Privacy policy
Document version: 19 October 2026 · 2026-10-19.2
Controller and contact
The controller of your personal data is Nadart sp. z o.o., a Polish limited liability company, ul. 1 Maja 54, 96-300 Żyrardów, Poland; KRS 0000552484; tax identification number (NIP) 838-184-82-33; REGON 361237343; share capital PLN 5,000; registered with the District Court for the Capital City of Warsaw, 14th Commercial Division of the National Court Register. The company owns the brand and operates waisme.com.
Privacy requests and withdrawal of consent: ido@waisme.com. General enquiries and complaints: hello@waisme.com. You may also write to the registered office.
Data we collect and sources
You provide data directly to us. The contact form collects your email address and, optionally, your name, brand or company, phone number, project description and selected portfolio references (work identifiers, titles and URLs). Newsletter and launch-notification forms require an email address. We also record the form language, submission time, delivery information and, for email sign-ups, the wording and version of consent, its time, confirmation or withdrawal status and protected link tokens.
Your browser and the server exchange technical data needed for connection and security, including IP address, date and time, requested URL, response code and browser information. The contact form briefly uses a hash of email and IP to limit repeated submissions; it does not store the raw IP in the enquiry record.
Please do not submit special-category data, identity-document numbers or unnecessary personal data about other people.
Purposes and legal bases
- Enquiries and consultations: replying, understanding your needs and preparing a proposal. Article 6(1)(b) GDPR applies to steps requested by a prospective contracting party; otherwise Article 6(1)(f) applies to our legitimate interest in correspondence and communication with company representatives. Marketing consent is not required to make an enquiry.
- Newsletter: requested advice, service news and offers from . Article 6(1)(a) GDPR and prior email consent under Article 398 of the Polish Electronic Communications Law. You must confirm your subscription using an email link.
- Launch notification: one website-launch email only, based on separate consent under Article 6(1)(a) GDPR and Article 398 of that Law. This does not subscribe you to the newsletter.
- Security, technical operation, complaints and claims: Article 6(1)(f) GDPR — protecting the website, handling correspondence and establishing, exercising or defending claims; Article 6(1)(c) where a specific legal obligation applies.
Voluntary provision
Providing data is voluntary. We need a valid email address to reply and the relevant consent for email subscriptions. Other contact fields are optional; we may ask for clarification if your project details are insufficient. Refusing newsletter or launch-notification consent does not prevent browsing or contacting us. An enquiry does not itself conclude a paid-services contract.
Recipients and transfers outside the EEA
Our website and email hosting provider is VH.PL (Prociv sp. z o.o.), ul. Czerniawska 2A/27, 50-576 Wrocław, Poland, KRS 0000393293. Authorised website and correspondence staff, IT maintenance and backup providers and legal advisers may receive necessary data on an appropriate basis, including processing agreements where required. Competent authorities receive data when required by law.
In the configuration covered by this policy, WordPress handles forms and sign-ups, with email through VH.PL. We do not use an external newsletter platform, advertising pixels or analytics scripts. Cloudflare Turnstile security on labelled forms is an exception to local processing, as described below. Visiting an external social platform is your choice; its operator processes data under its own terms and may operate outside the EEA. New tools require updated information and any necessary transfer safeguards before use.
Cloudflare Turnstile: labelled forms use security provided by Cloudflare, Inc. (USA). When you start using a form, Cloudflare receives technical connection and browser signals, including IP. Our validation does not send contact fields or email to Cloudflare. Our basis is Article 6(1)(f) GDPR — preventing spam. Cloudflare processes signals on our behalf for website protection and as a separate controller to improve bot detection. Processing may occur outside the EEA, including the USA. Cloudflare terms provide for the EU–US Data Privacy Framework where applicable, and standard contractual clauses with additional safeguards for restricted transfers. Request information or a copy of safeguards at ido@waisme.com; see the Cloudflare DPA and Turnstile notice.
Retention
- Enquiries: while handling the matter and for justified follow-up. We review and delete obsolete enquiries that did not lead to a contract within 12 months of the last contact, unless needed for a specific dispute. Contract records are handled separately during performance and for applicable statutory or limitation periods.
- Unconfirmed newsletter: confirmation links expire after 48 hours; unconfirmed sign-ups are removed within 30 days.
- Confirmed newsletter: until withdrawal or discontinuation. Marketing stops on withdrawal. Limited evidence of consent and withdrawal may remain for up to 3 years after withdrawal, or longer only while a specific dispute remains unresolved.
- Launch notification: until withdrawal or one launch email. The sending list is removed within 30 days after notification or withdrawal. If no launch takes place, sign-ups expire after 12 months. Limited consent evidence may remain as described above.
- Logs and backups: under the hosting rotation cycle, only as needed for security or recovery. Data removed from active use may remain in an isolated backup until overwritten; deletion requests are reapplied after recovery. Ask the controller for details relating to a particular backup or incident.
- Turnstile: our website does not archive verification tokens; a token is valid for up to 5 minutes and is checked once. Cloudflare’s own processing is governed by its linked privacy notices, including its retention criteria.
We do not automatically retain all data merely because it might be useful in the future.
Your rights and withdrawing consent
Subject to GDPR conditions, you may access and obtain a copy of your data, rectify it, request erasure or restriction, and receive portable data processed automatically on consent or contract grounds. You may object to legitimate-interest processing for reasons relating to your situation, and object to direct marketing at any time.
Withdraw consent free of charge by emailing ido@waisme.com. You may also unsubscribe using the newsletter cancellation link; every newsletter email includes a way to unsubscribe. Withdrawal does not affect earlier lawful processing. We normally respond within one month; if a lawful extension is necessary, we will explain it. Where there are reasonable doubts, we may request necessary identity verification.
You may complain to the President of the Polish Personal Data Protection Office, or another competent supervisory authority: uodo.gov.pl/en.
Automation, security and updates
We do not make solely automated decisions, including profiling, that produce legal or similarly significant effects on you using the described data. Automated form checks and spam controls protect the website.
We use HTTPS, access controls and form safeguards. See our cookie policy for browser storage and terms of service for website services. Updates are published with their date. Updating this document does not itself grant consent for a new purpose.