Privacy policy (GDPR)

1. Controller and contact

NOVACLEANLY SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, NIP 6762712989, REGON 543967115, KRS 0001223270, Św. Filipa 23 / 3, 31-150 Kraków, Polska. Data questions and requests: contact@novacleanly.pl.

2. Data and purposes

We process contact and identification data, the service address and date, selected scope, billing data, payment history and correspondence. Handling enquiries, concluding and performing contracts rely on GDPR Article 6(1)(b); accounting and tax obligations rely on point (c).

Required order data is marked in the form. Without contact details, scope and address we cannot quote or perform the service; NIP and company details are needed for the requested document. Extra notes and photos are optional unless assessing the scope is necessary to quote. We do not request health data, identity documents or information unrelated to the service.

Under GDPR Article 6(1)(f), we protect the service from abuse and establish, pursue and defend claims. Our interest is service security and protection of rights in a specific case. Complaints are also handled to meet applicable legal duties. Ordinary correspondence unrelated to a contract is handled in the interest of answering it.

Analytics requires prior consent. Order-related contact is not marketing consent. Electronic marketing requires a separate voluntary basis and appropriate consent for the channel; we do not infer it from purchases or acceptance of the Terms.

3. Employees and suppliers

Employees carrying out an assigned job receive only necessary details: time, address, scope, contact and required instructions. They do not need the full customer history, invoices or private admin notes. Organisational authorisation, confidentiality and training remain NovaCleanly responsibilities.

We use Google Cloud for hosting, database and infrastructure, an SMTP email provider, Przelewy24 for payments and KSeF for integrated documentation. Accountants, legal advisers and authorised authorities may receive necessary data. A supplier role follows the actual service and contract; not every recipient is a GDPR Article 28 processor.

Google Analytics and Google Ads measurement start only after separate choices in Cookie settings. Ad personalisation is disabled. WhatsApp is an optional link to an external messenger whose provider processes data under its own rules. Email is an alternative. Do not send entry codes, documents or health data through the messenger.

4. Photos and access instructions

Quote photos determine scope and price; quality or damage records support contract performance and claims to the necessary extent. They are not automatic consent for advertising or a portfolio. Publication requires a separate appropriate basis.

Before sending, remove people, documents, family photos, access codes and unnecessary information. Quote photos have no public directory and require authorisation to view. We do not guarantee automatic detection or removal of information visible in photos.

Entry and key instructions are for the particular job, not for reviews, photos or marketing. Customers may update or delete saved address profiles in their accounts.

5. Retention

Contract data is retained during performance and for the period needed for legal obligations and claims. Tax and accounting records are kept for statutory periods; removing an order from view does not remove mandatory financial records.

Contact messages: up to 24 months unless part of a contract or dispute. Service logs and statistics: up to 180 days; notification jobs: 90 days; limits and verifications: their short validity windows. Evidence of accepted terms is retained with the order records.

Unsubmitted quote attachments are cleaned after 24 hours. Linked photos of completed or cancelled jobs follow configured retention, by default 180 days; active cases need review and evidence protection. Cleanup requires a working maintenance job. Cookie choices remain valid for up to 180 days.

6. Your rights

You may request access and copies, rectification, erasure, restriction and portability as provided by GDPR. Contact: contact@novacleanly.pl. Identity is verified only as necessary; not every erasure request covers legally required documents.

For legitimate-interest processing you may object on grounds relating to your situation; for direct marketing, at any time. Consent can be withdrawn as easily as it is given, without affecting earlier lawful processing. Change analytics choices using the permanent “Cookie settings” button. You may complain to the President of the Polish UODO.

7. Transfers, automation and cookies

Infrastructure and messenger providers may use resources outside the EEA. Before a transfer, an appropriate mechanism must be established, such as a valid adequacy decision or standard contractual clauses and necessary supplementary measures. Information on providers and copies of safeguards are available through the contact address; we do not claim that unverified agreements have been signed.

The calculator applies pricing and availability rules; cases needing assessment go to a person. We do not assess health or profile for automated decisions with effects under GDPR Article 22. Browser technologies and settings: /cookies.