01 Data controller and scope
The controller of personal data processed in connection with the GeekboxApps website is FABIAN BERDA, who operates the website under the GeekboxApps brand.
- NIP
- 6412565016
- REGON
- 527012908
- Address
- ul. Fryderyka Joliot-Curie 2C, 41-710 Ruda Śląska
- Contact
- office@geekboxapps.com
This policy covers visits to our website and contact with us, including through the form and by email. It explains the rules arising from Regulation (EU) 2016/679 (GDPR) and legislation on privacy in electronic communications. Simply using the website does not constitute consent to analytics or marketing.
02 The data we process
- Contact: your name, email address or phone number, project type, message and any information you choose to provide in correspondence. For telephone contact, this also includes information needed to handle the call.
- Form handling: the page from which a message was sent, a technical submission identifier and information about the delivery result.
- Website operation and security: your IP address and technical request data, such as the time of connection, requested URL, browser type and response code. These may be processed in the website infrastructure and technical logs; the IP address is also used to limit abuse of the form.
- CookieYes consent management: your acceptance or refusal, consent categories, consent identifier and the date it was recorded. Depending on the configuration, evidence of consent may also include the domain, approximate location and a partially masked IP address. Such an identifier does not make the data fully anonymous.
Providing contact details is voluntary. The short enquiry form on the homepage requires a project type and an email address or phone number. The full contact form requires your name, email address and message. Without details that allow us to reply, we may be unable to deal with your enquiry. Do not send passwords, payment card details, identity documents, health information or other special categories of personal data unless this is necessary and has been agreed with us in advance.
03 Purposes and legal bases
- Answering enquiries and handling correspondence: Article 6(1)(f) GDPR. Our legitimate interest is to respond to messages and stay in contact with people who write to us, including on behalf of a business.
- Preparing a proposal and taking steps at your request before entering into a contract: Article 6(1)(b) GDPR, where you are to be a party to the contract. This basis also covers data necessary to perform a contract with you.
- Security, preventing spam and abuse, and establishing, exercising or defending legal claims: Article 6(1)(f) GDPR. Our interest is to protect the website, correspondence and our rights.
- Meeting specific legal obligations: Article 6(1)(c) GDPR, for example handling a request concerning your data and, once we work together, complying with applicable tax and accounting obligations.
- Optional Google Analytics statistics: your consent under Article 6(1)(a) GDPR and prior consent to the use of analytics technologies under Article 399 of the Polish Electronic Communications Law.
- Remembering and respecting your privacy choices: Article 6(1)(f) GDPR - our legitimate interest is to apply your settings and avoid repeatedly asking about a choice you have already made. Where necessary to demonstrate that consent was given, the legal basis is Article 6(1)(c) in conjunction with Article 7(1) GDPR. A record of refusal is used to respect that refusal, not to activate analytics.
- Optional Google Ads performance measurement: prior consent for this purpose under Article 6(1)(a) GDPR, together with consent to the relevant technologies under Article 399 of the Polish Electronic Communications Law. Consent to analytics alone does not constitute consent to the transfer of data for advertising measurement.
Sending an enquiry does not subscribe you to a newsletter or constitute consent to marketing messages. We do not sell data. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing, including profiling.
04 Recipients of data
Authorised people handling enquiries and providers of infrastructure, hosting, email and technical support may have access to data to the extent necessary to provide their services. Where they process data on our behalf, appropriate data processing agreements are required.
We use Resend (Plus Five Five, Inc., USA) to deliver messages from the form. The provider receives the information needed to send the message: the contact details you provide, the project type or enquiry content and delivery metadata. See the Resend Privacy Policy and Resend Data Processing Addendum for details.
The website is served through Cloudflare. The full form in the Contact section uses Cloudflare Turnstile to reduce spam and abuse. Verification involves technical connection data and a security token; the message content is not sent to Turnstile. For more information, see the Cloudflare Privacy Policy and Turnstile Privacy Policy .
Where Google Analytics 4, Google Tag Manager or Google Ads measurement is used after appropriate consent, Google Ireland Limited (Ireland) receives the relevant data, together with Google LLC (USA) in connection with operating the services. We explain the purposes and conditions of processing in the analytics section . Data may be disclosed to public authorities where required by law.
CookieYes, provided by CookieYes Limited (United Kingdom), operates the consent panel. The service remembers choices and maintains consent records on our behalf; it may process the choice data described above and technical connection data. Processing arrangements and subprocessors are described in the CookieYes Data Processing Agreement .
05 Transfers outside the EEA
Using Resend involves transferring data to the USA, outside the European Economic Area (EEA). Operating Cloudflare infrastructure may also involve processing outside the EEA. Processing by Google and CookieYes services may involve the United Kingdom, the USA and other countries where these providers or their subprocessors operate. This does not mean that all data is stored exclusively in Poland or the EEA.
A transfer requires a basis under Chapter V GDPR: a European Commission adequacy decision or appropriate safeguards, such as standard contractual clauses together with a transfer assessment and additional measures where necessary. For the USA, the EU-US Data Privacy Framework may be used if the decision remains in force and the specific recipient holds active certification covering the transfer. Being based in the USA is not enough on its own.
According to its published data processing terms, Resend uses standard contractual clauses for transfers covered by those terms. A copy is available in its Data Processing Addendum . Google's arrangements are explained in its information on data transfers . Contact us for information about the safeguards applicable to your data and a copy of them, subject to protecting other people's rights.
