Privacy Policy

Last updated: 8 October 2026

This Privacy Policy explains how personal data is processed when you use the Gamrot Design website, contact Gamrot Design or submit an enquiry, including through a form on Facebook or Instagram.

1. Data controller

The controller is Maciej Gamrot, operating an unregistered business under the brand Gamrot Design, with a contact address at ul. Ogrodowa 4, 32-340 Wolbrom, Poland.

For questions about your personal data, contact maciej@gamrot.design.

2. Data we process

Depending on how you contact us, we may process:

• your name;
• email address;
• telephone number;
• business or venue name;
• website or social profile address;
• information about your existing website and business needs;
• your message and subsequent correspondence;
• for quote requests: the website type, extras and estimated price chosen in the calculator, and the page and language the form was sent from;
• after analytics consent: cookie identifiers, pages visited, language, device/browser category, website interactions, visit source and campaign labels;
• basic technical server logs, such as IP address, connection date/time and device/browser type.

3. Purposes and legal bases

We process personal data for:

1. Handling an enquiry, preparing a proposal or quote, and discussing possible cooperation — Article 6(1)(b) GDPR, taking steps at your request before entering into a contract.
2. Answering messages and corresponding, where contact does not directly lead to a contract — Article 6(1)(f) GDPR, our legitimate interest in handling enquiries and providing a response or offer.
3. Entering into and performing a contract — Article 6(1)(b) GDPR.
4. Meeting legal, tax and accounting obligations — Article 6(1)(c) GDPR.
5. Establishing, exercising or defending legal claims — Article 6(1)(f) GDPR.
6. Keeping the website secure and functioning correctly, including technical logs — Article 6(1)(f) GDPR.
7. Understanding website use and the effectiveness of traffic sources — your consent under Article 6(1)(a) GDPR. This covers Google Analytics 4 and campaign context described in section 11.

We do not use enquiry details to send newsletters or unrelated marketing without a separate lawful basis.

4. Facebook and Instagram forms

Advertising enquiry forms may be made available through Facebook or Instagram, provided by Meta Platforms Ireland Limited.

Meta processes its users’ data under its own rules and may prefill forms from account details. See the Meta Privacy Policy.

Once submitted, the form details are provided to the controller and processed under this policy.

5. Recipients

Data may be shared with providers needed to operate the site, handle correspondence or carry out our cooperation, including:

• hosting, email and IT providers, including AtMyApp and the Cloudflare infrastructure used by hosting;
• Google Ireland Limited and entities providing Google Analytics, if you consent to analytics;
• Meta Platforms Ireland Limited, if you submit through Facebook or Instagram;
• accounting, legal or administrative providers where necessary;
• authorised public bodies where disclosure is required by law.

Providers acting for the controller receive access only as needed for their tasks.

6. Transfers outside the European Economic Area

Technology providers, particularly Google, Cloudflare and Meta, may process data outside the EEA. Where such transfers occur, they use mechanisms provided for by the GDPR, such as an applicable European Commission adequacy decision or standard contractual clauses.

7. Retention

• Enquiry and proposal/quote data is retained while handling your request and then for up to 12 months after the last contact, unless an effective objection or erasure request is made earlier.
• If we enter into a contract, data is retained for its performance and then for legally required tax/accounting periods and applicable limitation periods for claims.
• Technical logs are kept as necessary for security and troubleshooting, generally no longer than 30 days, unless needed longer to investigate a security incident.
• User-level and event-level Google Analytics data is retained for 2 months, without resetting that period on new activity. This setting does not cover standard aggregated reports, which may remain available longer. Browser storage periods are described in section 11.

Meta may retain data in its systems according to its own rules and service settings.

Website forms marked as previews do not send or save the contact details entered. With consent, analytics may measure the interaction with a preview itself.

8. Your rights

Subject to the GDPR, you may request:

• access to and a copy of your data;
• rectification;
• erasure;
• restriction of processing;
• data portability;
• objection to processing based on our legitimate interests;
• withdrawal of consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise your rights, email maciej@gamrot.design.

You may also complain to the President of the Polish Personal Data Protection Office (UODO) if you believe processing is unlawful. See uodo.gov.pl.

9. Providing data is voluntary

Providing personal data is voluntary. Fields marked as required are needed to handle the enquiry, prepare a proposal and contact you. Without them, we may be unable to handle the request. Analytics consent is optional and does not determine whether you can use the site or contact us.

10. Automated decisions

Gamrot Design does not use your data for solely automated decisions producing legal effects or for profiling.

11. Cookies, analytics and visit sources

You choose. We load Google Analytics 4 only after you select “Allow analytics”. Before that, we do not load the Google tag or send analytics data to Google. “Necessary only” keeps analytics off. In either case, you can use the website, calculator and available contact methods.

Change your choice using “Privacy settings” in the footer. Withdrawal stops further analytics and removes the GA4 cookies accessible to the site and stored campaign context. The page may reload, which can discard unsent form entries. Withdrawal does not automatically erase information previously sent to Google; contact the controller about your data rights.

What we measure

Google Analytics 4 helps us understand which pages and traffic sources lead to interest in our services. We measure page/section views, industry choices, CTA clicks, calculator changes, form opens/starts and categories of errors. A preview submission is not counted as a received enquiry. Once real submission is available, confirmed receipt of an enquiry may be measured as an event.

Events may include language, industry, form type, selected package and estimated net price. We do not send your name, email, phone number, message or other typed content to Google. We do not record sessions or enable personalised advertising or Google Signals. Analytics data is associated with browser identifiers, so we do not describe it as completely anonymous.

Google also receives technical data needed to handle the connection and provide analytics. See how Google uses information from partner sites and Google’s data processing terms.

How we identify a visit’s source

Links to this website may contain UTM labels identifying source, channel, campaign and a post or ad. Google Ads links may include Google click identifiers. After analytics consent, allowed labels are passed to analytics. Separately, UTM labels, the landing page and referring domain may be stored for the current browser session so that changing pages or languages does not lose the visit context. When enquiry submission is enabled, that context may accompany an enquiry to help assess contact sources. We do not store the full URL or arbitrary query parameters for this purpose.

If you decline, we do not create analytics storage or campaign context. Not every visit or enquiry can be attributed to a source.

Browser storage

• Privacy choice: “gamrot:consent:v1” in local storage contains your choice and its expiry, without a user identifier. It is valid for 180 days, after which we ask again.
• Google Analytics cookies: “_ga” and “_ga_6H6WFKG8QR”, only after consent. We configure a lifetime of up to 180 days, without automatic renewal by the website configuration. They distinguish browsers and sessions.
• Campaign context: “gamrot:attribution:v1” in session storage, only after consent. It expires after 30 minutes without measured activity, checked when reused; session storage is generally associated with the current browser tab. We also remove it on withdrawal.

Browser settings may limit storage or its lifetime. If privacy-choice storage is blocked, your choice may last only on the current page. The website does not use Meta Pixel. Facebook and Instagram may use their own cookies under Meta’s rules when you use those platforms.

12. Changes to this policy

This policy may change when our processing, tools or applicable rules change. The current version will be published here with its update date.

Short notice for a Meta form

The controller is Maciej Gamrot, operating an unregistered business under Gamrot Design. Form details are used to handle your enquiry, prepare a proposal or quote and discuss possible cooperation. Providing data is voluntary but necessary to handle the request. The Privacy Policy linked from the form explains processing and your rights.