Privacy Policy

1. Data controller

The controller of your personal data is the operator of the DROPWEBSITE website (the “Operator”), available at dropwebsite.com. In all matters concerning the protection of personal data you can contact the Operator by e-mail at [email protected].

2. What data we process

• Form data — first and last name, e-mail address, phone number, company name and tax ID (NIP), and the content of your message or brief, to the extent provided voluntarily in the contact or order form.
• Contract-related data — order history, project arrangements, correspondence and billing documents.
• Technical data — standard server logs (IP address, date and time of the request, browser identifier) processed by the hosting infrastructure to keep the service secure and stable.

Providing data is voluntary, but necessary to handle an inquiry or to conclude and perform a contract.

3. Purposes and legal bases of processing

• Handling inquiries and orders and performing the contract — including preparing the quote, running the progress panel and communicating about the project — under Art. 6(1)(b) GDPR (steps necessary to conclude and perform a contract, taken at the data subject’s request).
• Newsletter and availability notifications — based on consent, Art. 6(1)(a) GDPR. Sign-up is confirmed in a double opt-in model: sending starts only after you click the confirmation link. Consent can be withdrawn at any time — every message contains a one-click unsubscribe link.
• The Operator’s own marketing — including contact regarding offers addressed to businesses — under Art. 6(1)(f) GDPR (the Operator’s legitimate interest in promoting its own services). You have the right to object to this processing.
• Billing and tax obligations — under Art. 6(1)(c) GDPR (legal obligation, including accounting and tax regulations).
• Establishing, pursuing or defending legal claims — under Art. 6(1)(f) GDPR.

4. Data recipients

We entrust data only to providers necessary to run the service, under data processing agreements:

• Vercel Inc. — hosting of the service and application infrastructure,
• Neon Inc. — the database storing form, order and sign-up data,
• Resend Inc. — e-mail delivery (confirmations, notifications, the newsletter).

These providers may process data on servers located outside the European Economic Area — in that case the transfer takes place under standard contractual clauses approved by the European Commission. Data may also be disclosed to entities authorised under the law (e.g. tax authorities) and to the Operator’s accounting office with regard to billing documents.

5. Retention periods

• Contact form inquiries — for the duration of the correspondence, and then for up to 12 months from the last contact.
• Contract-related data — for the duration of the contract, and after its completion for the limitation period of claims and the period required by tax and accounting regulations (as a rule, 5 years from the end of the tax year).
• Newsletter — until consent is withdrawn or you unsubscribe from the list.
• Technical logs — according to the hosting provider’s retention policy, as a rule no longer than 30 days.

6. Data subject rights

Everyone whose data we process has the right to:

• access their data and receive a copy of it,
• rectification (correction) of the data,
• erasure of the data — where there is no ground for its further processing,
• restriction of processing,
• portability of data processed on the basis of a contract or consent,
• object to processing based on legitimate interest, including the Operator’s own marketing,
• withdraw consent at any time — without affecting the lawfulness of processing carried out before the withdrawal,
• lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office in Poland (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

To exercise any of these rights, simply write to [email protected]. We respond without undue delay, at the latest within one month.

7. Cookies

The service uses essential cookies only — they maintain the session of a logged-in user in the progress panel and the admin panel. We do not use advertising or analytics cookies, nor any tools that track users across websites. For this reason the service does not display a cookie consent banner — essential cookies do not require consent.

You can delete or block cookies in your browser settings; blocking essential cookies will, however, prevent you from using the panel.

8. Changes to this Policy

This Policy may be updated from time to time, for example when regulations or the scope of our services change. The current version is always available at dropwebsite.com/privacy, together with the date of the last update.