Privacy policy

1. Who is responsible for your data

The controller is Krystian Pelczarski, operating the sole proprietorship Meble kuchenne z pasją Krystian Pelczarski, ul. Berlińska 40, 58‑500 Jelenia Góra, Poland, NIP (Polish tax ID) 6112515161. Contact: info@kuchniezpasja.pl or +48 604 923 443.

2. What we use your data for

We use contact details, correspondence, attachments and order information to answer enquiries, prepare quotes and arrange services. The legal basis is Article 6(1)⁠(b) GDPR. Required form fields are needed to answer your enquiry, and other details are optional.

Technical data, including your IP address and browser information, help operate and protect the website. Security and the organisation of customer service are based on our legitimate interests (Article 6(1)⁠(f) GDPR). Cloudflare Turnstile protects the contact form.

We protect employee sign-ins with attempt counters linked to hashes of the IP address and the supplied email address. We delete these entries on the next sign‑in attempt once 30 minutes have passed since the start of the rate-limit window.

3. Browser settings, maps and ad measurement

We do not use analytics tools. We remember your language and privacy choices so the website works according to your preferences. The language cookie expires after one year, and you can delete locally saved settings in your browser.

Google Maps loads only with your consent (Article 6(1)⁠(a) GDPR). Google may then receive technical data and the identifier of a signed‑in account. You can withdraw consent through “Manage consent” in the footer. Facebook, Instagram and WhatsApp links lead to services covered by their providers’ own policies.

If you consent to ad measurement, we load the Google Ads conversion tag (Google Ireland Limited). Google then stores cookies such as _gcl_au and _gcl_aw and learns that, after a click on our ad, the contact form was sent or the phone number was clicked, together with technical data such as the IP address, browser data and the ad click identifier.

We do not pass the form content or your contact details to Google. We do not use remarketing or ad personalisation. The measurement shows us which ads lead to enquiries. The legal basis is your consent (Article 6(1)⁠(a) GDPR).

Google also processes this data as an independent controller under its own privacy policy. You can withdraw consent through “Manage consent” in the footer, and we then delete the measurement cookies on our domain.

4. Who receives data

New enquiries are copied to the configured mailboxes of our service team. If you write to a specific employee’s email address, or an employee already handles your enquiries, your message goes only to that employee.

Once a case is assigned, subsequent messages and attachments are forwarded to the assigned employee’s mailboxes. If that employee has turned copies off or no longer works with us, the other employees receive the copy. Authorised staff retain access to the conversation history in the internal panel. Reassignment changes the recipient of future messages.

Administrators manage staff mailboxes. Copies are processed by the providers of these mailboxes.

When we schedule an appointment with you (a consultation, measurement, delivery or installation), the assigned employee may receive an email reminder in their mailbox. It contains the appointment details and your name, contact details, location and the notes needed to carry it out. Reminders are sent via Resend and processed by the providers of the staff mailboxes.

Data is available to designated employees and our service providers: Cloudflare (website, security and data storage), Resend (email and attachments), Google (maps, ad measurement with consent and staff Gmail inboxes) and AI service providers (email protection and correspondence translation).

The AI spam filter checks the sender and reply‑to address, the subject, the message text and the file types of any attachments, but not the files themselves. It runs under zero data retention (ZDR): the AI provider does not store the checked content or use it to train models. ZDR does not cover technical or billing metadata.

Messages the filter clearly classifies as spam or fraud are discarded and not stored in our service system. Messages with a very long body (more than 20,000 characters, or correspondingly fewer in non-Latin scripts) are discarded without analysis, so please send longer documents as an attachment. If you receive no reply, you can also reach us by phone or through the contact form.

If the filter is unavailable, we handle the message without that analysis so no correspondence is lost.

At the request of one of our employees, an AI tool also translates the subject and text of a message or reply draft, under the same ZDR conditions and without attachments. This supports correspondence handling, and an employee reviews the translation before sending. Translation previews are not saved separately in our database.

Providers may process data outside the EEA, including in the United States. Transfers are subject to appropriate safeguards, such as standard contractual clauses or the EU‑US Data Privacy Framework, where applicable. Contact us for information about these safeguards.

5. How long we keep data

• Enquiries and correspondence in our service system: normally 730 days from creation of the case.
• Appointment records: no automatic deletion. We delete entries manually when they are no longer needed for work planning or the protection of legal claims.
• Mailbox copies and appointment reminders: up to 24 months after the last contact. Email data at Resend: normally 30 days.
• Technical Cloudflare logs: up to 7 days. Browser privacy settings: until changed or deleted.
• Google Ads measurement cookies: up to 90 days or until consent is withdrawn.

After deleting a case, we retain only content-free technical message identifiers for as long as re‑import from the email service remains possible. They prevent deleted correspondence from being recreated and contain no names, addresses or message text.

Legal obligations or the protection of legal claims may require longer retention.

6. Your rights

Subject to the GDPR, you can request access, correction, erasure, restriction and portability of your data. You can object to processing based on legitimate interests and withdraw consent for future processing. Contact us and we will normally respond within one month.

You can lodge a complaint with the competent Polish supervisory authority, the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00‑193 Warsaw, Poland), or with the supervisory authority in your EU country of residence (Article 77 GDPR). We do not use profiling or automated decisions that produce legal or similarly significant effects on individuals.