NET-FLOW.
PL

Documents

Privacy Policy

Last updated: 26.09.2026

Note: this is an English translation provided for convenience. The Polish version is the authoritative one.

1. General information

This Privacy Policy describes how personal data of users is processed on the website operated at net-flow.pl and its subdomains.

The data controller is Net-Flow Sp. z o.o., with its registered office in Warsaw, ul. Spiralna 2B, NIP: PL5214120388, REGON: 541958796, entered in the KRS register under number 0001177291 (the “Controller”).

You can contact the Controller at: kontakt@net-flow.pl.

2. Scope of processed data

  • Form data: name or institution name, email address, phone number (if provided), website address and message content.
  • Technical data: device IP address, browser type, operating system.
  • Website usage data, collected only with consent: cookie identifiers, pages visited, traffic source (e.g. an ad) and actions taken, such as submitting a form or clicking the phone number.
  • User preferences: selected site language and saved cookie consents.
  • Data of people contacting the Controller through social media profiles: profile name and the content of the message or comment.

3. Purposes and legal bases

  • Handling contact form inquiries: Art. 6(1)(f) GDPR (legitimate interest in communicating with users).
  • Pre-contract actions and service delivery: Art. 6(1)(b) GDPR.
  • Visit statistics (Google Analytics 4), ad performance measurement (Google Ads, Meta pixel) and showing ads to people who have visited the website: only with consent, Art. 6(1)(a) GDPR.
  • Running social media profiles and replying to messages: Art. 6(1)(f) GDPR (legitimate interest in informing about services and communicating with users).
  • Website security and proper operation: Art. 6(1)(f) GDPR.

4. Data recipients

  • Website hosting infrastructure provider (Vercel Inc.).
  • Transactional email provider for the contact form (Resend).
  • Google Ireland Limited: Google Analytics 4 and Google Ads, only with consent.
  • Meta Platforms Ireland Limited: Meta pixel, only with consent (details in section 5).
  • Accounting or legal service providers acting for the Controller.
  • Public authorities, only where disclosure is required by law.

Since some providers are based outside the European Economic Area or are affiliated with entities outside it (incl. the USA), data may be transferred outside the EEA. Transfers are based on the European Commission decision of 10 July 2023 on the adequate level of protection under the EU-US Data Privacy Framework, for entities covered by it (including Google LLC and Meta Platforms, Inc.), or on Standard Contractual Clauses approved by the European Commission.

5. Meta pixel and social media profiles

For the collection of data via the Meta pixel and its transmission to Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland), the Controller and Meta are joint controllers within the meaning of Art. 26 GDPR. For processing after the transmission, Meta is responsible as a separate controller, as described at facebook.com/privacy/policy.

The Controller runs company profiles on Facebook, Instagram and LinkedIn. Data of people who visit the profiles, comment on posts or send messages is processed by the Controller to run the profiles and reply to messages. For profile visit statistics, the Controller is a joint controller with Meta Platforms Ireland Limited and with LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2, Ireland), respectively.

The rights described in section 7 can be exercised against the Controller or directly against the platform provider.

6. Retention

  • Contact form data: for the time needed to handle the inquiry, no longer than 12 months after correspondence ends.
  • Consent-based data: until consent is withdrawn.
  • Statistics in Google Analytics 4: no longer than 14 months.
  • Analytics and advertising cookies: for the periods listed in the Cookies Policy.
  • Social media messages and comments: until deleted or until the profile is closed.
  • Technical logs: for the period resulting from hosting infrastructure configuration.

7. Your rights

  • access to your data and obtaining a copy,
  • rectification (correction),
  • erasure,
  • restriction of processing,
  • data portability,
  • objection to processing,
  • withdrawal of consent at any time (without affecting prior lawful processing),
  • lodging a complaint with the President of the Polish Personal Data Protection Office (PUODO).

8. Cookies

The website uses cookies and similar technologies (localStorage). Detailed rules, including consent management, are described in the Cookies Policy.

9. Data security

The Controller applies technical and organisational measures appropriate to the risk, including encrypted connections (TLS/SSL), data minimisation and infrastructure access control.

10. Voluntary data provision

Providing data is voluntary but necessary to use the contact form. Without it, a message cannot be sent.

11. Changes to this Policy

The Controller may update this Policy. The current version is always available at net-flow.pl/polityka-prywatnosci with its last-updated date.