Privacy Policy
1. Personal Data Controller
The controller of personal data is:
TURBICONIX LIMITED LIABILITY COMPANY
Address: UL. OSTROBRAMSKA 101 / BIURO1, 04-041 WARSAW
Tax ID (NIP): 1133189497
E-mail: team@turbiconix.pl
2. Scope of Processed Data
When using the website, the following data may be processed:
- contact form data (name, email address, message content),
- IP address (in anonymized form),
- technical metadata related to form submission and abuse prevention (timestamp, request metadata, User-Agent),
- data regarding device and browser,
- statistical data regarding how the site is used,
- cookies and similar technologies.
3. Purposes of Data Processing
Personal data is processed for the purpose of:
- handling contact and sales inquiries submitted through forms,
- preventing abuse, spam, and unauthorized activity,
- maintaining technical diagnostics and proof of submission for dispute handling,
- conducting statistics and analyzing site traffic,
- improving site functionality and content,
- ensuring site security and proper operation.
4. Legal Basis for Processing (Final Mapping)
Personal data is processed based on:
- Article 6(1)(b) GDPR – handling inquiries that are directly related to product offers, orders, or pre-contract requests,
- Article 6(1)(a) GDPR – user consent to process analytics data (Google Analytics).
- Article 6(1)(f) GDPR – legitimate interest of the controller (general contact handling, anti-spam protection, technical security logging, reCAPTCHA, and incident diagnostics).
Consent can be withdrawn at any time.
5. Google Analytics
The site uses Google Analytics 4, provided by Google LLC.
- IP address anonymization is applied,
- data is not used for advertising purposes,
- no data that directly identifies the user is collected.
6. Google reCAPTCHA
The site uses Google reCAPTCHA v3 to protect forms from spam and abuse. reCAPTCHA analyzes user behavior (interaction signals) to distinguish humans from bots.
Google LLC acts as a data processor and processes data on behalf of the controller.
Processing is based on the Google Cloud Data Processing Addendum, and any transfers outside the EEA rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses (SCC).
Data may include: IP address, device and browser information, and interaction signals.
7. Processors and Controller Qualification
Controller: Turbiconix sp. z o.o.
Under currently active contracts and services, the provider roles are classified as follows:
- Brevo – processor for transactional form email delivery (API/SMTP),
- Hosting provider – processor for server hosting and infrastructure operations,
- MXroute – mailbox infrastructure provider; processor for mailbox hosting, and independent controller for its own platform-security/abuse obligations,
- Google LLC – independent controller for Google Analytics and reCAPTCHA under Google terms.
8. Data Transfer Outside the EU (Active Providers)
Cross-border transfers may occur for currently active providers and are covered by one or more safeguards below:
- Google LLC (US): EU–US Data Privacy Framework and/or Standard Contractual Clauses (SCC),
- MXroute (US): Standard Contractual Clauses (SCC) and contractual safeguards,
- Brevo (EU provider): primarily EU processing; where subprocessors outside EEA are used, SCC and equivalent safeguards apply.
9. Data Retention Period (Final Schedule)
- Contact form inquiry data: 12 months after last business contact, then deletion or anonymization unless legal defense requires longer storage.
- Security / anti-spam / technical logs: 30 days (rolling deletion).
- Analytics data: up to 14 months according to Google Analytics settings.
- Consent preference cookies in browser: 180 days (user can clear earlier).
10. User Rights
The user has the right to:
- access to data,
- rectification,
- erasure,
- restriction of processing,
- data portability,
- withdraw consent at any time,
- lodge a complaint with the President of the Office for Personal Data Protection (UODO).
11. Cookies
The site uses cookies:
- necessary/session/security cookies required for operation and form security,
- analytics (Google Analytics),
- essential for proper site operation.
Optional analytics cookies are loaded only after consent. Necessary technical and security processing may still occur even if optional cookies are rejected.
You can manage cookies through browser settings or the consent panel.
12. Changes to Privacy Policy
The controller reserves the right to make changes to the Privacy Policy.