01Data controller
The controller of your personal data is YourWeb Agency (“YourWeb”, “we”). You can contact us about personal data:
- E-mail: kontakt@your-web.pl
- Phone: +48 660 790 373, +48 664 034 072
This policy covers data processed in connection with the your-web.pl website, the contact form, cooperation under our plans and accounts in YourWeb Studio.
02What data we process and why
Contact form and enquiries
Data: first name, last name, email address, company name and size, the chosen plan and billing, promo code and the content of your message, as well as any data you share with us in further correspondence.
Purpose and legal basis: replying to your enquiry and preparing an offer at your request (Art. 6(1)(b) GDPR) and handling correspondence, which is our legitimate interest (Art. 6(1)(f) GDPR).
Period: until the correspondence ends and, if we do not start working together, no longer than 12 months after the last contact.
Call calendar: after sending the form you can book an online call. We store the chosen time together with your enquiry, plus cryptographic hashes of your email address and IP address (not the addresses themselves), so that nobody can fill the calendar with other people's data. We send a confirmation of the time to the email address you gave, and after the form on the EUDR page also an automatic reply that your enquiry has arrived. The call is deleted together with the enquiry, at the latest 12 months after its date.
Concluding and performing an agreement
Data: contact details of the people representing the client, billing data and the data needed to deliver the project.
Purpose and legal basis: concluding and performing the agreement (Art. 6(1)(b) GDPR), issuing invoices and keeping the accounts required by law (Art. 6(1)(c) GDPR).
Period: for the duration of the agreement, and accounting documents for 5 years from the end of the calendar year in which the tax payment deadline passed.
YourWeb Studio accounts
Data: login, display name, contact email address, password (stored as a hash), account identifier, profile photo (if you add one), information about the author and time of changes in the document history, information about your presence in the panel during live collaboration and, if you sign in in YourWeb App, the remembered sign-in on that device (a hash of the device key and the dates it was used).
Purpose and legal basis: giving you access to Studio and its use in line with the Terms of service (Art. 6(1)(b) GDPR), and account security and accountability for content changes, which is our legitimate interest (Art. 6(1)(f) GDPR).
Period: for as long as the account exists; entries in the change history: for as long as the project they concern exists; the remembered sign-in in the app: until you sign out, change your password or do not open the app for 90 days.
Notifications in YourWeb App
If you turn on notifications on a device, we store its notification address (issued by the push service of your browser or phone), encryption keys, the device name (e.g. “iPhone · aplikacja YourWeb App”) and the types of notifications you chose. The content of a notification (e.g. a customer's name, the ordered products, the amount and delivery method, the beginning of a message; never contact details or an address) is sent in encrypted form through the push service of the browser or phone maker.
Purpose and legal basis: informing you about events in Studio at your request (Art. 6(1)(b) GDPR).
Period: until you turn notifications off on that device or the notification address expires. Signing out on a phone or tablet (in YourWeb App or a browser) does not turn notifications off, and signing out on a computer pauses them until you sign in again on that device; paused notifications are deleted after 90 days without signing in again.
Content of your website managed in Studio
If the content of a website managed in Studio contains personal data (for example team details on a client's website), the website owner is its controller. YourWeb processes such data on the owner's behalf under a data processing agreement.
Security and technical data
Data: IP address, browser type, the time and address of the request, recorded in server logs.
Purpose and legal basis: ensuring security, detecting abuse and diagnosing errors, which is our legitimate interest (Art. 6(1)(f) GDPR).
Period: for the limited time needed for these purposes.
Choosing the website language
When you open the website, we use your IP address to check whether you are connecting from Poland, so that we can show it in Polish or in English. The check takes place in the server's memory, based on public data on IP address allocation, without storing the result and without passing your address to anyone else. If you choose a language in the website header, we remember it in a cookie described in the Cookie policy.
Purpose and legal basis: showing the website in a language you understand, which is our legitimate interest (Art. 6(1)(f) GDPR).
Establishing and pursuing claims
Where necessary, we may process data to establish, pursue or defend claims (Art. 6(1)(f) GDPR), until the limitation period expires.
Cookies
You will find information about cookies and other data stored in your browser in the Cookie policy.
03Who we share data with
Data may only be shared with entities that help us provide our services, and only to the extent necessary for them to do so:
- hosting, server infrastructure and database providers,
- our email provider,
- our accounting office and payment service providers,
- providers of tools used in Studio, for example a translation service, if you use it,
- the push services of browser and phone makers (Google, Apple, Mozilla, Microsoft), if you turn on notifications; they receive the content of notifications in encrypted form.
We may also disclose data to public authorities where the law requires it. We do not sell personal data.
04Transfers outside the EEA
As a rule, we process data within the European Economic Area. If a service provider processes data outside the EEA, this is done on the basis of a European Commission decision confirming an adequate level of protection or standard contractual clauses. You can obtain a copy of these safeguards by contacting us.
05Your rights
In connection with the processing of your data, you have the right to:
- access your data and receive a copy of it,
- have inaccurate data corrected,
- have your data erased or its processing restricted,
- data portability for data we process on the basis of an agreement or consent,
- object to processing based on our legitimate interest,
- withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.
To exercise these rights, write to kontakt@your-web.pl. You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).
06Do you have to provide data
Providing data is voluntary. Without the data marked as required in the form we cannot reply to your enquiry, and without the data needed for an agreement we cannot conclude and perform it or create a Studio account.
07Automated decisions
We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.
08Data security
We use technical and organisational measures appropriate to the risk, including encrypted connections, access control for panels and databases, storing passwords as hashes and giving editors access only to the content assigned to them.
09Changes to this policy
We may update this policy, for example after changes in the law or in the way we provide our services. The current version is always available on this page together with the date from which it applies.