Privacy Policy

The controller of your personal data within the meaning of Article 4(7) GDPR is Norbert Nowacki, conducting sole-proprietor business activity, based in Słupsk, Poland, Tax ID (NIP): 8392975165, registered in the Polish Central Register and Information on Economic Activity (CEIDG). Full registration data is publicly available by NIP in the CEIDG search at aplikacja.ceidg.gov.pl.

EventApp (eventapp.pl) is a product of the Controller.

Contact for data protection matters: kontakt@codapi.pl, tel. +48 503 033 023.

We process only data that you provide to us yourself or that is collected automatically while you use the website:

• Contact form - your e-mail address and the message content.
• Technical and analytical data - IP address, browser identifiers, device information, pages visited, and traffic source (UTM parameters). Before you make a choice in the banner, some of this reaches Google without cookies (see section 4). Measurement with cookies and the Meta Pixel start only after you consent.
• Cookies - first-party cookie_consent (your banner decision) and NEXT_LOCALE (your chosen site language), and after consent also Google Analytics and Meta cookies.

We do not collect special categories of data (Art. 9 GDPR) or data relating to criminal convictions (Art. 10 GDPR).

We process your data for the following purposes:

• Responding to inquiries submitted through the contact form and sales-related communication — based on Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request) and Art. 6(1)(f) (legitimate interest of the Controller in handling correspondence).
• Website analytics and measuring advertising effectiveness — based on Art. 6(1)(a) GDPR (your voluntary consent expressed through the cookie banner).
• Compliance with legal obligations (including tax and accounting), if the inquiry results in a contract — based on Art. 6(1)(c) GDPR.

The website uses cookies and third-party tools. We use Google Consent Mode v2. Before you make a choice in the banner, Google Tag Manager and Google Analytics 4 load in no-consent mode: they store no analytics or advertising cookies, but Google Analytics 4 sends Google a basic cookieless measurement signal (including IP address and browser information). Analytics cookies and the Meta Pixel start only after you consent.

We use:

• First-party cookies - cookie_consent (stores your consent decision; valid for 12 months) and NEXT_LOCALE (stores your chosen site language).
• Google Tag Manager and Google Analytics 4 (Google Ireland Ltd., data may be transferred to Google LLC in the USA) - website traffic measurement. The _ga and _ga_* cookies are stored only after you consent.
• Meta Pixel (Meta Platforms Ireland Ltd., data may be transferred to Meta Platforms, Inc. in the USA) - loaded only after you consent. It measures conversions (Lead event after form submission) and page views, and stores the _fbp cookie.
• UTM parameters - stored in the browser's session storage as soon as you arrive, to attribute your inquiry to its marketing source. They are cleared when you close the tab.

You can change or withdraw your consent at any time via the Cookie settings link in the site footer. When you withdraw it, we delete the Google Analytics and Meta cookies from your browser.

We use trusted providers who process data solely on our instructions and under data-processing agreements compliant with Art. 28 GDPR:

• Resend (Plus Five Five, Inc., USA) — e-mail delivery for contact-form messages.
• Vercel Inc. (USA) — hosting of the eventapp.pl website.
• Google Ireland Ltd. - Google Tag Manager and Google Analytics 4 (before your consent in cookieless mode, see section 4).
• Meta Platforms Ireland Ltd. - Meta Pixel (activated only with your consent).

Your data is not sold, traded, or disclosed to third parties for marketing purposes.

Because some of our providers are based in or operate infrastructure in the United States (Vercel, Resend, Google, Meta), your data may be transferred outside the European Economic Area. Such transfers take place under appropriate safeguards:

• Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses (SCCs).
• Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection under the EU–US Data Privacy Framework — for providers with active DPF certification.

You may obtain a copy of the applied safeguards by contacting us at kontakt@codapi.pl.

We retain your data only for as long as necessary for the purpose for which it was collected:

• Contact-form messages — up to 3 years from the last contact (Polish statute of limitations for business claims under Art. 118 of the Civil Code).
• Tax and accounting data (if the inquiry led to a contract and an invoice) — 5 years from the end of the tax year in which the tax obligation arose.
• Cookies — for the validity period set by each provider (from session to 24 months).
• Analytics data — according to the settings of the analytics tools, for which you may withdraw consent at any time.

Under the GDPR you have the following rights:

• Right of access to your data and to receive a copy of it (Art. 15 GDPR).
• Right to rectification of inaccurate or incomplete data (Art. 16 GDPR).
• Right to erasure — “right to be forgotten” (Art. 17 GDPR).
• Right to restrict processing (Art. 18 GDPR).
• Right to data portability (Art. 20 GDPR).
• Right to object to processing, including profiling (Art. 21 GDPR).
• Right to withdraw consent at any time — without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3) GDPR).
• Right to lodge a complaint with the supervisory authority — the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

To exercise any of these rights, write to kontakt@codapi.pl. We respond without undue delay, at the latest within one month of receiving the request.

We have implemented appropriate technical and organisational measures to protect your data against unauthorised access, loss, or alteration:

• Encryption of website traffic via HTTPS/TLS.
• Data minimisation — we collect only what is truly necessary.
• Access to data restricted to authorised persons only.
• Contact-form messages delivered through an authenticated provider (Resend).

This privacy policy may be updated to ensure compliance with applicable law and to reflect changes in our practices. The current version is always available at /polityka-prywatnosci. We will notify you of material changes in a visible way on the website.