Privacy and Cookie Policy

Last updated: July 29, 2026

1. General Information

This Privacy Policy explains how we process the personal data of users of the website available at https://skalisty.pl, including data submitted via the contact form and the recruitment form.

We process personal data in accordance with applicable laws, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, hereinafter referred to as “GDPR,” and the Act of July 12, 2024—Electronic Communications Law.

2. Personal Data Controller

The controller of personal data is:

Skalisty Group sp. z o.o., ul. Strachowicka 48A, 54-512 Wrocław, Poland, KRS: 0001132355, NIP: 8943246204, REGON: 529907012

Contact the controller:

The controller has not appointed a data protection officer. For all matters regarding the processing of personal data and the exercise of rights under the GDPR, you may contact the controller directly.

3. What data do we process?

Depending on how you use the website, we may process:

  • first and last name;

  • email address;

  • phone number;

  • company name and website address;

  • information contained in a message or request for a quote;

  • information regarding the planned project;

  • address details and information about country of residence;

  • information about professional experience, qualifications, and preferred position;

  • information regarding the possibility of working as a subcontractor;

  • information contained in your resume, portfolio, and other submitted documents;

  • IP address, browser type, operating system, and device information;

  • information about the pages visited and how the website is used;

  • cookie settings.

Please do not include any information in your messages, resumes, or attachments that is not necessary for processing your inquiry or the recruitment process.

4. Contact Form and Inquiries

We process data provided via the contact form, email, or phone for the following purposes:

  • respond to your message;

  • maintaining correspondence;

  • discuss a planned investment;

  • prepare information, consultations, or an offer;

  • take steps prior to entering into a contract;

  • establishing, pursuing, or defending against claims.

The legal basis for processing is:

  • Article 6(1)(b) of the GDPR—taking action at the request of an individual prior to entering into a contract or performing a contract;

  • Article 6(1)(f) of the GDPR—the controller’s legitimate interest in communicating with data subjects, handling inquiries, and protecting against claims;

  • Article 6(1)(c) of the GDPR—if the retention of specific data is required by applicable law.

Providing data is voluntary, but data marked as required is necessary to submit the form and receive a response.

If the contact does not result in the conclusion of a contract, we retain the data for no longer than 12 months from the end of the correspondence, unless longer retention is justified by the need to assert or defend against claims.

5. Recruitment

We process the data provided via the recruitment form for the following purposes:

  • evaluating the candidate’s application;

  • contacting you regarding the recruitment process;

  • verifying experience, qualifications, and portfolio;

  • selecting candidates;

  • take steps toward entering into an employment contract, a civil law contract, or a B2B partnership;

  • conducting future recruitment processes, provided the candidate gives separate consent.

The legal basis for processing data required by labor law is Article 6(1)(c) of the GDPR. We process data necessary to take steps prior to entering into a contract on the basis of Article 6(1)(b) of the GDPR.

We process additional information voluntarily provided by the candidate—including data contained in a portfolio or documents that go beyond the scope required by law—on the basis of consent, in accordance with Article 6(1)(a) of the GDPR.

Health data or other special categories of data may be processed only if the candidate has provided them on their own initiative and given explicit consent, in accordance with Article 9(2)(a) of the GDPR, or if their processing is required by law.

We delete data used exclusively for the current recruitment process upon its completion, taking into account the period necessary to protect against potential claims. If a candidate consents to participate in future recruitment processes, we may retain their data for up to 36 months from the date of receipt of the application.

Consent to participate in future recruitment processes may be withdrawn at any time by writing to [email protected]. Withdrawal of consent does not affect the lawfulness of prior processing.

Recruitment applications remain with Skalisty Group sp. z o.o. and are not shared with partners, investors, or other employers.

6. Conclusion and Performance of a Contract

If an inquiry leads to the conclusion of a contract, we process data for the purpose of:

  • preparing and entering into the contract;

  • carrying out the project;

  • handling billing and documentation;

  • communicating with the client or the client’s representatives;

  • fulfilling tax and accounting obligations;

  • establishing, pursuing, or defending against claims.

The legal basis for processing is Article 6(1)(b), (c), or (f) of the GDPR, depending on the type of data and the purpose of its use.

We retain contract-related data for the duration of the contract and thereafter until the statute of limitations for claims expires. We retain tax and accounting records for the period required by law.

