1. Data controller
The controller of personal data is Dominik Dębski, operating a sole proprietorship entered in the Polish Central Register and Information on Business Activity (CEIDG), trading under the Lemur Media brand, NIP (tax ID) 5241471896, registered office: Warsaw. For matters relating to personal data, please contact us at dominik@lemurmedia.pl.
2. Cookies and Google Analytics
The website uses Google Analytics 4 only after consent is given in the banner displayed on the first visit. Without consent, the Google Analytics script is not loaded and the website does not store any analytics or advertising cookies.
Once consent is given, Google Analytics stores the cookies _ga and _ga_FWML1BBJ26 (valid for up to 2 years) and collects information about the pages visited, the traffic source, device type, operating system and browser, approximate location (country, region, city) and interactions with the website, such as scrolling, clicking an external link or contact button, completing the self-assessment and submitting the contact form. When the form is submitted, Google Analytics receives only information about the event, the selected area and the source, without the name, e-mail address, company name or message content. Google Analytics 4 does not store full IP addresses. Advertising features (Google signals, ad personalisation) are disabled. The purpose is to keep visit statistics and assess the usefulness of content. The legal basis is consent (Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law (PKE) of 12 July 2024).
Consent can be withdrawn at any time using the “Cookie settings” button in the website footer. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.
We store the consent decision in the browser's storage (localStorage, key lm_consent) for 12 months. The contact form keeps the data entered in the browser's session storage (sessionStorage) solely so that it is not lost if sending fails; the data is deleted when the tab is closed. These entries are necessary for the website to function and do not require consent. Fonts are served from the website's own server. The AI readiness self-assessment calculates the result in the user's browser; answers are neither transmitted nor stored.
3. Data from the contact form and e-mail correspondence
We process the data provided in the form or in an e-mail: first name and surname, company name, e-mail address, selected area, message content and information on how the person heard about Lemur Media. We process the data in order to:
- respond to the enquiry and conduct correspondence, on the basis of the controller's legitimate interest (Article 6(1)(f) GDPR);
- take steps prior to entering into a contract at the request of the data subject or the entity they represent (Article 6(1)(b) GDPR, and for a company representative Article 6(1)(f) GDPR);
- establish, exercise or defend legal claims, on the basis of the controller's legitimate interest (Article 6(1)(f) GDPR).
4. Client data
If a contract is concluded, we process the data of persons representing the client and of contact persons in order to perform the contract (Article 6(1)(b) GDPR where the data subject is a party to the contract, and Article 6(1)(f) GDPR in other cases), to fulfil tax and accounting obligations (Article 6(1)(c) GDPR) and to establish, exercise or defend legal claims (Article 6(1)(f) GDPR). The rules for processing data made available by the client as part of a project, including personal data of its customers and employees, are set out in a data processing agreement.
5. Server logs
The server hosting the website automatically records connection information in logs: IP address, date and time, the requested page address, response code and browser information. This data is used solely to ensure the security and proper functioning of the website, on the basis of the controller's legitimate interest (Article 6(1)(f) GDPR), and is retained for the period determined by the hosting service configuration. We do not combine it with other data.
6. Retention period
- Statistical data in Google Analytics: 14 months from collection.
- Correspondence that does not lead to a contract: up to 12 months from the last message.
- Contract-related data: for the term of the contract and thereafter until the limitation period for claims expires.
- Accounting documents: for the period required by tax law, i.e. 5 years from the end of the calendar year in which the tax payment deadline fell.
7. Data recipients
Data may be transferred to entities that provide the controller with services necessary to run the business, under data processing agreements: the website hosting provider (SEOHOST Sp. z o.o.), the e-mail service provider (Google Workspace, Google Cloud EMEA Limited), the provider of Google Analytics (Google Ireland Limited, only after consent is given) and an accounting firm. In projects requiring a legal opinion, data may be transferred to a law firm cooperating on the project as a separate controller, only after the client has been informed in advance.
8. Transfers of data outside the European Economic Area
E-mail is handled by Google Workspace, and visit statistics (after consent is given) by Google Analytics. Google may process data outside the European Economic Area, including in the United States. Transfers take place on the basis of the European Commission's adequacy decision under the EU-U.S. Data Privacy Framework and standard contractual clauses approved by the Commission.
9. Rights of data subjects
Every data subject has the right to:
- access their data (Article 15 GDPR);
- rectification of their data (Article 16 GDPR);
- erasure of their data (Article 17 GDPR);
- restriction of processing (Article 18 GDPR);
- portability of data processed on the basis of a contract (Article 20 GDPR);
- object to processing based on legitimate interest (Article 21 GDPR);
- lodge a complaint with the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa.
Please send requests to exercise these rights to the e-mail address given in section 1. We respond without undue delay and no later than one month after receiving the request.
10. Voluntary provision of data
Providing data is voluntary but necessary to respond to an enquiry. The data is not used for automated decision-making or profiling.
11. Links to other websites
Articles in the Insights section contain links to external sources. Once you move to another website, the privacy policy of its operator applies.
12. Changes to the policy
This policy may be updated if the law or the way the website operates changes. The current version is always available at this address.