Privacy policy

1. 1

   Who is responsible for your data

   The controller of your personal data is Profitway sp. z o.o. sp. kom. (hereinafter: Profitway), entered in the register of entrepreneurs under KRS no. 0000780034, tax ID (NIP) 5213862320.

   Office: Popularna 4/6 lok. 6, 02-473 Warsaw, Poland. For anything concerning personal data write to biuro@profitway.pl - we reply within 24 working hours.

   We have not appointed a data protection officer. Every request goes straight to the team that manages the data in question.

2. 2

   What data we collect

   We collect only what we genuinely need, and in practice only in three situations:

   • Contact forms and quote requests - name, phone number, e-mail address, optionally a budget range and your message. This is data you hand us yourself.
   • Recruitment - the information in your CV and in the messages you send us, whether you answer a job ad or write to us on your own initiative.
   • Technical data - IP address, browser and device type, how you arrived on the site (UTM parameters) and the events collected by analytics tools, if you consent to them.

   We do not buy databases and we do not collect special category data such as information about health, beliefs or origin.

3. 3

   Why we process it and on what basis

   Every purpose has its legal basis in art. 6 GDPR:

   • Answering your enquiry and preparing an offer - steps taken at your request before entering into a contract (art. 6(1)(b) GDPR).
   • Delivering the contract and running the collaboration - performance of a contract (art. 6(1)(b) GDPR).
   • Marketing our own services, including sales contact - our legitimate interest (art. 6(1)(f) GDPR) and, where electronic communications law requires it, your consent (art. 6(1)(a) GDPR).
   • Analytics, statistics and improving the site - the consent you give in the cookie bar (art. 6(1)(a) GDPR).
   • Advertising and remarketing - the consent you give in the cookie bar (art. 6(1)(a) GDPR).
   • Recruitment - labour law provisions (art. 6(1)(c) GDPR) and your consent for data beyond the statutory scope and for future recruitment processes (art. 6(1)(a) GDPR).
   • Tax and accounting obligations and defending against claims - a legal obligation and our legitimate interest (art. 6(1)(c) and (f) GDPR).

   Site security, meaning protecting the forms against spam and abuse, rests on our legitimate interest (art. 6(1)(f) GDPR).

4. 4

   How long we keep it

   We do not keep data longer than it is needed:

   • Enquiries that did not turn into a collaboration - 24 months from the last contact.
   • Contract data - for the duration of the contract, then until the limitation periods for claims and tax obligations expire (as a rule 6 years).
   • Recruitment documents - 6 months after the process ends, or 24 months if you consented to future processes.
   • Data used for marketing - until you object or withdraw your consent.
   • Cookie data - according to the lifetime of each individual file. The record of your consent decision is kept for 12 months, after which we ask again.
5. 5

   Who we entrust it to

   We do not sell your data and we do not share it with third parties for their own marketing. We entrust it only to those without whom the service cannot be delivered, and always under a data processing agreement:

   • hosting, e-mail and cloud infrastructure providers,
   • providers of analytics, advertising and marketing automation tools,
   • our accountants, legal advisers and auditors,
   • subcontractors delivering part of the work for us, to the extent they need it.

   We also disclose data to public authorities and courts where the law obliges us to.

6. 6

   Transfers outside the EEA

   Some of the tools we use (Google, Meta and Microsoft services among others) belong to providers established in the United States. This means your data may be processed outside the European Economic Area.

   Such transfers take place under the standard contractual clauses approved by the European Commission (SCC) and, for certified providers, additionally under the Data Privacy Framework. You can ask for a copy of the safeguards in place by writing to biuro@profitway.pl.

7. 7

   Your rights

   At any time you have the right to:

   • access your data and receive a copy of it,
   • rectify data that is inaccurate or incomplete,
   • erase your data, that is the right to be forgotten,
   • restrict processing,
   • port your data to another controller,
   • object to processing based on our legitimate interest, including direct marketing,
   • withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

   One e-mail to biuro@profitway.pl is enough. We reply within a month at the latest. If you believe we process your data unlawfully, you can also lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.

8. 8

   Voluntary data and automation

   Providing data in our forms is voluntary, but without a phone number or an e-mail address we simply have no way to answer your enquiry.

   We do not take decisions about you based solely on automated processing and we do not profile you in a way that produces legal effects. If you consent to marketing cookies, advertising tools may tailor the content of ads to your interests - that is the only form of profiling involved here.

9. 9

   Cookies and similar technologies

   Cookies are small files stored in your browser. We use them in three categories, and two of them only start once you consent. Alongside cookies we use similar technologies: local storage, pixels and event identifiers - we treat them in exactly the same way.

   Our scripts are managed through Google Tag Manager. The manager itself collects no data about you: it only decides which of the tools below may run at all, and it honours your choice from the bar through Google Consent Mode v2.

   Category	What it does	Example tools	Legal basis
   Necessary	Keeping the session alive, protecting forms against spam, remembering your consent choice	Profitway mechanisms (pw-consent), server protections	Legitimate interest - no consent required
   Analytics	Traffic statistics, traffic sources, click maps and aggregated session recordings	Google Analytics 4, Google Tag Manager, Microsoft Clarity, Hotjar	Consent (art. 6(1)(a) GDPR)
   Marketing	Measuring ad performance, remarketing, identifying companies visiting the site and automating marketing communication	Google Ads, Meta Pixel, Albacross, Mautic	Consent (art. 6(1)(a) GDPR)

   The list of tools is illustrative. We may also use other, similar analytics and advertising tools - always within the same categories and always on the same terms: analytics and marketing only after your consent.

10. 10

    Managing your consent

    On your first visit we show a bar where you decide what we may load. Your choice is stored locally on your device together with the date and the consent version - it does not go into any external register.

    You can change your mind at any time. This button, or the link in the site footer, opens the settings again:

    Cookie settings

    You can also delete or block cookies in your browser settings. Just bear in mind that disabling the necessary ones may stop the forms from working.

11. 11

    Security

    The entire site runs over HTTPS. Only the people who actually need access to the data have it, and every such account is protected with multi-factor authentication.

    The forms are protected against automated spam, and submissions go straight to our company mailbox - they do not pass through intermediary services.

12. 12

    Changes to this policy

    We update this policy whenever the way we process data changes or new tools come into play. The current version is always published at this address, and for material changes we will ask for your consent again.

    Last updated: August 2026.

The Polish version is the binding one. This English translation is provided for information only.