Privacy policy

Last updated: 1 October 2026

1. Data controller

The controller of your personal data is Andrzej Lubczyński, trading as AIROX, ul. Marcina Kasprzaka 29B/96, 01-234 Warsaw, Poland.

Contact for data protection matters: contact@airox.agency.

We have not appointed a Data Protection Officer. For all matters concerning your data, please write to us directly at the address above.

2. What data we process

Depending on how you use the site, we process:

data you provide in the contact form: your name, email address, company name and a description of the process or the content of your message;
technical data accompanying your submission: the page the form was sent from, the date and time of submission, the language version of the site and campaign parameters (utm_source, utm_medium, utm_campaign) if present in the page address;
the content of email correspondence you exchange with us;
server technical data: IP address, browser type and version, operating system and request time — recorded in our hosting provider's logs.

Providing your data is voluntary. Without an email address, however, we will not be able to reply to your enquiry.

3. Purposes and legal bases

Handling your enquiry and conducting correspondence — Article 6(1)(f) GDPR. Our legitimate interest is replying to a person who contacted us on their own initiative.
Getting back in touch with a person who decided not to work with us after the call — at most three times, within 90 days of the call — Article 6(1)(f) GDPR. Our legitimate interest is to check whether the need we discussed is still relevant. You may object at any time, and we will stop contacting you.
Taking steps prior to entering into a contract and performing that contract — Article 6(1)(b) GDPR.
Complying with legal obligations (tax and accounting) — Article 6(1)(c) GDPR.
Establishing, exercising or defending legal claims — Article 6(1)(f) GDPR.
Analytics and measuring the effectiveness of marketing — Article 6(1)(a) GDPR, only after you give consent in the privacy preferences panel. As at the date of this policy, the site does not use any analytics or marketing tools.

4. Recipients of your data

We share your data with providers that support the operation of the site and the handling of enquiries. They process it solely on our instructions, under data processing agreements:

Cloudflare, Inc. — website hosting and abuse protection;
Make (Celonis SE) — automated intake and processing of contact form submissions; data is processed in the European region of the service;
Google Ireland Limited — Google Workspace services: email, the spreadsheet holding the enquiry register, and the task list; and Google Tag Manager, a tag management tool loaded when the page opens;
Formagrid Inc. (Airtable) — the system for handling enquiries and meetings (CRM), where we store data from the contact form and from meeting bookings together with the contact history;
our accounting firm and legal counsel — to the extent necessary for settlements and legal support;
public authorities — only where disclosure is required by law.

If you use the meeting booking link, you are taken to the external booking service TidyCal. Its operator is a separate controller of the data you enter in the booking form, governed by that service's own privacy policy. Booking data — your name, email address and meeting time — is then passed to our CRM so that we can prepare for and handle the call.

5. Transfers outside the European Economic Area

Contact form submissions are processed in the European region of Make, and email is handled within Google Workspace under an agreement with a European entity.

Some infrastructure providers (Cloudflare, Google, Airtable) nevertheless belong to groups headquartered in the United States, and in certain circumstances data may be transferred outside the EEA. Any such transfer takes place on the basis of a European Commission adequacy decision (Article 45 GDPR) or Standard Contractual Clauses approved by the European Commission (Article 46(2)(c) GDPR). Data stored in Airtable resides on servers in the United States; it is transferred on the basis of Standard Contractual Clauses approved by the European Commission (Article 46(2)(c) GDPR).

You have the right to obtain information about the safeguards applied — write to contact@airox.agency.

6. Retention periods

Enquiries and commercial correspondence — 3 years from the last contact;
Data relating to a concluded contract — for the term of the contract and 3 years thereafter (the limitation period for claims arising from business activity);
Accounting and settlement records — 5 years from the end of the tax year to which they relate (Article 74 of the Polish Accounting Act);
Server logs — up to 12 months;
Record of your cookie decision — 6 months, after which we will ask again.

7. Your rights

In connection with the processing of your data, you have the right to:

access your data and obtain a copy of it (Article 15 GDPR);
have inaccurate data corrected or incomplete data completed (Article 16 GDPR);
have your data erased (Article 17 GDPR);
restrict processing (Article 18 GDPR);
data portability (Article 20 GDPR);
object to processing based on our legitimate interest (Article 21 GDPR), including the handling of your enquiry; following an objection we will stop processing unless we demonstrate compelling legitimate grounds which override your interests;
withdraw your consent at any time where processing is based on it — without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, write to contact@airox.agency. We respond without undue delay and within one month at the latest; for particularly complex matters this period may be extended by a further two months, of which we will inform you.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).

8. Cookies

How we use cookies and similar technologies is described in our Cookie policy. You can change your decision at any time via the privacy preferences panel in the site footer.

9. Automated decision-making and profiling

We do not take decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.

10. Data security

We apply technical and organisational measures appropriate to the risk: TLS encryption of connections, two-factor authentication on the systems where we process data, access limited strictly to those who need it, and regular backups.

11. Changes to this policy

We may update this policy, for example when the tools we use change. The current version is always available on this page, with the date of the last change shown at the top. We will announce material changes prominently on the site.