Privacy policy

Data controller

The controller of your personal data is:

For privacy questions, requests concerning your rights or information about the way we process data, contact us by email or at the postal address above.

Data we process

We process only the data needed to communicate with you, handle your enquiry, operate the website securely and create basic statistics:

• data submitted through the form: name, email address, phone number, message, selected language and, optionally, company name; we also record the submission date and the version of the privacy policy that the user confirmed reading;
• the content of subsequent correspondence and information relating to sending and delivering email messages;
• security-related technical data, such as an IP address, request time, browser information and the result of the anti-bot verification;
• visit data: page, language, approximate device type, source category and — for visits from another website — its hostname only; the IP address is used momentarily to create a daily pseudonymous identifier but is not stored in the analytics tables;
• the selected website language and information indicating whether the welcome animation has already been displayed during the current session.

Purposes and legal bases

• responding to your enquiry, preparing a proposal and taking steps at your request before entering into a contract — Article 6(1)(b) GDPR;
• managing correspondence and enquiries and establishing, pursuing or defending legal claims — our legitimate interests under Article 6(1)(f) GDPR;
• protecting the form, website and infrastructure against bots, spam and abuse — our legitimate interests under Article 6(1)(f) GDPR;
• creating basic statistics, diagnosing website operation and improving its content — our legitimate interests under Article 6(1)(f) GDPR;
• complying with legal obligations where applicable — Article 6(1)(c) GDPR.

Selecting the checkbox next to the form confirms that you have read this policy. It is not consent used as the legal basis for processing your data.

Who may receive the data

Data is available only to people and organisations that need it to handle your enquiry or maintain secure infrastructure. These may include:

• hosting, server, database and technical support providers;
• email and SMTP delivery providers;
• Cloudflare, Inc., which provides Turnstile protection against automated submissions;
• authorised public authorities where disclosure is required by law.

Some providers may process data outside the European Economic Area. In such cases, transfers rely on a mechanism permitted by the GDPR, in particular an adequacy decision or standard contractual clauses.

How long we retain data

• we retain a contact enquiry and related correspondence for up to 24 months after the communication ends;
• we retain technical security and email delivery logs for up to 30 days;
• we retain individual visit details with a daily pseudonymous identifier for up to 30 days; after that, only aggregate results without a visitor identifier remain;
• we may retain selected data for longer where required by law or necessary to establish, pursue or defend legal claims, but no longer than the applicable limitation period.

Is providing the data mandatory?

Providing your name, email address, phone number, message and confirmation that you have read the policy is voluntary, but necessary to submit the form and handle your enquiry. Company name is optional. The form cannot be submitted without completing the anti-bot verification.

Your rights

Subject to the conditions set out in the GDPR, you may request:

• access to your data, a copy of it, correction or deletion;
• restriction of processing;
• the right to object to processing based on our legitimate interests;
• data portability where processing is automated and the relevant GDPR conditions are met.

To exercise your rights, email contact@puzzleups.com. We may request information needed to verify your identity where this is necessary to protect the data.

You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office: uodo.gov.pl.

Automated decisions and Turnstile

We do not use your data for marketing profiling or to make decisions that produce legal effects concerning you or similarly significantly affect you.

Cloudflare Turnstile automatically analyses technical browser and device signals to distinguish people from bots. Cloudflare does not receive the content of the form fields. The result determines only whether the form can technically be submitted.

Browser storage and similar technologies

The website uses necessary browser storage mechanisms to retain selected settings and maintain security:

• localStorage remembers the selected language until you remove the website data in your browser;
• sessionStorage records for the current session that the welcome animation has already been displayed;
• Cloudflare Turnstile uses technical signals and mechanisms necessary to protect the form against bots.

We do not use external analytics or advertising tools and do not store an identifier in your browser for visit statistics.

Visit statistics

We maintain our own basic statistics to understand which pages are visited, detect technical issues and improve content. We do not build profiles across days or track activity outside puzzleups.com.

We estimate the number of unique visitors on a given day using a non-reversible hash created from the date, IP address and broad browser and device categories. The hash changes every day and the IP address itself is not stored in the analytics tables.

We respect Do Not Track (DNT) and Global Privacy Control (GPC) signals. When your browser sends either signal, the visit is not recorded in the statistics.

Changes to this policy

We may update this policy when the website, our services or legal requirements change. The current version and its effective date are always published on this page.