1. Who runs this site
The service provider and the controller of your personal data within the meaning of Article 4(7) GDPR is:
Łukasz Paluch
Sole proprietorship registered in Poland (CEIDG), trading as Gemba Buddy and GAO Experts
Wandy 2B
41-407 Imielin, Poland
Tax identification number (NIP): 6462639596
No separate KRS number — sole proprietorships are not entered in that register
info@gembabuddy.com
There is no data protection officer. One is required only in the cases listed in Article 37(1) GDPR — large-scale systematic monitoring, or large-scale processing of special-category data — and none of them applies here. Write to the address above with any question about your data; it reaches a person, not a ticket queue.
2. What we collect
Two things, and nothing else.
What you send us. The contact form asks for your message, your email address, and optionally your name. Nothing on the form is hidden. If you write to us by email instead, we hold whatever your email contains.
What the server records. Like every web server, ours writes an access log: IP address, time, the page requested, browser and operating system version. When you submit the contact form, your IP address is also held for one hour in the memory of the sending service, so that the same connection cannot flood our inbox.
Providing your data is voluntary. Without a message and an email address we cannot reply, but nothing on this site requires you to identify yourself in order to read it.
3. Why, and on what legal basis
To answer you
Article 6(1)(b) GDPR where your message concerns a trial, a demo or an offer — these are steps taken at your request before a contract. Otherwise Article 6(1)(f): our legitimate interest in replying to people who write to us.
Your consent to be emailed
Article 6(1)(a) GDPR, given by ticking the box on the form. You may withdraw it at any time; that does not affect the lawfulness of anything done before you withdrew it.
Keeping the site up
Article 6(1)(f) GDPR. Server logs and the submission limit exist to keep the site available and to stop abuse of the form. That is our legitimate interest, and it is hard to run a public website without them.
Your data is not used for marketing unless you ask us for it, is never sold or exchanged, and is not used to build a profile. No decision affecting you is made automatically.
4. Who else sees it
Only companies that provide the technical infrastructure, each bound by a data processing agreement and acting solely on our instructions:
Hostinger International Ltd., 61 Lordou Vironos, 6023 Larnaca, Cyprus — the virtual server the site runs on. Its data processing addendum is part of the terms of service and allows Hostinger to use infrastructure sub-processors, some of them outside the EEA.
cyber_Folks S.A., ul. Wierzbięcice 1B, 61-569 Poznań, Poland, operating the Zenbox service — the mail server that delivers form submissions to our inbox and holds our mailbox. Your message stays in Poland.
The only route by which anything could leave the European Economic Area is Hostinger's own infrastructure sub-processors; those transfers are covered by the European Commission's Standard Contractual Clauses under Article 46 GDPR. Nothing is sent to a third country by us. Fonts are served from our own server, so no outside party learns that you visited. We may also have to disclose data to public authorities where the law requires it.
5. How long we keep it
Your message. It lives in our mailbox for as long as the matter is open, and afterwards for as long as we may need it to defend or pursue a claim — in Poland, generally up to six years. If nothing comes of the conversation, we delete it sooner.
The submission limit. Your IP address is dropped from memory one hour after you send the form, and immediately if the service restarts.
Server logs. These rotate by size rather than by age — three files of 10 MB each, oldest deleted first. We cannot honestly promise a number of days: a quiet month keeps them longer than a busy one. Nothing in the logs is read or analysed unless we are chasing a fault or an attack.
6. Cookies, analytics and tracking
This site sets no cookies
Nothing is written to your browser's storage, no analytics tool runs here, there are no advertising or social media scripts, and no pixels. That is why you are not being asked to accept anything. If we ever add analytics, this section will change and you will be asked for consent first — the tool will not run until you give it.
The typefaces are loaded from our own server rather than from Google Fonts. Loading a font from someone else's server would send them your IP address, and we would rather it did not.
7. Your rights
Under the GDPR you may ask us to:
tell you what data about you we hold, and give you a copy (Art. 15);
correct it if it is wrong, or complete it if it is missing something (Art. 16);
delete it (Art. 17);
restrict what we do with it while a dispute is resolved (Art. 18);
hand it over in a machine-readable format, or send it to someone else (Art. 20);
stop processing it where we rely on legitimate interest — you may object at any time (Art. 21);
honour your withdrawal of consent, with effect from the moment you withdraw it (Art. 7(3)).
One email to info@gembabuddy.com is enough. We answer within one month, as Article 12(3) requires; if a request is complicated we may extend that by two months and will tell you why.
8. If you think we got it wrong
You can complain to a supervisory authority. Ours is:
Prezes Urzędu Ochrony Danych Osobowych
ul. Stawki 2, 00-193 Warszawa, Poland
uodo.gov.pl
You may also complain to the authority in the country where you live or work — in Germany, the data protection authority of your federal state. We would rather you wrote to us first, but it is your call.
9. Changes to this policy
If what we do with data changes, this page changes with it, and the version number and date at the top move too. There is no mailing list to notify, because we do not keep one. The version in force is always the one published here.
