Privacy policy (GDPR)
This document describes what personal data we process, for what purposes, on what legal basis, and what rights data subjects have.
1. Data controller
The controller of personal data is NOVACLEANLY SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (sp. z o.o.), NIP 6762712989, REGON 543967115, KRS 0001223270, registered office: Św. Filipa 23 / 3, 31-150 Kraków, Poland.
Data protection contact: contact@novacleanly.pl.
2. Scope of data processed
- Identification and contact data (e.g. first name, surname, e-mail, phone, service address).
- Data relating to orders, payments and settlements.
- Data provided in contact forms, complaints and correspondence.
- Technical and security data (e.g. system logs, IP address, session identifiers).
3. Purposes and legal bases for processing
- Performance of the contract and order handling – Art. 6(1)(b) GDPR.
- Compliance with legal obligations (accounting, tax, record-keeping) – Art. 6(1)(c) GDPR.
- Handling complaints, establishing or defending legal claims, and site security – Art. 6(1)(f) GDPR.
- Own marketing and promotional communication – Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR.
4. Data recipients
Data may be entrusted to providers required to deliver the service: Google Cloud (hosting and database), the SMTP mail provider, Przelewy24 (payments), Google Analytics once consent is given, as well as our accounting office and legal advisors. Each recipient receives only the data needed for its task.
5. Data retention periods
- Data related to performance of the contract – for the duration of performance and the limitation period for claims.
- Accounting and tax data – for the period required by law.
- Contact form messages – up to 24 months, unless they become part of handling a contract or a claim.
- Visit statistics and sign-in logs – up to 180 days; notification jobs – 90 days; short-lived rate-limiting data – until the end of its time window.
6. Your rights
- The right to access your data and obtain a copy of it.
- The right to rectification, erasure or restriction of processing.
- The right to data portability (where processing is based on a contract or consent).
- The right to object to processing based on legitimate interest.
- The right to withdraw consent at any time (without affecting processing carried out earlier).
- The right to lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland.
8. Transfers outside the EEA
Where data is transferred outside the European Economic Area, we apply the appropriate safeguards required by the GDPR, including standard contractual clauses.
9. Contact and changes to this policy
Requests concerning personal data should be sent to contact@novacleanly.pl. This privacy policy may be updated periodically as legislation or the way we deliver our services changes.