Privacy Policy
Website: https://gesbudownictwo.pl/
Last updated: 29 July 2026
This Privacy Policy sets out the rules governing the processing and protection of Users’ personal data in connection with their use of the gesbudownictwo.pl website, hereinafter referred to as the “Website”, as well as the rules governing the use of cookies and other tracking technologies.
1. Personal Data Controller
The controller of personal data collected through the Website is:
GES BUDOWNICTWO SŁAWOMIR GAPPA ul. Srebrna 11 05-120 Legionowo Tax Identification Number (NIP): 876-164-73-63 Email: biuro@gesbudownictwo.pl Tel.: (+48) 603 512 890 ul. Srebrna 11, 05-120 Legionowo NIP: 876-164-73-63 e-mail: biuro@gesbudownictwo.pl tel.: (+48) 603 512 890
hereinafter referred to as the “Controller”.
For all matters relating to the protection of personal data, the Controller may be contacted using the email address or telephone number provided above.
2. Legal Grounds for Data Processing
Personal data is processed in accordance with:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, the General Data Protection Regulation (GDPR);
- the Polish Personal Data Protection Act of 10 May 2018;
- the Polish Act of 18 July 2002 on the Provision of Electronic Services;
- the Polish Telecommunications Law Act of 16 July 2004, with regard to cookies.
3. Data Collected and the Purposes of Processing
3.1. Contact Form
When the contact form on the Website is used, the following data is collected:
- first name and surname;
- email address;
- telephone number, where provided;
- the content of the message and any other data voluntarily included in the enquiry.
Purpose of processing: responding to an enquiry, presenting an offer, establishing business contact and, where applicable, entering into and performing a contract.
Legal basis:
- Article 6(1)(b) GDPR – taking steps prior to entering into a contract or performing a contract;
- Article 6(1)(f) GDPR – the Controller’s legitimate interest in managing correspondence and developing business relationships;
- Article 6(1)(a) GDPR – consent, in relation to data voluntarily provided beyond the minimum information required.
Retention period: until the correspondence has been concluded and the enquiry has been dealt with, and subsequently for the period necessary for archiving purposes and for the establishment, exercise or defence of potential claims, for a maximum of six years in accordance with the applicable limitation periods, or until an effective objection is raised or consent is withdrawn.
3.2. Telephone and Email Contact
Where a User contacts the Controller by telephone or email outside the contact form, the personal data voluntarily provided by the User, including their first name, surname, contact details and the content of the correspondence, is processed for the purpose of handling the enquiry.
Legal basis: Article 6(1)(b) and (f) GDPR.
3.3. Data Collected Automatically - Server Logs
When the Website is used, certain technical data is collected automatically, including:
- IP address;
- browser type and version;
- operating system;
- date and time of the visit;
- referring page URL;
- approximate location based on the IP address.
This data is recorded in the server logs maintained by the Website’s hosting provider and is used for technical purposes, including ensuring the correct operation of the Website, for statistical purposes, and for detecting misuse and maintaining security.
Legal basis: Legal basis: Article 6(1)(f) GDPR – the Controller’s legitimate interest in maintaining the security and operation of its IT infrastructure.
4. Cookies and Tracking Technologies
The Website uses cookies and similar technologies to ensure its proper operation, analyse traffic and compile statistics.
4.1. Consent Management — CookieYes
Strona korzysta z narzędzia CookieYes The Website uses CookieYes, provided by Cookie Yes Ltd., to manage consent for the use of cookies. On their first visit, the User is shown a banner allowing them to consent to or reject individual categories of cookies, including analytical and functional cookies. Consent may be changed or withdrawn at any time using the settings available on the Website, for example through the “Cookie Settings” link or button in the footer.
CookieYes stores information about the consent granted or refused in a cookie on the User’s device. This enables the Controller to comply with the obligation to demonstrate consent under Article 7(1) GDPR.
4.2. Categories of Cookies Used
| Category | Purpose | Example providers | Consent required |
|---|---|---|---|
| Essential | Core operation of the Website and storage of consent preferences | CookieYes | No |
| Analityczne/statystyczne | Analysis of Website traffic and User behaviour | Google Analytics (GA4) | Yes |
| Functional | Embedded third-party content, such as a map | Google Maps | Yes, depending on the settings |
| Security | Protection of the contact form against bots and spam | Google reCAPTCHA | Usually technically necessary |
A detailed and up-to-date list of cookies, including their names, purposes and retention periods, is available in the CookieYes banner or cookie settings panel on the Website.
4.3. Changing Cookie Settings
The User may change their cookie settings at any time through:
- the CookieYes settings panel available on the Website;
- their web browser settings, which may allow cookies to be blocked or deleted.
Restricting the use of cookies may affect certain features of the Website.
5. Analytics Tools and Other Third-Party Services
5.1. Google Analytics 4 (GA4)
The Website uses Google Analytics 4, provided by Google Ireland Limited, to analyse Website traffic, including visit statistics, traffic sources, User behaviour and devices. Data is collected in anonymised or aggregated form, and Google Analytics may use cookies for this purpose.
The tool is activated only after the User has provided the appropriate consent through the CookieYes banner.
Further information: Google Privacy Policy
5.2. Google Search Console (GSC)
Google Search Console is a tool used by the Controller to monitor the Website’s visibility in Google search results, the indexing of individual pages and the detection of technical errors. The tool does not collect Users’ personal data directly from the Website and does not place its own cookies on visitors’ devices. It uses aggregated data held by Google relating to search queries and search results.
