Privacy Policy

Last updated: 19 October 2026

This policy explains which personal data we process in connection with roduq.com, why, on what legal basis, for how long, and what your rights are. For cookies, see our Cookie Policy.

1. Controller

The controller is Rafał Stefaniszyn, trading as Roduq Rafał Stefaniszyn, al. Zwycięstwa 241/13, 81-521 Gdynia, Poland (“Roduq”, “we”).

For anything related to personal data, email roduq@roduq.com, call +48 58 585 94 02 or write to the address above. We have not appointed a data protection officer.

2. What we process, why and on what legal basis

Contact form and project enquiry

We collect your name, email address and message and, if you provide them, your company name, the service you are interested in and the project scope. We use them to reply to your enquiry and prepare an offer, and we send a confirmation with a reference number to the address you give.

Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). If you write on behalf of a company, our legitimate interest in communicating with a client’s representative (Art. 6(1)(f) GDPR). Providing the data is voluntary, but without it we cannot reply.

Booking a meeting

We collect your name, email address, chosen time slot, time zone and an optional message. We create an event in our Google Calendar with a Google Meet link and add you as a guest, so Google sends you an invitation. We also send a confirmation with a link to manage the booking.

Legal basis: Art. 6(1)(b) GDPR (steps before a contract) and, for company representatives, Art. 6(1)(f) GDPR.

Commercial information

If you tick the separate, optional consent box in the form, we may send you commercial information about Roduq by email. Legal basis: your consent (Art. 6(1)(a) GDPR together with the Polish Electronic Communications Law). You can withdraw it at any time by writing to roduq@roduq.com; this does not affect earlier messages. We do not run a newsletter or mailing lists in external tools.

Working together

If we sign a contract, we process the data needed to perform and invoice it (Art. 6(1)(b) GDPR) and to meet our tax and accounting obligations (Art. 6(1)(c) GDPR).

Protecting the forms from abuse

We limit how many submissions can be sent from one IP address. We do not store the IP address itself — only a one-way keyed hash of it, kept for 20 minutes. Legal basis: our legitimate interest in keeping the website secure (Art. 6(1)(f) GDPR).

Legal claims

In a dispute, we may process the data needed to establish, exercise or defend legal claims (Art. 6(1)(f) GDPR).

3. What we don’t do

  • We don’t use analytics or advertising tools (such as Google Analytics or the Meta pixel) and we don’t track you across websites.
  • We don’t profile you or make automated decisions about you.
  • We don’t sell data.

4. Who receives the data

Only providers that help us run the website and communicate with you, acting on our instructions under a data processing agreement or as separate controllers:

  • the server provider hosting the website — Hetzner Online GmbH (Germany; servers in Germany and Finland);
  • the email provider through which the website sends confirmations and notifications and we handle correspondence — Google (Google Workspace);
  • Google — calendar and Google Meet when you book a meeting;
  • providers of other office software we use in our work;
  • our accountants and legal advisers — when needed for accounting or legal claims;
  • public authorities — when the law requires it.

The map, videos and social networks are covered in section 6.

5. Transfers outside the European Economic Area

Google Workspace and Google Calendar are provided to us by Google Ireland Limited (Ireland), but data may also be processed by Google LLC in the USA. Data is transferred there on the basis of the European Commission’s adequacy decision (EU-US Data Privacy Framework) for certified companies, or of standard contractual clauses approved by the Commission (Art. 46(2)(c) GDPR). You can request a copy of the safeguards by writing to us. The OpenStreetMap Foundation is based in the United Kingdom, which is covered by a Commission adequacy decision.

6. Map, videos and social networks

Map on the Contact page. The map uses OpenStreetMap. When you scroll to it, your browser downloads map tiles from the OpenStreetMap Foundation’s servers (United Kingdom), which receive your IP address and basic browser information. We do this in our legitimate interest in showing where we are (Art. 6(1)(f) GDPR). See the OpenStreetMap Foundation privacy policy.

Videos. Some videos come from YouTube (privacy-enhanced mode) or Vimeo. The player loads only when you click play. From then on, Google or Vimeo process your data, including your IP address, under their own privacy policies.

Social networks. We have profiles on Facebook, Instagram, LinkedIn and YouTube. The icons in the footer are plain links — the networks receive nothing until you click them. When you visit our profiles, your data is processed mainly by the operators of those networks. For the statistics of our Facebook and Instagram pages, we are joint controllers with Meta Platforms Ireland Limited. If you message us on a social network, we reply on the basis of Art. 6(1)(f) GDPR.

7. How long we keep data

  • Contact form submissions in the website database — 90 days, then deleted automatically.
  • Correspondence and meeting bookings — until the conversation ends, then no longer than 12 months unless we start working together.
  • Contract data — for the term of the contract, then until legal claims become time-barred and the statutory retention period for accounting records ends (as a rule, 5 years from the end of the year in which the tax obligation arose).
  • Data for commercial information — until you withdraw consent.
  • The IP hash used to protect the forms — 20 minutes.
  • Backups — data deleted from the website disappears from backups as they are regularly replaced.

8. Your rights

You have the right to:

  • access your data and receive a copy;
  • have it corrected;
  • have it erased;
  • restrict processing;
  • data portability, where processing is based on consent or a contract;
  • object to processing based on legitimate interest — and to direct marketing at any time;
  • withdraw consent at any time.

To exercise these rights, email roduq@roduq.com. We will reply without undue delay and within one month at the latest. You can also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw (uodo.gov.pl), or with the authority in your country.

9. Security

Connections to the website are encrypted (HTTPS). The database is not reachable from the internet, and only authorised people can access the editorial panel. Backups are kept in a protected form outside the server. We keep the software up to date.

10. Changes

If we change how we process data, we will update this policy and the date at the top.