (the name Nortia also appears in organisational materials) - Damian Nowiński, correspondence address: Poleska 76C, 42-218 Częstochowa (the “Controller”). The Controller is not entered in CEIDG (the Central Register and Information on Economic Activity) or KRS (the National Court Register) and holds no NIP (tax identification) or REGON (statistical identification) number assigned in connection with business activity.
The Controller can be contacted at the e-mail address: kontakt@twojesystemy.com.
2. What this policy covers
This policy describes the rules for processing the personal data of people who visit the TwojeSystemy website and of people who contact the Controller about services such as modernisation of websites and systems, e-commerce automation, internal tools and technology consulting.
The website is informational and promotional in nature and is used to present the offer and to start contact. Services are discussed individually, in particular through the contact form or by e-mail. The website does not provide user accounts, online payments, a client panel or self-service ordering.
3. What data we may process
Depending on how contact is made, the Controller may process the following categories of data:
- Data provided in the contact form: the first name or name of the person making contact, e-mail address, optionally a company name, and the content of the message.
- Data provided in e-mail correspondence: e-mail address, first and last name, name of the company or organisation, job title, telephone number, content of the message, attachments and other data voluntarily provided in the course of the correspondence.
- Data related to potential or ongoing collaboration: details of contact persons on the side of the client or organisation, information needed to prepare a reply or quotation, to determine the scope of work, to conclude or perform a contract and to maintain day-to-day communication.
- Technical data related to use of the website: basic technical information that may be recorded in server logs by the hosting provider or the website’s infrastructure, such as the IP address, date and time of the request, address of the page visited, information about the browser, device and operating system, the server response code and the address of the referring page, if passed on by the browser.
The Controller does not ask for special categories of data to be provided through the contact form, such as data concerning health, political opinions, religious beliefs, biometric data or other sensitive information. If it is not necessary to handle the enquiry, it should not be provided.
4. Purposes and legal bases for processing
The Controller processes personal data for the following purposes:
| Purpose of processing | Scope of data | Legal basis |
|---|---|---|
| Handling an enquiry sent through the contact form or by e-mail, including replying and continuing the correspondence | Contact details, content of the message, company or organisation details, other information provided by the person making contact | Art. 6(1)(f) of the General Data Protection Regulation (GDPR; in Polish: RODO) - the Controller’s legitimate interest in conducting communication and handling enquiries; where the contact is aimed directly at concluding a contract - Art. 6(1)(b) GDPR |
| Preparing a collaboration proposal, a quotation, a scope of work or a technology consultation | Contact details, organisation details, information about business or technical needs provided by the person making contact | Art. 6(1)(b) GDPR - taking steps prior to entering into a contract, or Art. 6(1)(f) GDPR - the Controller’s legitimate interest in preparing a business response |
| Concluding and performing a contract for bespoke services, if collaboration goes ahead | Contact details of persons representing the client or designated as contact persons, data necessary to carry out the collaboration | Art. 6(1)(b) GDPR - performance of a contract, or Art. 6(1)(f) GDPR - the legitimate interest of the Controller and the client in maintaining working contact with persons acting on behalf of the organisation |
| Establishing, pursuing or defending against claims | Correspondence data, data relating to the collaboration, information necessary to demonstrate the course of contact or of service delivery | Art. 6(1)(f) GDPR - the Controller’s legitimate interest in protecting rights and pursuing claims |
| Ensuring the security and correct operation of the website, diagnosing errors and preventing abuse | Technical server data, in particular data from server logs | Art. 6(1)(f) GDPR - the Controller’s legitimate interest in maintaining a secure and stable website |
| Fulfilling legal obligations, should they arise in connection with the collaboration | Data required by law, e.g. data needed for accounting or tax records | Art. 6(1)(c) GDPR - a legal obligation to which the Controller is subject |
If, in a specific case, the Controller wishes to process data on the basis of consent, the Controller will ask for it separately and explain the purpose of such processing. Consent can be withdrawn at any time, which does not affect the lawfulness of processing carried out before its withdrawal; the legal basis for such processing will be Art. 6(1)(a) GDPR.
5. Contact form and e-mail contact
The contact form is used to start contact with the Controller. Providing data in the form is voluntary, but failing to provide the data marked as required may make it impossible to send the enquiry or for the Controller to reply.
Data sent through the form or by e-mail is processed in order to reply to the message, to clarify needs, to provide information about services and, if the conversation continues, also to prepare for entering into or performing a collaboration.
Information that is not needed to describe the enquiry should not be sent through the form.