5.3. Google Maps
A Google Map showing the location of the Controller’s registered office is embedded on the “Contact” page. Loading the map establishes a connection with Google’s servers and may involve the transfer of data, such as the User’s IP address, to Google Ireland Limited and the placement of cookies by Google.
Further information: Google Privacy Policy
5.4. Google reCAPTCHA
To protect the contact form against spam and automated submissions by bots, the Website may use Google reCAPTCHA, provided by Google Ireland Limited. This service analyses User behaviour, including mouse movements and interactions with the Website, to distinguish humans from bots. It may use cookies and transfer data, including the User’s IP address, to Google.
The use of reCAPTCHA is based on the Controller’s legitimate interest under Article 6(1)(f) GDPR in protecting the contact form against misuse.
Więcej informacji: Polityka prywatności Google oraz Warunki korzystania z usługi reCAPTCHA
5.5. Google Fonts
The Website may use Google Fonts. Depending on the configuration, fonts may be loaded locally from the Website’s server, without transferring data to Google, or directly from Google’s servers, which may involve the transfer of the User’s IP address to Google Ireland Limited. The Controller aims to use fonts in a manner that minimises the transfer of data to third parties.
5.6. Hosting
The Website is hosted on servers provided by:
Kru.pl Sp. z o.o. ul. E. Radzikowskiego 3 31-305 Kraków Email: bok@kru.pl Website: https://kru.pl/ ul. E. Radzikowskiego 3, 31-305 Kraków e-mail: bok@kru.pl www: https://kru.pl/
As part of its hosting services, Kru.pl Sp. z o.o., a member of the ITH Group, processes data contained in server logs, as described in Section 3.3, including the IP addresses of Website visitors. This processing is carried out under a data processing agreement concluded with the Controller in accordance with Article 28 GDPR. The servers used to host the Website are located in Poland, in Kraków and Warsaw. Consequently, this data is not transferred outside the European Economic Area as part of the hosting service.
6. Recipients of Personal Data
Users’ personal data may be disclosed to the following categories of recipients:
- the hosting service provider, Kru.pl Sp. z o.o., a member of the ITH Group, ul. E. Radzikowskiego 3, 31-305 Kraków;
- Google Ireland Limited in connection with Google Analytics 4, Google Search Console, Google Maps, Google reCAPTCHA and Google Fonts;
- Cookie Yes Ltd. for cookie consent management;
- the email service provider used to manage correspondence;
- entities providing accounting, legal or IT services to the Controller, solely to the extent necessary for the provision of those services;
- public authorities where required by law.
The Controller does not sell personal data to third parties.
7. Transfers of Data Outside the European Economic Area
The use of tools such as Google Analytics, Google Maps, Google reCAPTCHA and Google Fonts may involve the transfer of data to countries outside the European Economic Area, including the United States, where companies belonging to the Google group operate servers. Such transfers are carried out using mechanisms designed to ensure an adequate level of data protection, particularly the Standard Contractual Clauses approved by the European Commission and, in the case of Google LLC, certification under the EU–US Data Privacy Framework. EU-U.S. Data Privacy Framework (w przypadku Google LLC).
8. Data Retention Period
Personal data is retained for:
- the period necessary to fulfil the purpose for which it was collected, such as responding to an enquiry or performing a contract;
- the period required by law, including tax and accounting regulations applicable to data relating to contracts and invoices;
- the applicable limitation period for potential claims;
- until consent is withdrawn, where data is processed on the basis of consent, including analytical cookies.
Data collected through analytical tools such as Google Analytics 4 is retained in accordance with the retention settings configured by the Controller in the Google Analytics administration panel.
9. Users’ Rights
Each data subject has the right to:
- access their personal data under Article 15 GDPR;
- rectify their personal data under Article 16 GDPR;
- have their personal data erased, also known as the “right to be forgotten”, under Article 17 GDPR;
- restrict the processing of their personal data under Article 18 GDPR;
- data portability under Article 20 GDPR;
- object to processing based on the Controller’s legitimate interests, including profiling, under Article 21 GDPR;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal, under Article 7(3) GDPR;
- lodge a complaint with the supervisory authority, the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, where they believe that the processing of their personal data infringes the GDPR.
These rights may be exercised by contacting the Controller at: biuro@gesbudownictwo.pl.
10. Voluntary Provision of Personal Data
The provision of personal data is voluntary. However, where the contact form is used, the provision of personal data is necessary for the Controller to respond to the enquiry. Failure to provide the required data may result in the Controller being unable to respond or process the request.
11. Automated Decision-Making and Profiling
The Controller does not make decisions concerning Users based solely on automated processing, including profiling, that produce legal effects concerning them or similarly significantly affect them.
12. Security of Personal Data
The Controller implements appropriate technical and organisational measures to protect the personal data being processed against unauthorised disclosure, loss, destruction or unauthorised alteration, including:
- an encrypted SSL/TLS connection on the Website;
- restricted access to personal data, limited to authorised persons;
- regular software and security updates.
13. Amendments to the Privacy Policy
The Controller reserves the right to amend this Privacy Policy, particularly in response to changes in applicable law, the functionality of the Website or the tools used. The current version of the Privacy Policy, together with the date of its latest update, will always be available on the Website.
14. Contact
For matters relating to personal data protection or this Privacy Policy, please contact:
GES Budownictwo Sławomir Gappa ul. Srebrna 11 05-120 Legionowo Email: biuro@gesbudownictwo.pl Tel.: (+48) 603 512 890