Privacy Policy

Last updated: October 2026

1. Who We Are

ilf.studio is operated by Fundacja Rozwoju Przedsiebiorczosci Twoj Startup, ul. Żurawia 6/12, Warszawa 00-503, Poland (NIP: 5213641211, REGON: 146433467, KRS: 0000442857). We provide web development, AI automation, SEO, and design services.

For any privacy-related questions, contact us at: [email protected]

2. Data We Collect

• Contact and request data: name, e-mail address, phone number and the content of your message when you use a form on this website or write to us.
• Project details: information you share about your business or project during our cooperation.
• Payment data: when you pay via PayU, your payment details are processed directly by PayU. We do not store card details.
• Technical data: IP address, browser type and requested pages in server and network logs, for security and operation of the website.
• Usage statistics (only with your consent): if you accept analytics in the cookie banner, Google Analytics records how you use the website (pages viewed, device type, approximate location derived from the IP address).
• Website check requests: if you use the free GDPR website check, the website address you enter and a one-way hash of your IP address (to limit abuse).

3. How We Use Your Data

• Respond to your inquiries and provide requested services
• Process payments for services rendered
• Send project-related communications
• Fulfil our legal and accounting obligations
• Keep the website secure and available
• Understand how the website is used, only if you consented to analytics

We do not sell or rent your personal data and do not share it with third parties for their own marketing.

4. Legal Basis for Processing

• Contract performance (Art. 6(1)(b) GDPR): to deliver services you requested and to take steps at your request before a contract
• Legitimate interests (Art. 6(1)(f) GDPR): to respond to inquiries, keep business records, secure the website and prevent abuse of the website check
• Legal obligation (Art. 6(1)(c) GDPR): accounting and tax regulations
• Consent (Art. 6(1)(a) GDPR, and § 25(1) TDDDG / Art. 5(3) ePrivacy Directive for access to your device): Google Analytics. You can withdraw consent at any time (section 8).

5. Data Retention

• Client project data: 5 years after project completion (accounting requirements)
• Contact inquiries: 2 years if no contract was established
• Server logs: 90 days
• Website check results and screenshots: deleted automatically after 24 hours
• Google Analytics data: according to the retention period set in Google Analytics (14 months)
• Your cookie choice: stored in your browser until you change it or clear browser data

6. Service Providers and Recipients

Provider	Purpose	Location / transfer
Hetzner Online GmbH, Germany	Hosting of this website, our CRM and the website check	EU
Cloudflare, Inc.	Network delivery and protection (DNS, proxy, TLS); processes IP addresses and request data	USA; EU-US Data Privacy Framework and Standard Contractual Clauses
Google Ireland Ltd. / Google LLC	Google Analytics 4, only after consent	EU and USA; EU-US Data Privacy Framework
PayU S.A., Poland	Payment processing, see PayU’s privacy policy	EU
Telegram	Internal notification about a new request (name, contact and request summary)	Outside the EU; Standard Contractual Clauses
OpenAI	Categorising incoming requests in our CRM	USA; EU-US Data Privacy Framework

Fonts and scripts used by this website are served from our own server. No third-party service is contacted before you make a choice in the cookie banner, except Cloudflare, which delivers every request.

7. Your Rights

Under GDPR, you have the right to:

• Access: request a copy of personal data we hold about you
• Rectification: request correction of inaccurate data
• Erasure: request deletion of your data
• Restriction: request that we limit processing of your data
• Portability: receive your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interests
• Withdrawal of consent: at any time, without affecting processing before the withdrawal

To exercise these rights, contact us at [email protected]. We will respond within one month.

You also have the right to lodge a complaint with the Polish data protection authority (UODO): uodo.gov.pl.

8. Cookies and Similar Technologies

Necessary, no consent required: your cookie choice (cookie_consent) and your language preference (preferred_lang) are stored in your browser’s local storage.

Analytics, only with consent: if you click “Accept”, Google Analytics is loaded and sets the cookies _ga and _ga_<ID> (up to 2 years). If you click “Decline”, Google Analytics is not loaded and no analytics cookies are set.

Changing your choice: use the “Cookie settings” link at the bottom of every page. If you withdraw consent, we remove the analytics cookies and stop loading Google Analytics.

9. Free GDPR Website Check

When you use the check, our server opens the public homepage you entered in an automated browser and records which services it loads. The address you entered and the results are stored for 24 hours and then deleted. Your IP address is kept only as a one-way hash for rate limiting. Owners of a website can ask us not to check their domain.

10. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. All data transmission is encrypted via HTTPS/TLS.

11. Changes to This Policy

We update this policy when the services we use change. The “Last updated” date shows the latest revision.

12. Contact

Questions about this Privacy Policy? Contact us: [email protected] Fundacja Rozwoju Przedsiebiorczosci Twoj Startup ul. Żurawia 6/12, Warszawa 00-503, Poland