Privacy Policy

1. Data controller

The controller of your personal data is:
MankaSoft Michał Mańka (sole proprietorship)
ul. Kościuszki 48, 43-100 Tychy, Poland
Tax ID (NIP): 6463024833 | REGON: 543102958
Email: m.manka@mankasoft.com | Phone: +48 575 885 101

I process data under Regulation (EU) 2016/679 (GDPR) and the Polish Act of 10 May 2018 on the Protection of Personal Data. I have not appointed a data protection officer; write to the address above about anything.

2. What data and where it comes from

• Contact form: your email address, your message and the page it was sent from. The form sends the message to this site's server, which emails it to my inbox. Messages are not stored in any database.
• Email and phone: whatever you give me when you write or call (e.g. name, company, tax ID, phone number).
• Form abuse protection: I store a hash of the IP address made with a secret key that changes daily, and count messages from one address within a one-hour window. The IP address itself is never stored.
• Server logs: the hosting provider records technical connection data (IP address, date, page address, browser).
• Statistics (only with your consent): Google Analytics 4 collects visit information with a pseudonymous identifier, no Google signals and no ad personalisation. Google Analytics 4 does not log IP addresses.
• Browser storage: your cookie choice and motion setting. They stay on your device and are not sent to a server. The site's language follows from the address (the English version is under /en/), so it is not stored.

3. Purposes and legal bases

• Replying to an enquiry and preparing a quote: Art. 6(1)(b) GDPR (steps before a contract at your request), and for other matters Art. 6(1)(f) GDPR (my legitimate interest in answering messages).
• Performing a contract: Art. 6(1)(b) GDPR.
• Accounting and taxes: Art. 6(1)(c) GDPR (tax law obligations).
• Site security and form protection: Art. 6(1)(f) GDPR.
• Visit statistics: Art. 6(1)(a) GDPR (your consent), which you can withdraw at any time.

Providing data is voluntary, but without an email address or phone number I cannot reply. I do not make automated decisions or profile anyone.

4. Retention

• Enquiries that did not lead to a contract: 12 months from the last contact.
• Contract documents and invoices: 5 years from the end of the calendar year in which the tax payment deadline passed (Art. 86 § 1 with Art. 70 § 1 of the Polish Tax Ordinance).
• IP hashes from the form: until the end of the day. The first form submission of the next day deletes them together with the key they were made with (counting uses a 1-hour window).
• Server logs: under the hosting provider's (OVH) rules and the law that applies to it.
• Google Analytics 4 cookies: up to 14 months or until consent is withdrawn.

5. Recipients

Data goes only to processors acting on my behalf under data processing agreements (Art. 28 GDPR):

• OVH Sp. z o.o. — website and email hosting (servers in the European Union),
• Google Ireland Ltd. — Google Analytics 4, only with your consent,
• an accounting office — invoice data only, if we sign a contract.

I do not sell data or share it with anyone for marketing.

6. Transfers outside the EEA

Form and email data stay in the European Union. With Google Analytics 4, data may reach Google LLC in the US on the basis of the European Commission's adequacy decision for the EU–US Data Privacy Framework, in which Google LLC participates. Without your consent Google Analytics does not load.

7. Your rights

• access to your data and a copy of it (Art. 15 GDPR),
• rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18),
• data portability (Art. 20),
• objection to processing based on legitimate interest (Art. 21),
• withdrawing consent at any time, without affecting earlier processing,
• a complaint to the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

I answer requests without undue delay and within one month at the latest (Art. 12(3) GDPR). Write to m.manka@mankasoft.com or use the data deletion page.

8. Cookies and browser storage

Under Art. 399 of the Polish Electronic Communications Law, information is stored on your device only when it is necessary for the site to work or when you consent:

• necessary: cookie choice and motion setting (browser storage, no tracking),
• analytics: Google Analytics 4 cookies (_ga, _ga_*), only after consent in the banner.

Change your consent at any time with "Cookie Settings" in the footer. After withdrawal Google Analytics stops at once and its cookies are deleted. You can also manage cookies in your browser settings.

9. Security

The site is served over HTTPS only (TLS 1.3, HSTS) with security headers (Content-Security-Policy, X-Frame-Options, Referrer-Policy and others). The form accepts messages only from this site, limits their number and does not store their content on the server.

10. Changes

Any significant change is reflected in the "Last updated" date at the top. Version 3.0 (October 10, 2026).