Privacy policy

Effective from 15 October 2026.

1. Controller

The controller of your personal data is Marcin Retmańczyk, running a sole proprietorship under the name MARCIN RETMAŃCZYK MRETMAN, ul. Bolesława Chrobrego 26, 45-580 Opole, Poland, VAT ID PL7542751870, REGON 160110115 (“we”). Trading name: Meble z Pomysłem.

Contact regarding personal data: biuro@meblezpomyslem.pl, phone +48 883 200 129 or by post to the address above. We have not appointed a data protection officer.

2. What data we collect and why

• Contact form, e-mail and phone – name, phone number, e-mail and project description (and, for e-mail contact, attached files such as floor plans or photos) to answer your enquiry and prepare a quote. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Art. 6(1)(f) GDPR (our legitimate interest in handling correspondence).
• Performance of a contract – data needed for measuring, design, production, delivery and installation, and for warranty claims. Legal basis: Art. 6(1)(b) GDPR.
• Legal obligations – issuing and storing invoices and accounting records. Legal basis: Art. 6(1)(c) GDPR in conjunction with Polish tax and accounting law.
• Establishing or defending legal claims. Legal basis: Art. 6(1)(f) GDPR.
• Website operation and security – the website is delivered through the Cloudflare network, which automatically processes your IP address, date and time, the page requested and browser and device information on every visit. This data is used to deliver the website, protect it against attacks (e.g. DDoS, malicious bots, intrusion attempts) and detect abuse. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in keeping the website secure and working).

3. How long we keep data

• enquiries that did not lead to a contract – up to 12 months from the last contact,
• contract data – for the duration of the contract and then until the warranty and limitation periods expire,
• accounting documents – for 5 years from the end of the calendar year in which the tax payment deadline passed,
• technical data and security logs – for the retention period of the Cloudflare service, no longer than needed to keep the website secure or investigate an incident,
• Google Analytics statistics (only with consent) – 14 months; Microsoft Clarity session recordings – 30 days, Clarity heatmaps and statistics – up to 13 months; cookies as described in section 7.

4. Recipients

Your data may only be disclosed to service providers who help us run the business, under data processing agreements or legal provisions: Cloudflare, Inc. (website hosting, DNS, CDN and attack protection), Formspree, Inc. (contact form processing – forwards form submissions to our e-mail), Google Ireland Limited (Google Tag Manager and Google Analytics – only with your consent), Microsoft Ireland Operations Limited (Microsoft Clarity – only with your consent), Hostido (e-mail provider), accounting office, transport companies (for deliveries) and IT service providers, as well as public authorities where required by law.

We do not sell your data. Cloudflare, Inc. and Formspree, Inc. are based in the USA, and Google Ireland Limited and Microsoft Ireland Operations Limited may transfer data to Google LLC and Microsoft Corporation (USA), so data may be transferred outside the European Economic Area. Cloudflare, Google LLC and Microsoft Corporation participate in the EU-U.S. Data Privacy Framework, covered by the European Commission’s adequacy decision (Art. 45 GDPR), and additionally applies Standard Contractual Clauses. Transfers to Formspree are based on the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR) in our data processing agreement. If you prefer not to use the form, e-mail biuro@meblezpomyslem.pl or call us. Fonts and website files are served directly from our website – we do not connect to Google Fonts.

5. Your rights

• right of access and to obtain a copy,
• right to rectification,
• right to erasure,
• right to restriction of processing,
• right to data portability,
• right to object to processing based on legitimate interest,
• right to lodge a complaint with a supervisory authority – in Poland the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or the authority in your country of residence.

To exercise your rights, e-mail biuro@meblezpomyslem.pl. We will reply within one month.

6. Voluntary provision of data

Providing data is voluntary, but without it we cannot answer your enquiry or enter into a contract. We do not use automated decision-making or profiling.

7. Cookies

Essential (always active): Cloudflare may set strictly necessary technical cookies (e.g. __cf_bm, cf_clearance) used only to tell humans from bots and to protect the website against attacks – they are required for the secure operation of the site and therefore do not require consent. We also store in your browser’s localStorage your cookie choice (mzp-consent) and the fact that you closed the language suggestion bar – these contain no personal data.

Analytics (only with consent): with your consent, Google Analytics 4 (loaded via Google Tag Manager) collects information on how the site is used – pages visited, visit duration, approximate location (city/country), device and browser type, traffic source and clicks on phone, e-mail or form submission (without form content); IP addresses are not stored. It sets the _ga and _ga_* cookies (up to 2 years). Microsoft Clarity creates click and scroll heatmaps and anonymous recordings of how a visit unfolds (mouse movement, clicks, scrolling) – text typed into forms is masked automatically and never recorded; it sets the _clck (up to 1 year) and _clsk (1 day) cookies. Legal basis: Art. 6(1)(a) GDPR (consent). Marketing (only with consent): Google Ads cookies (e.g. _gcl_au, up to 90 days) used to measure ad effectiveness. Google Tag Manager itself sets no cookies. Without consent Google only receives anonymous cookieless signals (Google Consent Mode). You can change or withdraw your consent at any time via “Cookie settings” in the footer; withdrawal does not affect the lawfulness of processing before it.

The location map on the home page is an interactive Google map (Google Maps, Google Ireland Ltd). It only loads after you click “Show map” or accept marketing cookies – until then you see a plain image stored on our website that does not connect to Google. Once the map loads, Google receives your IP address and may set its own cookies (e.g. NID) under its privacy policy. The site also links to external services (Facebook, Google Maps); once you follow such a link, that service’s privacy policy applies. You can delete or block cookies and localStorage data in your browser settings at any time.

8. Changes

This policy may be updated, e.g. when the law changes or new features are added. The current version is always available on this page. In case of discrepancies, the Polish version prevails.