Effective from: 10 September 2026.
1. Data controller
The controller is IT Services Marta Kowalik, NIP PL7691519977, business address: os. Okrzei 4, 97-400 Bełchatów, Polska. Privacy contact: biuro@it-serv.eu, phone +48 788 750 168.
2. Data and purposes
We may process data submitted through contact forms or an order, including e-mail address, request description, information required to deliver the service and payment-related data. We process data to answer enquiries, agree and perform services, process payments and confirmations, handle complaints, meet accounting/tax duties, prevent abuse and establish or defend legal claims.
3. Legal bases
Depending on the situation, processing is based on GDPR Article 6(1)(b) (pre-contract steps and contract performance), 6(1)(c) (legal obligations, including accounting and tax duties), 6(1)(f) (legitimate interests such as security and claims), or 6(1)(a) where consent is the appropriate basis.
4. PayU and other recipients
For payment processing, transaction data required for the payment is provided to PayU S.A., which processes data under its own legal obligations and, for payment processing, also acts as a separate controller. Data may also be processed by hosting/IT providers, accounting providers and legal advisers only to the extent required for their tasks.
5. Retention
Contract and settlement records are retained for periods required by tax/accounting law and as needed to protect legal claims. Enquiry data that does not result in a contract is kept for the time needed to handle the matter and for a reasonable archival period.
6. Your rights
Subject to the GDPR, you may have rights of access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests and withdrawal of consent where consent is the legal basis. You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO).
7. Security
We use appropriate technical and organisational measures designed to protect data against loss, unauthorised access, disclosure, alteration or destruction. Access is limited to persons and processors who need the data for a defined purpose.
8. Cookies and technical data
The website may use cookies and technical data needed for operation, security, sessions and forms. If non-essential tools are introduced, consent will be requested where required by law.
9. Transfers outside the EEA
If a provider processes data outside the European Economic Area, transfers are made only using a GDPR-permitted mechanism, such as an adequacy decision or standard contractual clauses where applicable.
10. Contact and updates
Privacy questions may be sent to biuro@it-serv.eu. This policy may be updated as services or legal requirements change; the current version is published on this page.