Privacy policy

1. Data controller

The controller is ACTIVE IT (trading as Primessio) — sole proprietorship registered in the Polish CEIDG register, ul. Bukowa, 05-506 Magdalenka, Poland, NIP: 563-197-59-37, VAT: PL5631975937.

Contact for data matters: info@primessio.com, phone: +48 506 038 327.

2. What data and why

Through the contact form we collect your name, email address and message — solely to answer your enquiry and, where relevant, to take steps prior to entering a contract. For security (abuse prevention) we also record the sender’s IP address.

3. Legal basis

Processing is based on Art. 6(1)(b) GDPR (steps prior to a contract, at your request) and Art. 6(1)(f) GDPR (our legitimate interest in handling correspondence; for the IP address: security and abuse prevention). Providing the data is voluntary but necessary for us to reply.

4. Recipients (processors)

Data may be entrusted to providers of our infrastructure: the hosting and mail-server provider (webh.pl). They process data under data-processing agreements (Art. 28 GDPR) and only on our documented instructions. We do not transfer data outside the European Economic Area.

5. Retention

We keep the data for as long as needed to handle the enquiry and correspondence, then until any limitation periods for claims expire. The IP address logged for security is deleted once that purpose ends.

6. Your rights

You have the right to access, rectification, erasure, restriction, data portability (where based on a contract) and to object (where based on legitimate interest, Art. 21 GDPR). You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

7. Cookies and analytics

Beyond strictly necessary cookies we use Google Analytics 4 (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) solely for anonymous visit statistics. The tool loads ONLY after your explicit consent in the banner; until then the Google script is not requested at all and analytics storage is blocked (Consent Mode). If you decline, no connection to Google servers is made and any _ga cookies from an earlier visit are deleted.

The legal basis is your consent under Art. 6(1)(a) GDPR together with Art. 5(3) of the ePrivacy Directive as implemented locally. You may withdraw consent at any time — the "Analytics settings" link sits in the footer of every page; withdrawal does not affect the lawfulness of processing carried out beforehand. We collect usage data (pages viewed, entry source, approximate city-level location, device and browser type) and a truncated IP address; this is never combined with data from the contact form. Google may process the data outside the EEA on the basis of standard contractual clauses. Retention in the property is 14 months.

8. Profiling / automated decisions

We make no decisions based solely on automated processing and do not profile visitors.

9. Changes

We may update this policy. The version in force is dated below.