PL / EN Let’s talk
Let’s talk
PL / EN
Documents

Privacy policy.

We explain what data we collect through this site, why we need it and what you can do about it. Without a wall of legal jargon – but with the specific provisions wherever the law calls for precision.

Last updated: 14 August 2026.

This is an English translation provided for convenience. The binding version is the Polish one, available at masthef.com/polityka-prywatnosci. In the event of any discrepancy, the Polish text prevails.

The controller of your personal data – that is, the entity deciding why and how it is processed – is:

Masthef Sp. z o.o. ul. Sezamkowa 12, Brzezina, 55-330 Mrozów, Poland VAT ID PL9131637903 · KRS 0001092134 hello@masthef.com

For any matter concerning personal data – including exercising the rights described in section 7 – write to hello@masthef.com or to our registered address.

We have not appointed a data protection officer, because we are not required to: we do not process data on a large scale and we do not carry out regular monitoring of individuals (Art. 37 GDPR). Correspondence on data matters is handled at the address above.

Data from the contact form

Your name, email address and the message itself are mandatory – without them we have no way to reply. The company name and topic are optional. Providing this data is not required by law or by contract: it is voluntary, but without it you will not receive a reply from us.

Data from correspondence

If you write to us directly by email, we process the data contained in the message and in its signature – usually your name, email address, company name and job title.

Technical data

Our hosting provider records in the server logs your IP address, the date and time of the request, the browser and operating system type, and the address you arrived from. This is a standard part of how every website works – needed in order to serve and secure it.

Data from spam protection

The contact form is protected by Cloudflare Turnstile – a mechanism that distinguishes a human from a bot, in most cases without any interaction on your part. When you open the contact page, your browser connects to Cloudflare servers, which process your IP address, information about your browser and device, and the way you interact with the page. Without this protection we could not offer a working form.

Statistical data (Google Analytics)

To measure traffic on the site we use Google Analytics 4. It collects information about how you use the site: the pages you visit, the time and source of your visit, your approximate location (at town level), and the type of device and browser. It relies on a random identifier stored in a cookie – it does not know your name or email address, and for users in the European Union Google does not store full IP addresses. We store statistical cookies only with your consent – see sections 3 and 9 for details.

We do not collect special categories of data under Art. 9 GDPR – concerning health, beliefs, origin or trade union membership. Please do not include such information in the content of your message.

Every purpose has its own legal basis. Below are all of the purposes that apply at our end.

Handling an enquiry from the form and subsequent correspondence
Art. 6(1)(b) GDPR – taking steps at your request prior to entering into a contract. If the enquiry is not aimed at a contract, the basis is Art. 6(1)(f) GDPR, and our legitimate interest is replying to a person who has contacted us.
Archiving correspondence and establishing, pursuing or defending claims
Art. 6(1)(f) GDPR – a legitimate interest in being able to demonstrate the course of commercial arrangements and to defend against possible claims.
Ensuring the security and correct operation of the site
Art. 6(1)(f) GDPR – a legitimate interest in protecting the infrastructure against abuse and in diagnosing failures.
Protecting the contact form against spam and bots
Art. 6(1)(f) GDPR – a legitimate interest in keeping the contact channel open and preventing automated abuse.
Site visit statistics (Google Analytics)
Art. 6(1)(a) GDPR – your consent to statistical cookies. You can withdraw it at any time (see section 9), and declining it does not limit your use of the site in any way.
Meeting tax and accounting obligations, if a partnership goes ahead
Art. 6(1)(c) GDPR in connection with the Polish Accounting Act and the Tax Ordinance Act.

We do not take decisions about you based solely on automated processing and we do not profile you (Art. 22 GDPR). We do not use your data to train artificial intelligence models.

We do not sell your data and we do not share it with anyone for marketing purposes. We entrust it solely to providers who help us run the business, and we do so on the basis of data processing agreements (Art. 28 GDPR). These are the following categories of recipients:

  • hosting and site infrastructure provider – Vercel Inc., which serves the site and keeps the server logs;
  • spam protection provider – Cloudflare, Inc., supplying the Turnstile mechanism that protects the contact form;
  • contact form delivery provider – Resend (Resend, Inc.), which delivers the message from the form to our mailbox and processes the form data on servers in the European Union;
  • email provider – the entity that maintains the company mailbox where correspondence arrives;
  • visit statistics provider – Google Ireland Limited, supplying the Google Analytics tool – solely with your consent (sections 3 and 9);
  • external advisers – our accounting office and legal advisers, to the extent needed to settle a partnership or defend against claims;
  • public authorities – solely where an obligation to transfer data follows from the law.

We will provide an up-to-date list of the specific providers on request – write to hello@masthef.com.

