Legal

Privacy Policy

Effective 7 September 2026

1. Who we are

This policy is issued by BODYA SP Z O O, a company registered in Poland with its office at Ul. Marcelego Nenckiego 31, 52-223 Wrocław. We are the controller of the personal data described below.

It covers visitors to this website and anyone who contacts us through the contact form, by phone or by email. Using the site or sending us a project brief means you accept the terms set out here.

2. Data we collect

We keep collection limited to what a project enquiry actually requires:

  • Contact form data — your name, company name, phone number, email address if you supply one, the service you selected and the text of your brief.
  • Technical data — browser and device type, approximate location derived from your IP address, and which pages were opened. Collected automatically for basic traffic statistics and to protect the site from abuse.
  • Anything shared voluntarily — details you give us by phone or email while we discuss a possible project.

We do not process payment card details through this website, and we never ask for passwords or identity documents in the contact form.

3. Why we process it

  • To answer your enquiry and prepare a proposal or estimate.
  • To perform a contract once we start working together, including correspondence and invoicing.
  • To keep the website secure and to see which sections visitors find useful.
  • To meet obligations imposed on us by Polish and EU law, such as retaining accounting records.

We do not sell personal data and we do not use it for third-party advertising.

4. Legal basis

We rely on Article 6 of the General Data Protection Regulation (GDPR), specifically: your consent, where you submit the contact form; the necessity of taking steps at your request before entering into a contract, and of performing that contract; our legitimate interest in keeping the site functional and secure; and compliance with legal obligations under Polish accounting and tax law.

5. How long we keep it

Enquiries that do not lead to a project are kept for up to twelve months, in case you come back to us. Data connected to an active or completed contract is kept for the duration of the engagement and afterwards for the periods required by Polish accounting and limitation rules. Technical site statistics are held in aggregated form and are not used to identify individual visitors.

6. Who else sees it

We do not disclose personal data to third parties for their own purposes. It may be processed on our behalf, strictly to the extent needed to run the business, by:

  • our hosting and content-delivery provider, including DDoS protection;
  • the service that receives and forwards contact form submissions;
  • email and project-management tools used by our team;
  • our accountants, and public authorities where the law requires disclosure.

Each processor works under a written agreement limiting what they may do with the data.

7. Transfers outside the EEA

Some of our technical providers run infrastructure outside the European Economic Area. Where data is transferred, it happens on the basis of an adequacy decision of the European Commission or on Standard Contractual Clauses, so that the level of protection follows the data.

8. Cookies

The site uses essential cookies required for it to load and function. Where analytics cookies are used, the data is anonymised and tells us only which pages are visited and from which country. You can block or delete cookies in your browser settings; parts of the site may then behave less predictably.

9. Your rights

Under the GDPR you have the right to:

  • be told whether we hold data about you, and to receive a copy of it;
  • have inaccurate data corrected;
  • have your data erased where there is no longer a basis for keeping it;
  • restrict processing, or object to processing based on our legitimate interest;
  • receive your data in a portable, machine-readable format;
  • withdraw consent at any time, without affecting processing carried out before the withdrawal.

To exercise any of these, contact us using the details in section 13. If you believe we have handled your data improperly, you may also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) in Warsaw.

10. Security

We apply appropriate technical and organisational measures: encrypted connections (HTTPS), access to enquiries limited to the people who need it, and regular updates of the systems we run. No transmission over the internet can be guaranteed absolutely secure, and we do not claim otherwise.

11. Children

This site is aimed at businesses and is not directed at children. We do not knowingly collect data from anyone under the age of 16.

12. Changes

We may update this policy when our processes or the applicable law change. The effective date at the top of the page always reflects the current version, and material changes will be marked on this page.

For any question about this policy or about your data, reach us at:

BODYA SP Z O O
Ul. Marcelego Nenckiego 31
52-223 Wrocław, Poland
Phone: +48 794 592 360