Privacy policy
last updated:
This document explains how personal data is processed in connection with the use of the twelvefoxes.com website.
1. Data controller
The controller of personal data is:
Rafał Lachowicz Programista
ul. Dworska 19/27
15-756 Białystok, Poland
Tax ID (NIP): 5423042646
Contact for data protection matters: [email protected]
The controller has not appointed a Data Protection Officer. All matters relating to the processing of personal data should be directed to the email address above.
2. Scope and purposes of processing
2.1. Technical data of visitors
Each visit to the website involves the automatic transmission of technical data by your browser: IP address, browser and operating system information, the address of the referring page, and the date and time of the request. This data is processed by our infrastructure provider, Cloudflare, in its server logs. The controller has no direct access to these logs and does not use them to build any profile of visitors.
Purpose: ensuring the security and availability of the website and protection against abuse and attacks.
Legal basis: Article 6(1)(f) GDPR — the legitimate interest of the controller in ensuring the security and proper operation of the website.
2.2. Email correspondence
If you contact us using the email address published on the website, we process the data contained in your message: sender address, name or company name, message content, and any other data you choose to provide.
Messages sent to addresses in the twelvefoxes.com domain are forwarded by Cloudflare Email Routing, which processes the correspondence in transit on our behalf, to a mailbox held with Google (Gmail). Google stores and operates that mailbox under its own terms of service and privacy policy, as an independent controller — not on our instructions. Its processing of the correspondence is therefore governed by Google's privacy policy, over which we have no influence. If you would rather your correspondence did not pass through these providers, you may write to us at the postal address given in Section 1.
Purpose: responding to enquiries and conducting correspondence, including business correspondence.
Legal basis: Article 6(1)(f) GDPR — the legitimate interest in handling enquiries and communicating with parties interested in our services; where an enquiry is directed towards entering into a contract, Article 6(1)(b) GDPR.
2.3. Visitor statistics
The website uses Cloudflare Web Analytics to measure traffic and page performance. The tool collects aggregated data: page views, referring addresses, country of origin of traffic, browser and device type, and performance metrics (Core Web Vitals).
The tool does not use cookies, does not store any identifiers on your device, does not employ fingerprinting techniques, and does not track visitors across websites. IP addresses are used solely to determine the country of origin of traffic and are not stored.
Purpose: analysis of website traffic and performance, and the development and optimisation of the website.
Legal basis: Article 6(1)(f) GDPR — the legitimate interest in maintaining visitor statistics and improving the website.
3. No third-party content
The website loads no external resources. Fonts, styles, scripts and images are served from our own domain; there are no embedded players, social media widgets, advertising pixels or third-party analytics scripts. Opening this site therefore does not cause your browser to connect to any provider other than the one hosting the site itself.
4. Cookies
This website does not use analytics, marketing, or profiling cookies. We do not track visitors and do not build advertising profiles. Because no consent-based technologies are used, the site displays no cookie consent banner.
Our infrastructure provider, Cloudflare, Inc., may set only technical cookies necessary to ensure the security and availability of the website — in particular cookies used to detect automated traffic and protect against abuse (for example __cf_bm, cf_clearance). These cookies are strictly necessary for the delivery of a service explicitly requested by the user and, under the Polish Electronic Communications Law (Prawo komunikacji elektronicznej), do not require consent.
Cookie settings can be changed at any time in your web browser. Disabling technical cookies may affect the availability of the website.
5. Recipients of data
Personal data is entrusted to the following processor, which processes it solely on our instructions:
- Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) — website hosting (Cloudflare Pages), email forwarding (Cloudflare Email Routing) and visitor statistics (Cloudflare Web Analytics).
In addition, email correspondence reaches Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), which operates the mailbox in which it is stored. Google does so as an independent controller under its own terms, not as our processor: we have concluded no data processing agreement with it and give it no instructions as to the correspondence. This concerns only the content of email correspondence, not the data of website visitors.
6. Transfers outside the European Economic Area
Both companies named in Section 5 are established in the United States, which means that data may be transferred outside the European Economic Area.
For data entrusted to Cloudflare, transfers are made on the basis of the Standard Contractual Clauses approved by the European Commission, incorporated into Cloudflare's data processing addendum (Module Two, controller to processor). Cloudflare is additionally certified under the EU-U.S. Data Privacy Framework, a programme recognised by a European Commission adequacy decision as providing an adequate level of protection; to the extent a transfer is covered by that certification, it is not a restricted transfer. A copy of the clauses applied may be obtained by contacting us at the address given in Section 1.
Correspondence stored by Google is transferred on the basis of that company's own arrangements, not safeguards put in place by us — Google LLC is certified under the EU-U.S. Data Privacy Framework. As we are not a party to any agreement with Google concerning this correspondence, we cannot provide a copy of any safeguards on its side; the applicable terms are set out in Google's privacy policy.
7. Data retention
- Technical data (server logs): retained by the infrastructure provider in accordance with its retention policy, only for as long as necessary for security purposes.
- Email correspondence: for as long as necessary to handle the matter, and thereafter for the limitation period applicable to potential claims — no longer than 3 years from the conclusion of the correspondence.
- Statistical data: only in aggregated form that does not permit the identification of individual persons.
8. Your rights
In connection with the processing of your personal data, you have the following rights:
- right of access to your data and to obtain a copy of it;
- right to rectification of inaccurate data and completion of incomplete data;
- right to erasure of your data;
- right to restriction of processing;
- right to data portability — limited to data processed on the basis of Article 6(1)(b) GDPR, that is correspondence directed towards entering into a contract; it does not extend to data processed on the basis of our legitimate interest.
Right to object. You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data carried out on the basis of our legitimate interest (Article 21 GDPR) — that is, to the processing described in Sections 2.1, 2.2 and 2.3. If you object, we will cease processing the data unless we demonstrate the existence of compelling legitimate grounds overriding your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims.
To exercise these rights, please contact us at the email address given in Section 1. We will respond without undue delay and in any event within one month of receiving your request.
You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland. If you reside in another EEA country, you may also lodge a complaint with your local supervisory authority.
9. Automated decision-making
Personal data is not used for automated decision-making, including profiling that produces legal effects or similarly significantly affects the data subject.
10. Changes to this policy
This policy may be updated to reflect changes in our processing activities, technical changes to the website, or changes in applicable law. The current version is always available at this address, with the date of the most recent update shown at the top of the document.