Who is responsible for your data
Widuo is a brand under which two separate sole traders collaborate. The joint controllers of data used to handle enquiries together are:
- Maciej DudzikPolish tax ID (NIP): 8411738421Business address: ul. Władysława IV 12A/13, 84-300 Lębork, Poland
- Kacper WiśniewskiPolish tax ID (NIP): 5662038168Business address: ul. Gwardii Ludowej WRN 6/30, 06-413 Ciechanów, Poland
Shared privacy contact: kontakt@widuo.pl.
Handling enquiries together
Both joint controllers jointly determine the purposes and means of handling enquiries addressed to Widuo and have access to the relevant correspondence. The shared contact address also handles requests about personal data.
You may exercise your rights against either joint controller, regardless of who replied to your enquiry. The shared contact does not restrict these rights. If you enter into a contract with one business, that business will provide information about processing related to its performance.
What data we receive
The form requires a name or company name, an email address and a description of your enquiry. A timeline and approximate budget are optional. Correspondence also contains any other information you choose to share. Please do not send passwords, access credentials or sensitive personal data.
Providing data is voluntary. Without a return address and the substance of your enquiry, we cannot reply; required fields are needed to submit the form. The application does not save unfinished entries in browser storage and only transmits their contents to our server when you submit.
Delivering and protecting the website also involves technical data such as an IP address, request time, page address and information about the browser and connection. Anti-spam verification is described separately below.
Purposes and lawful bases
- Responding to your enquiry and preparing an offer at your request, where you are a prospective party to the contract — Article 6(1)(b) GDPR, taking steps before entering into a contract.
- Communicating with company representatives and handling other correspondence — Article 6(1)(f) GDPR. Our legitimate interest is communicating with people interested in Widuo services.
- Operating and securing the website and preventing spam and abuse — Article 6(1)(f) GDPR. Our interest is protecting the website, mailboxes and correspondence.
- Establishing, exercising or defending specific legal claims where necessary — Article 6(1)(f) GDPR; the interest is protecting our rights.
How long we keep data
We delete enquiries that do not result in working together no later than 6 months after the last contact. This covers correspondence in both mailboxes and working copies under our control. Deletion is part of mailbox management; the website does not automatically delete emails.
An exception applies to specific messages needed to establish, exercise or defend legal claims: we retain only what is necessary until the dispute ends or the relevant limitation period expires. Client data and documents relating to contracts follow separate rules, including accounting obligations.
Form contents are not stored in a website database or our application logs. They are processed temporarily in transit and remain in email after acceptance by the mail server. Providers may retain their own technical data and backups under the terms of their services.
Who takes part in processing
Cloudflare hosts and delivers the website, runs the contact form function and protects against abuse. Submitted form contents pass through a Cloudflare function and are forwarded to OVHcloud email. OVHcloud delivers and stores messages in mailboxes accessed through Zimbra.
Correspondence is accessible to the joint controllers and people authorised to assist where necessary. Technical providers act within the scope of their services and processing terms. Data may also be disclosed to legally authorised authorities or advisers where a specific matter requires it. We do not sell enquiry data.
Turnstile anti-spam verification
Cloudflare Turnstile starts when you begin using the form fields. It analyses technical signals including IP, browser and connection information. We do not send form field values to the widget. Separately, the function handling submission receives the message contents.
Cloudflare processes signals on our behalf to protect our website. According to its privacy notice, it also acts as an independent controller when improving bot detection. Its notice explains that role and how to contact Cloudflare.
Processing outside the EEA
Cloudflare uses global infrastructure and subprocessors, so data may be processed outside the European Economic Area, including in the United States. We do not claim that all website processing takes place exclusively in Poland or the EU.
Cloudflare terms provide transfer mechanisms including Standard Contractual Clauses and, where applicable, adequacy decisions. You can contact us for details and a copy of safeguards; provider documentation is available through the link above. OVHcloud services are governed by their processing terms and service configuration.
Your rights
Subject to the GDPR, you may request access to and a copy of your data, rectification, erasure or restriction of processing. Data portability applies to automated processing based on a contract or consent.
Where processing relies on our legitimate interests, you may object on grounds relating to your particular situation. We assess objections under Article 21 GDPR. Rights are not unconditional; for example, erasure does not always cover information needed to defend legal claims.
Write to the shared address at the start of this page. We may request information necessary to verify your identity. We normally respond within one month; we explain any extension and its reasons within that period. You may also complain to the President of the Polish Personal Data Protection Office (UODO) or your competent supervisory authority.
Decisions and updates
We do not use enquiries to make solely automated decisions producing legal or similarly significant effects on you, or for marketing profiling. Automated anti-spam protection may reject a submission; in that case, you can contact us directly by email.
We update this notice when the website or our handling of data changes. The update date appears at the start of this document.