Please review this privacy information. Your acknowledgement confirms only that you have seen it; it is not consent to processing, cookies, marketing or form activation.
Privacy policy
Information about personal data processed when using the CiasTech website and contacting us about our services.
Data controller and contact
The data controller is “CiasTech” Sebastian Ciasto, Osiedle 18/3, 33-132 Niedomice, Poland, Polish tax identification number (NIP): 9930614675. For matters concerning personal data, contact kontakt@ciastech.pl.
Personal data we process
The data depends on how you contact us and on your enquiry. For email correspondence or a telephone conversation, we process information you provide and information needed to handle the matter. The form asks for your name, email address, service area, subject and message as required fields, with company and phone number optional. It also contains a hidden anti-spam field; filling it causes the enquiry to be rejected.
Purposes and legal bases
We use personal data only as needed to handle enquiries and provide services. Depending on the matter, processing may be based on:
- taking steps before entering into a contract or performing a contract — Article 6(1)(b) GDPR;
- the controller’s legitimate interests in responding, handling correspondence, protecting the website and establishing, exercising or defending legal claims — Article 6(1)(f) GDPR;
- compliance with a legal obligation, including record-keeping duties if they arise — Article 6(1)(c) GDPR.
Whether you must provide data
Providing data in correspondence is voluntary, but may be necessary for us to respond or take steps towards a contract. In the form, required fields are marked with an asterisk: name, email address, service area, subject and message. Without them, the enquiry cannot be submitted. Company and phone number are optional. We do not use data for newsletters, advertising profiling or marketing forms.
Recipients and service providers
Data may be accessed by people authorised by the controller and by providers needed to operate the website and handle correspondence. Website and API hosting is provided through SEOHOST SH1 under data processing agreement SH-RODO/334/2026 dated 1 November 2026. Annex 3 lists the following subprocessors: DATASPACE P.S.A., EXEA S.A., OVH Sp. z o.o., Quality Unit s.r.o. and Monarx, Inc. Listing these providers does not mean that each receives all data. SEOHOST has stated that an update to the data processing agreement annex is being prepared. Data processed by Monarx, Inc. may be transferred outside the European Economic Area, including to the United States; according to SEOHOST, these transfers rely on standard contractual clauses (SCCs) under Article 46(2)(c) GDPR. This does not mean that all data is transferred to the United States. Messages submitted through the active form are sent through Microsoft Graph from the Form.Send@ciastech.pl mailbox to kontakt@ciastech.pl; a copy is saved in Sent Items.
Technical data, logs and security
When you connect to the website, the server and hosting provider may process your IP address and technical request information needed to deliver the site and protect against abuse. SEOHOST hosting logs are available for the preceding 30 days and are then replaced by newer logs; this availability period is not a deadline for deleting data from all systems and backups. Monarx security scanning may cover Node.js application files, including configuration files and logs in protected directories. Standard analysis primarily covers file metadata. If security mechanisms consider it necessary, the full contents of a specific file may be provided for in-depth analysis; if it contains personal data, that data may also be processed. Scanning does not mean that every form message is automatically sent to Monarx.
Microsoft 365 email and message storage
We use Microsoft 365 to handle email correspondence. When the form is active, a message is sent through Microsoft Graph from the Form.Send@ciastech.pl mailbox to kontakt@ciastech.pl, and a copy is saved in that mailbox’s Sent Items. Enquiries are not stored in a separate website database. Microsoft 365 messages are subject to mailbox settings and retention policies; the retention period depends on those settings. Microsoft may process data under the service terms applicable to the tenant in use.
Retention period
Correspondence is kept for as long as needed to handle the enquiry and agreed follow-up. After the matter is closed, it may be retained where necessary to establish, exercise or defend legal claims or comply with a legal obligation; the period depends on the matter and applicable legal time limits. Microsoft 365 messages are kept according to mailbox settings and retention policies. SEOHOST deletes the latest backups no later than six months after the data processing agreement ends. This period applies only to the latest backups after termination and does not specify retention of current data, logs or messages.
Your data protection rights
Subject to the conditions in the GDPR, you may request access to your data, rectification, erasure or restriction of processing, and object to processing based on legitimate interests. The right to data portability applies in the cases set out in the GDPR where processing is automated and based on consent or a contract. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. Send requests to kontakt@ciastech.pl. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland.
Browser storage and profiling
After you acknowledge this information, the browser stores only the privacy policy version identifier in localStorage. The entry applies across this website’s pages in the same browser profile; the notice appears again if the entry is missing, the policy version changes, or you remove the entry or the website data in your browser settings. Deleting cookies alone may not remove the localStorage entry. If localStorage is unavailable, the acknowledgement cannot be retained and the notice may appear again. The localStorage entry is not a cookie, is not used to identify you, and is not consent to data processing. The website does not run a newsletter, advertising profiling or automated decision-making that produces legal or similarly significant effects.