CookieYes Limited is established in the United Kingdom. Transfers covered by a European Commission adequacy decision in force may rely on that finding of an adequate level of protection; current information is published by the European Commission . Further transfers and the safeguards applied are described in the CookieYes Data Processing Agreement . Each transfer requires a basis applicable to the actual data flows, including standard contractual clauses where required.
06 How long we keep data
- Correspondence: for as long as needed to handle your enquiry and any agreed follow-up. Once contact has ended, we retain only data needed to document arrangements or protect legal claims until the relevant limitation period expires. We consider the nature of the matter and whether continued retention is necessary; we do not archive enquiries indefinitely by default.
- Documents relating to our work together: for the period required by applicable law, where a retention obligation applies to the document.
- Technical data and logs: for the period needed to keep the service running, diagnose errors and handle incidents, taking account of log rotation and provider settings. Data relating to a particular incident may be needed to investigate it or protect legal claims.
Backups and providers' technical data have their own retention cycles determined by configuration and contracts. Deleted data may remain in isolated backups until those backups are rotated. Technical retention in the email delivery service does not determine how long messages are kept in our own mailbox.
We state the retention periods for analytics data below. Once the purpose and legal basis no longer apply, the data is deleted or permanently anonymised.
The choice stored in your browser and CookieYes's register of consent evidence are separate records. We retain evidence of consent only for as long as necessary to demonstrate which choice applied, taking account of legal obligations and the relevant limitation periods for claims. Withdrawing consent stops future measurement covered by that consent, but does not necessarily mean immediate deletion of the minimum evidence of earlier consent. Your choice is remembered in the cookie for 180 days. This period is separate from the retention period of the consent evidence register.
08 Analytics and advertising measurement
Analytics and advertising measurement only with consent. Google Analytics 4 provides visitor statistics. Google Ads may be used to measure advertising performance separately if you consent to that purpose. Below, we explain the scope of data and the rules for processing it.
Google Tag Manager (GTM) manages when measurement tags run. It does not replace the consent panel and is not in itself a legal basis for processing. Under the chosen Basic Consent Mode, Google tags and measurement requests are blocked until the appropriate consent is given, and after refusal or withdrawal of consent. Google also describes GTM diagnostics and technical request logs in its information about the data collected by GTM .
Analytics consent covers the statistical purpose only; advertising measurement requires appropriate separate consent. Without consent for a purpose, its tags remain blocked. Sending a form message does not constitute consent to analytics or advertising.
With analytics consent, statistics may include pages visited, time spent on the website, referral source and permitted values of the utm_source and utm_medium parameters and approved utm_campaign labels, device and browser type, approximate region and pseudonymous cookie identifiers. We measure page views and clicks on phone and email links. We record the generate_lead event once our server confirms that the email delivery provider accepted the form submission. We do not send Google your name, email address, phone number or message content, including in URLs or event parameters. Cookie identifiers do not make the data fully anonymous.
- Without consent, no measurement requests are sent to Google, including requests that do not use cookies.
- Measurement does not include Google Signals, advertising personalisation, remarketing, User-ID or enhanced conversions based on contact data.
- User and event data in GA4 is retained for 2 months, without resetting the period when new activity occurs. Aggregate reports may remain available for longer.
- For the
_gaand_ga_<identifier>cookies, the lifetime is up to 6 months from when they are set or updated. During activity covered by analytics, the cookie that stores GA4 session state may get a new expiry date. Setting or updating these cookies requires analytics consent.
Google Ads performance measurement. After appropriate consent, measurement may allow a confirmed enquiry to be attributed to an ad, for example using the GCLID click identifier and the generate_lead event passed from GA4. Event and ad attribution data may be passed to Google Ads without contact details or enquiry content. Consent to GA4 analytics does not automatically cover this transfer. We do not create remarketing lists or profiles for advertising personalisation. Measurement requires consent to both analytics and advertising measurement. We include the GCLID click identifier from our labelled campaign in the cleaned page address only after both consents. We do not store it ourselves before your choice. After withdrawal, we block further advertising measurement and remove accessible Google advertising records from _gcl_* cookies and _gcl_ls storage. The page may reload to end the previous settings.
For more information, see Google's Privacy Policy and the Google Analytics data protection information .
09 Your rights
Subject to the conditions and limits in the GDPR, you may:
- access your data and obtain a copy, and have inaccurate data corrected;
- request erasure or restriction of processing;
- receive data in a portable format where processing is automated and based on consent or a contract;
- object, on grounds relating to your particular situation, to processing based on legitimate interests;
- withdraw consent at any time where it is the basis for processing;
- lodge a complaint with the President of the Polish Personal Data Protection Office; information is available on the UODO website . You do not have to contact us first.
Send your request to office@geekboxapps.com. We respond without undue delay, normally within one month of receiving a request. If an extension is needed under the GDPR, we will inform you of this and the reasons within the first month. If we have reasonable doubts about your identity, we will ask only for the information necessary to verify it.
10 Security and external links
We limit the data we process and access to it. The form includes validation and abuse prevention measures. We choose technical and organisational safeguards according to the risk. No system can eliminate every threat. We do not ask for passwords or access credentials to your systems in the form.
Links to our work and other services lead to websites governed by their operators' rules. When you visit an external website, read its privacy policy. Merely displaying a link does not activate the destination website's tracking tools on our website.
11 Contact and policy updates
Have a privacy question or want to exercise your rights? Email GeekboxApps at office@geekboxapps.com. Simply describe the matter and provide the details needed for a reply.
We update this policy when the website's operation, providers or legislation change. The date of the current version appears at the start of the document. A policy update does not replace any required consent, automatically extend earlier consent or restrict your legal rights.
Back to top