Privacy policy

The controller of your personal data is KRU7, operating under the brand name WH, ul. Komorowska 53a, 05-830 Nadarzyn, Poland, NIP: 521-413-57-28 ("we", "us", or "WH").

You can contact us regarding data protection matters at biuro@whmg.pl or by post at the address above.

We collect personal data only when you actively provide it to us — specifically through our contact form. This may include:

• Full name
• Email address
• Phone number (optional)
• Company name (optional)
• The content of your message

We also automatically collect certain technical data through analytics tools and server logs (see sections 06 and 07).

We do not collect sensitive personal data (e.g. health information, political opinions, or financial data).

We use the data you submit solely to:

• Respond to your enquiry or request for a quote
• Follow up on your interest in our services, where you have given consent

We do not use your data for automated decision-making or profiling.

We process your personal data under the following legal bases (GDPR Art. 6):

• Consent (Art. 6(1)(a)) — you tick the consent checkbox before submitting the contact form; you accept analytics and marketing cookies via the cookie banner
• Legitimate interests (Art. 6(1)(f)) — website security, server logs, and ensuring proper website operation

• Contact form data: retained for up to 12 months after your enquiry is resolved, unless you ask us to delete it sooner or a longer retention period is required by law.
• Google Analytics data: retained per our configured retention period (14 or 26 months).
• Meta Pixel cookie (_fbp): expires after 90 days.
• Vercel Analytics data: retained for up to 30 days.
• Server logs: retained for up to 30 days.

We do not sell or rent your personal data to third parties. Data is processed by the following service providers on our behalf:

• Formspree, Inc. (USA) — processes contact form submissions and forwards messages to our email inbox. Data transfers are safeguarded by Standard Contractual Clauses.
• Google LLC (USA) — provides Google Tag Manager and Google Analytics for website usage analysis. Google Analytics uses cookies to collect anonymised data such as pages visited, session duration, device type, and approximate location. Analytics cookies are only set after you give consent. Data transfers are covered by the EU-US Data Privacy Framework.
• Meta Platforms Ireland Ltd. (Ireland / USA) — provides the Meta (Facebook) Pixel, which measures the effectiveness of our advertising on Facebook and Instagram. After you accept cookies via the banner, the pixel sets marketing cookies and shares website usage events with Meta (pages visited, clicks on contact buttons, contact form submissions — never the content of your message). Data transfers are covered by the EU-US Data Privacy Framework.
• Vercel Inc. (USA) — provides website hosting and Vercel Analytics. Vercel Analytics collects anonymised, aggregated performance data and does not use cookies or identify individual users. Data transfers are covered by the EU-US Data Privacy Framework.
• Cloudinary Inc. (USA) — provides CDN delivery of images and videos on this website (photos, gallery videos).
• WhatsApp / Telegram — buttons on the contact section link to external messaging platforms. Clicking a button takes you to a third-party platform governed by its own privacy policy. We do not pass any personal data to these platforms.

We use cookies to improve user experience and analyse website traffic. Non-essential cookies are only set after you give consent via our cookie banner.

• Essential cookies — required for the website to function (e.g. storing your cookie consent preference). These do not require consent.
• Analytics cookies — Google Analytics cookies (_ga, _ga*) used to distinguish visitors and track website usage. These are only set after you click "Accept" on the cookie banner.
• Marketing cookies — Meta (Facebook) Pixel cookies (_fbp) used to measure the effectiveness of our advertising on Facebook and Instagram. These are only set after you click "Accept" on the cookie banner.

Vercel Analytics does not use cookies.

You can change your cookie preferences at any time by clearing your browser cookies and revisiting the site.

Under the GDPR you have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you
• Right to rectification — ask us to correct inaccurate data
• Right to erasure — ask us to delete your data ("right to be forgotten")
• Right to restriction — request that we limit how we process your data
• Right to object — object to processing based on legitimate interests
• Right to data portability — receive your data in a structured, machine-readable format
• Right to withdraw consent — you may withdraw consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at biuro@whmg.pl. We will respond within one month.

You also have the right to lodge a complaint with the Polish supervisory authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw — uodo.gov.pl.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. All data is transmitted over HTTPS.

We may update this Privacy Policy from time to time. Changes will be reflected in the "Last updated" date at the top of this page.