7. Hosting, Server Logs, and Security

The website is hosted on servers provided by dhosting.pl Sp. z o.o. The hosting provider may process technical data necessary for the proper and secure operation of the website.

While using the website, logs may be automatically recorded that include, among other things:

  • IP address;

  • date and time of the connection;

  • the address of the requested resource;

  • information about the browser, operating system, and device;

  • information about any errors that occur.

We use this data to administer the website, diagnose problems, protect against abuse, and ensure security. The legal basis is Article 6(1)(f) of the GDPR, i.e., our legitimate interest.

We generally retain technical logs for no longer than 90 days, unless a detected security incident justifies retaining them for a longer period.

8. Google Analytics

With the user’s consent, we use Google Analytics, which helps us analyze how the website is used, the popularity of content, traffic sources, and basic technical information about users’ devices.

Google Analytics may use cookies and similar technologies. Analytical data is processed only after consent to analytical cookies has been given. The legal basis for processing is Article 6(1)(a) of the GDPR.

You may refuse to give consent or withdraw it at any time using the cookie settings available on the website.

The service provider is Google Ireland Limited. In connection with the use of Google services, data may also be processed by entities belonging to the Google group outside the European Economic Area. The transfer is carried out based on mechanisms provided for by the GDPR, such as adequacy decisions or standard contractual clauses.

For more information, see Google’s Privacy Policy.

9. Cloudflare Turnstile

The forms on the website (including the contact form, comments, newsletter sign-up, and chat assistant) are secured using the Cloudflare Turnstile service. The tool runs in the background and detects whether a human is using the form, protecting the site from spam, automated submissions, and other abuses—without requiring the user to complete any tasks.

For this purpose, the following data, among others, may be processed: IP address, browser and device information (including the User-Agent header and the technical TLS connection fingerprint), the website key along with its address, and technical data related to the user’s interaction with the site. The service provider states that it does not directly identify individuals based on these signals.

The legal basis for the processing is Article 6(1)(f) of the GDPR—the controller’s legitimate interest in protecting the forms and the website from abuse.

The service provider is Cloudflare, Inc. The service operates in the background, without displaying a verification window. The data processing policies for this service are described at Turnstile Privacy Addendum, which supplements Cloudflare’s Privacy Policy.

10. Cloudflare

We use Cloudflare to enhance the security, availability, and performance of the website, protect against attacks, and store files submitted via forms.

Cloudflare may process your IP address, technical device data, network traffic information, and requests made to the website. Uploaded attachments may be stored on Cloudflare’s infrastructure in accordance with the configuration of the service being used.

The legal basis for processing is:

  • Article 6(1)(b) of the GDPR—when the file is necessary to process a request, for recruitment purposes, or to take steps prior to entering into a contract;

  • Article 6(1)(f) of the GDPR – ensuring the security, availability, and proper functioning of the website;

  • Article 6(1)(a) of the GDPR – with respect to voluntary data provided in attachments.

Due to the global nature of Cloudflare’s infrastructure, data may be processed outside the European Economic Area. This is done using the mechanisms required by the GDPR, including relevant European Commission decisions or standard contractual clauses.

For more information, see the Cloudflare Privacy Policy.

11. Locally Stored Forms

Data submitted via forms is stored locally in the website management system hosted by dhosting.pl. Access to this data is restricted to authorized personnel within Skalisty Group sp. z o.o.

The website is maintained internally, and we do not outsource its day-to-day operation to an external agency.

12. Data Recipients

Data may be disclosed only to entities that assist us in maintaining the website and providing the services used, in particular:

  • dhosting.pl – website hosting and email services;

  • Cloudflare – security, form protection (Turnstile), content delivery, and file storage;

  • Google – Google Analytics;

  • providers of legal, accounting, or IT services, if access to the data is necessary;

  • public authorities, if the obligation to disclose data arises from legal provisions.

Data processors acting on our behalf may use the data only to the extent necessary to perform the tasks entrusted to them.

We do not sell personal data, share commercial inquiries with other companies, or forward job applications to other employers.

13. Transfer of Data Outside the EEA

In connection with our use of Google and Cloudflare services, certain information may be processed outside the European Economic Area, specifically in the United States.