6. Data recipients
Personal data may be disclosed only where this is justified by the purpose of processing or required by law. Recipients of data may include, in particular, the following categories of entities:
- providers of hosting, IT infrastructure, e-mail, tools for operating the website or security (including Google Workspace);
- providers of administrative, accounting, legal or advisory services, where they are involved in supporting the Controller’s business;
- the Controller’s associates or subcontractors, where their involvement is needed to prepare a reply or quotation or to carry out the agreed collaboration;
- public authorities or other authorised entities, where an obligation to disclose data arises from law.
The Controller should enter into appropriate data processing agreements with the entities that process data on its behalf (processors), where required by law.
7. Transfers of data outside the European Economic Area
The Controller uses Google Workspace (provider: Google Ireland Limited and other entities in the Google group, including Google LLC) for e-mail and for office and organisational tools. Accordingly, personal data contained in e-mail correspondence, in particular correspondence sent to kontakt@twojesystemy.com, may be processed on Google’s servers and transferred outside the European Economic Area (EEA), in particular to the United States.
Transfers of data outside the EEA take place on the basis of mechanisms provided for in the GDPR. Google has joined the EU-U.S. Data Privacy Framework, which is covered by a decision of the European Commission finding an adequate level of protection (Art. 45 GDPR) and, to the extent not covered by that decision, applies standard contractual clauses approved by the European Commission (Art. 46 GDPR), included in Google’s data processing terms (Cloud Data Processing Addendum).
Apart from the case above, the Controller does not transfer data outside the EEA as a separate purpose of processing. If the Controller introduces further tools in future that involve such a transfer, it will update this section and ensure GDPR-compliant grounds for the transfer.
8. Data retention period
Data will be kept for the period necessary to achieve the purpose for which it was collected, and thereafter for the period required by law or justified by the protection of the Controller’s rights. In particular:
- data from a single contact enquiry may be kept for the time needed to reply and to conclude the correspondence;
- if the contact develops into discussions about collaboration, data may be kept for the duration of those discussions and for the period needed to demonstrate their course;
- data related to a concluded contract may be kept for the duration of the collaboration and thereafter for the limitation period of any claims or the period required by accounting and tax regulations;
- data processed on the basis of consent will be kept until the consent is withdrawn, unless there is another legal basis for further processing;
- technical server logs may be kept for a period resulting from the hosting configuration and from security, diagnostic and abuse-protection needs.
After the relevant period has elapsed, data is deleted, anonymised or restricted to the extent required by law or for defence against claims.
9. Rights of data subjects
A data subject has the rights provided for in the GDPR, including:
- the right of access to data;
- the right to rectification of inaccurate or incomplete data;
- the right to erasure of data;
- the right to restriction of processing;
- the right to data portability, where applicable;
- the right to object to processing based on the Controller’s legitimate interest;
- the right to withdraw consent, where data is processed on the basis of consent.
To exercise these rights, contact the Controller at kontakt@twojesystemy.com. The Controller may ask for additional information enabling the identity of the person making the request to be confirmed, where this is necessary to protect the data.
10. Complaint to the President of UODO
A data subject has the right to lodge a complaint with a supervisory authority if they consider that the processing of their data infringes data protection law.
In Poland the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO). Current contact details are available at: https://uodo.gov.pl/en.
11. Voluntary provision of data
Providing data in the contact form or in an e-mail message is voluntary. However, contact details are needed so that the Controller can reply to the enquiry, clarify needs, prepare a collaboration proposal or continue communication.
Where data is needed to conclude or perform a contract, failing to provide it may make it impossible to conclude or carry out the collaboration.
12. Automated decision-making and profiling
Personal data is not used for automated decision-making that produces legal effects or similarly significantly affects the data subject. The Controller does not profile website users for behavioural advertising or for automated assessment of personal characteristics.
13. Data security
The Controller applies organisational and technical security measures appropriate to the nature of the data processed and the risks associated with processing it. These may include, in particular, access control for e-mail and work tools, account safeguards, use of trusted providers, an encrypted connection to the website, restricting access to data to persons who need it to carry out specific tasks, and ongoing response to security incidents.
No method of transmitting data over the Internet or of storing data guarantees complete security; therefore, excessive or particularly sensitive information should not be provided through the form.
15. Links to other sites
The website may contain links to external websites or profiles. The Controller is not responsible for the privacy practices of external sites. After moving to another site, it is worth reading its privacy policy.
16. Changes to the privacy policy
The privacy policy may be updated in particular where there is a change in how the website works, in the scope of services, in technical providers, in cookie tools or in applicable law. The current version of the document should be published on the TwojeSystemy website.
Date of last update: 24.06.2026