Privacy notice
13 October 2026
This notice covers the use of kardcraft.pl and kardcraft.com, the contact form and correspondence relating to enquiries.
1. Controller and contact
The data controller is Paweł Kardasz, who operates the KardCraft brand. For questions about your data or to exercise your rights, email kontakt@kardcraft.pl.
2. Data processed
The contact form submits your name, email address and message. Further correspondence may include information and arrangements you provide in connection with your enquiry. Please share only what is needed to explain your situation. Do not send special-category personal data or confidential materials before we agree on how to share them.
Technical data, including your IP address and browser information, is also used to display and protect the website. Cloudflare Turnstile analyses technical signals to distinguish visitors from bots.
3. Purposes and legal bases
- Responding to enquiries, corresponding and documenting necessary business arrangements — my legitimate interests, GDPR Article 6(1)(f).
- Taking steps at your request before entering into a contract with you — Article 6(1)(b). If you contact me as a representative of another entity, your contact details are processed on the legitimate-interest basis above.
- Operating the website and protecting the form against spam and abuse — my legitimate interests, Article 6(1)(f).
- Keeping information required for accounting if an enquiry leads to work together — legal obligations, Article 6(1)(c). Establishing, exercising or defending legal claims — my legitimate interests, Article 6(1)(f).
4. The form and confirmation email
Your enquiry is delivered to my mailbox. I send a confirmation containing a copy of your message and contact details to the address you provide. You can reply to that email to continue the conversation. The form does not store submissions in a separate database; correspondence is kept in email.
5. Service providers and transfers
I use Cloudflare to host and protect the website and operate the form, and home.pl to send and store email. Providers receive the data needed to deliver these services.
Cloudflare also processes Turnstile signals as an independent controller to improve bot detection. See the Turnstile Privacy Addendum.
Cloudflare operates international infrastructure, so data may be processed outside the European Economic Area. Its terms provide appropriate transfer safeguards, including standard contractual clauses where applicable. Details and the safeguards are available in Cloudflare's Data Processing Addendum. You can also contact me for a copy of the applicable safeguards.
6. Retention and deletion
- Enquiries and negotiations: while handling them and carrying out any agreed follow-up. After the matter is closed, I delete data unless it is needed to document further work or meet the obligations and claims purposes below.
- Records of work together: throughout the contract. Necessary evidence of arrangements is then kept until the applicable claims limitation period expires, calculated from when the claim becomes due; if proceedings are brought, for the time needed until their final conclusion.
- Tax and accounting records: for the period required by applicable law, until tax liabilities are time-barred. Under the general Polish rule, this is 5 years from the end of the year in which payment of the tax was due; suspension or interruption of the limitation period may extend retention.
I review the usefulness of correspondence at least once a year. A review does not itself extend retention: I delete data without undue delay when there is no current purpose and legal basis to keep it. Useful examples may be retained after effective anonymisation.
Technical data is used to handle requests and protect the website. The form's rate limit uses one-minute windows; the application does not create a separate archive of visitors' IP addresses. Cloudflare explains its processing of signals in the provider information linked above.
7. Your rights
Subject to the GDPR, you can request access, rectification, erasure or restriction of processing, and object to processing based on legitimate interests. Data portability applies when its conditions are met, particularly for automated processing based on a contract. You may lodge a complaint with a competent supervisory authority; in Poland this is the President of the Personal Data Protection Office: UODO.
8. Providing data and automated decisions
Providing data is voluntary. Submitting the form requires a name, valid email address and message. I do not make decisions producing legal effects or similarly significantly affecting you solely through automated processing.
9. Browser preferences
Your selected colour theme is saved in your browser's local storage. You can change it using the website's theme button or remove the website's stored data in your browser. Fonts and graphics are served directly by this website. I do not use advertising cookies or my own marketing tracking tools. Cloudflare explains its technical protection mechanisms in its Turnstile notice.