Data transfers are carried out on the basis of the legal mechanisms provided for by the GDPR, including:

  • European Commission decisions confirming an adequate level of protection;

  • the EU-U.S. Privacy Shield, if the recipient participates in that program;

  • standard contractual clauses approved by the European Commission;

  • additional technical and organizational safeguards.

For information regarding the safeguards in place, please contact us at [email protected].

14. Cookies

The website uses cookies, which are small pieces of information stored on the user’s device. Cookies may be used to:

  • ensure the proper functioning of the website;

  • save privacy settings;

  • secure forms;

  • maintain sessions and protect against abuse;

  • compile anonymous or aggregated statistics;

  • analyzing how the site is used.

Essential cookies

These are required for the proper and secure operation of the website, to process forms, and to remember the user’s cookie preferences. They do not require separate consent if their use is necessary to provide the service requested by the user.

Analytical cookies

They help us understand how users interact with the website. They include, in particular, Google Analytics cookies. They are activated only after consent is given.

Third-party cookies

Some services related to security or the delivery of resources may come from Google or Cloudflare. The scope of the information used depends on the configuration of the service in question and the choices made by the user.

A current list of the cookies used, their providers, purposes, and durations should be available in the cookie settings panel.

15. Managing Cookie Consent

During their first visit, users can accept or reject individual categories of optional cookies. Not consenting to analytical cookies does not restrict access to the website’s basic functions.

Consent may be changed or withdrawn at any time via the cookie settings available on the website. The user may also delete cookies and restrict their use in their browser settings.

Withdrawing consent does not affect the lawfulness of actions taken prior to its withdrawal.

16. Data Retention Periods

We retain data no longer than is necessary for the purpose for which it was collected:

  • inquiries that did not result in the conclusion of a contract—up to 12 months from the end of the correspondence;

  • data related to a contract—for the duration of the contract and until the statute of limitations for claims expires;

  • accounting and tax documents—for the period required by law;

  • data from the current recruitment process—until the process is completed, taking into account the period necessary to protect against claims;

  • candidate data intended for future recruitment – up to 36 months;

  • technical logs – generally up to 90 days;

  • data processed based on consent—until consent is withdrawn or the purpose of processing ceases;

  • cookie settings—for the period specified in the consent management panel.

After the relevant period has elapsed, the data is deleted, anonymized, or archived if there is a legal obligation to retain it.

17. Rights of Data Subjects

Under the terms of the GDPR, you have the right to:

  • access their data;

  • receive a copy of their data;

  • correct inaccurate data or complete incomplete data;

  • delete their data;

  • restrict processing;

  • to have your data ported;

  • to object to processing based on a legitimate interest;

  • withdraw consent at any time;

  • to file a complaint with the President of the Personal Data Protection Office.

Requests regarding your data may be sent to [email protected].

Before fulfilling a request, we may ask for information to verify the identity of the person making the request. We will respond within the timeframe specified by the GDPR.

A complaint may be filed with the President of the Personal Data Protection Office. The authority’s current contact information is available at uodo.gov.pl.

18. Objection to Processing

If data is processed pursuant to Article 6(1)(f) of the GDPR, you may object at any time on grounds relating to your particular situation.

Upon receiving such an objection, we will cease processing the data unless we demonstrate compelling legitimate grounds for the processing that override the user’s rights and freedoms, or the data is necessary for the establishment, exercise, or defense of legal claims.

19. Automated Decision-Making and Profiling

We do not use personal data to make decisions regarding users based solely on automated processing that would produce legal effects or similarly significantly affect them.

We do not profile users for advertising purposes.

20. Data Security

We implement appropriate technical and organizational measures designed to protect data against loss, unauthorized access, disclosure, alteration, or destruction.

These include, among other things:

  • an encrypted HTTPS connection;

  • restricted access to data;

  • form protection against automated submissions;

  • network traffic protection;

  • software updates;

  • backups;

  • granting access only to authorized persons.

However, no method of data transmission or storage can guarantee the complete elimination of all risks.

21. Links and External Websites

The website may contain links to websites, materials, or profiles operated by other entities. When you visit an external website, your data is processed in accordance with the policies set by that website’s operator.

We recommend that you review the privacy policy of each external site you visit.

22. Changes to the Privacy Policy

This policy may be updated in the event of changes to regulations, the website’s operation, the tools used, or the scope of data processed.

The current version of this document is published on the website along with the date of the last update. In the event of significant changes, we may additionally notify users via a notice posted on the website.