We try to keep data within the European Economic Area. Some of our providers are, however, US companies – including Vercel, Cloudflare, Resend and Google – so your data may be processed in the United States. This happens on one of two bases:

  • the European Commission implementing decision of 10 July 2023 finding an adequate level of data protection under the EU–U.S. Data Privacy Framework – where the provider appears on the list of certified entities (Art. 45 GDPR);
  • standard contractual clauses approved by the European Commission, supplemented by additional safeguards – where the provider does not hold that certification (Art. 46(2)(c) GDPR).

You can obtain a copy of the safeguards applied, or information on where they are available, on request at hello@masthef.com.

Enquiries and correspondence where no partnership followed
up to 12 months from the conclusion of the matter.
Correspondence and records where a partnership followed
for the duration of the partnership, and then until the limitation period for claims expires – as a rule 3 years for claims connected with business activity (Art. 118 of the Polish Civil Code).
Accounting and settlement documents
5 years, counted from the end of the calendar year in which the tax payment deadline fell (Art. 86 of the Tax Ordinance Act, Art. 74 of the Accounting Act).
Server logs
up to 30 days, unless longer retention is needed to investigate a security incident.
Statistical data in Google Analytics
up to 14 months from collection – after that time Google deletes the data associated with the user identifier.

In connection with the processing of your data you have the right to:

  • access your data and obtain a copy of it (Art. 15 GDPR);
  • rectification of inaccurate or incomplete data (Art. 16 GDPR);
  • erasure of data (Art. 17 GDPR);
  • restriction of processing (Art. 18 GDPR);
  • portability of data processed on the basis of a contract or consent (Art. 20 GDPR);
  • object to processing based on a legitimate interest (Art. 21 GDPR – see section 8);
  • withdraw consent at any time, where processing is based on it – without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR).

To exercise any of these rights, write to hello@masthef.com. We reply without undue delay, within one month at the latest – and if the matter is complex, we let you know that the deadline has been extended by up to two further months. Handling a request is free of charge. We may ask for information allowing us to identify you if we are unable to establish who the request concerns.

You also have the right to lodge a complaint with the supervisory authority, which is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland – uodo.gov.pl.

You have the right to object at any time to the processing of your data based on our legitimate interest (Art. 6(1)(f) GDPR) – on grounds relating to your particular situation.

Once we receive an objection, we will stop processing your data for that purpose unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims.

If we ever start processing your data for direct marketing purposes, an objection to such processing is unconditional – you only need to raise it and we stop immediately (Art. 21(2)–(3) GDPR).

Send your objection to hello@masthef.com.

Cookies are small pieces of information saved on your device. The rules for using them are set out in Art. 399 of the Act of 12 July 2024 – Electronic Communications Law (Journal of Laws 2024, item 1221).

This site uses two categories of cookies and similar technologies:

  • strictly necessary – those without which the site cannot be served or secured. In this category we include the form protection provided by Cloudflare Turnstile, described in section 2. Consent is not required for strictly necessary cookies: Art. 399 of the Electronic Communications Law exempts cases in which storage or access is necessary to provide the service requested by the user;
  • statistical – cookies set by Google Analytics 4 (with names starting with “_ga”, stored for up to 2 years), which help us understand how visitors use the site. We store them only with your consent.

We ask for your consent to statistical cookies in a banner on your first visit – until you give it, Google Analytics does not run at all. You can withdraw or change your consent at any time – as easily as you gave it – by clicking “Cookie settings” in the site footer. Withdrawal does not affect the lawfulness of earlier processing. You can also block Google Analytics across all websites by installing the Google Analytics opt-out browser add-on. How Google processes data is described in the Google privacy policy.

We do not use advertising tools, we do not embed social plugins, and we do not embed content from third-party services that would track your activity across other websites.

You can also manage cookie settings in your browser – including blocking and deleting them. Blocking strictly necessary cookies may make the site harder to use.

We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR): encrypted transmission (HTTPS), limiting access to data to the people who actually need it, and processing agreements with our providers. No method of transmitting data over the internet offers a hundred-percent guarantee – so please do not send us particularly sensitive information through the form.

This site is addressed to companies and trade partners, not to children. We do not knowingly collect data from people under 16 years of age. If you believe a child has given us their data, write to hello@masthef.com – we will delete it immediately.

We update the policy when the way we process data, the set of providers or the law changes. The current version is always available at this address, and the date of the last change is given at the top of the page. For material changes we will also let you know separately – by email or by a notice on the site.

Questions about this policy, requests concerning your data and objections all go to one address: hello@masthef.com. You can also write to us by post at our registered address: Masthef Sp. z o.o., ul. Sezamkowa 12, Brzezina, 55-330 Mrozów, Poland.

Links to other sites. Our site contains links to services run by other entities – including our Instagram profile and the sites of trade partners. Once you move to such a site, the privacy policy of its owner applies, and we are not responsible for the way they process your data. We encourage you to read their documents.

Governing law. In matters not covered by this policy we apply the GDPR and Polish law, in particular the Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws 2019, item 1781) and the Electronic Communications Law (Journal of Laws 2024, item 1221).