Privacy policy

Last updated: 21 October 2026

This policy explains what personal data we process when you visit the SW Studio website, send us an inquiry, call or write to us, or work with us: why we do it, on what legal basis, who we share it with, how long we keep it and what your rights are. It fulfils the information obligation under Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (the GDPR).

Who controls your data

SW Studio is Wiktor Sołtysik and Samuel Fijak. We live in Poland and work as private individuals, without a registered business. We decide together why and how data is processed, so we are joint controllers (Article 26 GDPR). We have agreed between us that:

• either of us receives and handles your requests about your data and answers them on behalf of both joint controllers;
• we look after the security of the data and give you the information in this policy together;
• regardless of this arrangement, you can exercise your rights against each of us.

For anything about your data, call +48 798 455 132 (Wiktor) or +48 504 299 553 (Samuel). We have not appointed a data protection officer, because at our scale the law does not require one.

What data we process and where it comes from

Contact form. Your full name, phone number, e-mail address, the services you choose and your message (required), your company name and budget (optional), and the date it was sent.

Phone, text messages and WhatsApp. Your phone number, your name (if you give it) and what we talk or write about. WhatsApp is a service of WhatsApp Ireland Limited, which processes data as a separate controller under its own privacy policy.

Working together. The data needed for arrangements, a contract and invoicing, for example your full name or company name, address and tax number (NIP), and the materials you give us: text, photos, a logo, or access to hosting or a website admin panel.

Company contacts. If you write to us on behalf of a company, or a company names you as its contact, we process your full name, job title and work phone number and e-mail address. This data comes from you or from the company you represent. We may also check company details in public registers such as CEIDG, KRS or the VAT taxpayer list.

Your customers' data. If, while working on your website, we see personal data of your customers (for example messages from the form on your site), we process it only on your instructions, under a separate data processing agreement. You are responsible for that data as its controller.

Technical data. Our hosting provider (Vercel) processes your IP address and basic information about the visit: the page address, the time, and your browser and device type. Without this the website could not be shown or protected from attacks. When you send the form, we also store your IP address, but not as it is: only as a one-way hash, used solely to block mass sending of messages.

Visit statistics. We use Vercel Web Analytics to see how many people visit the website and which pages they read. It uses no cookies and stores nothing in your browser. It records the address of the page you visit, the page you came from, your approximate location (such as the country), and your type of device, operating system and browser. Visits on the same day are linked by a hash created from the request, which changes every day, so it cannot be used to recognise you on later days.

Please do not send us special categories of data (for example about health, beliefs or religion) or other people's data unless it is needed for the project. If you give us someone else's data, for example a colleague's, make sure you are allowed to, and pass on the information in this policy to them.

Why we process data and on what legal basis

• Replying to an inquiry, preparing a quote and talks before a contract: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). If you write on behalf of a company, or about something unrelated to a contract, the basis is our legitimate interest in answering inquiries and talking to the people who contact us (Article 6(1)(f) GDPR).
• Entering into and performing a contract (designing, building and launching a website, and support after launch): performance of a contract (Article 6(1)(b) GDPR). We process the data of company contacts in our legitimate interest in performing the contract with the company they represent (Article 6(1)(f) GDPR).
• Invoicing and keeping the documents required by tax law: a legal obligation (Article 6(1)(c) GDPR).
• Website security and protection against spam and abuse (server logs, the IP address hash, sending limits): our legitimate interest in keeping the website working and secure (Article 6(1)(f) GDPR).
• Visit statistics (Vercel Web Analytics): our legitimate interest in knowing how the website is used, so we can improve it (Article 6(1)(f) GDPR).
• Establishing, pursuing or defending legal claims: our legitimate interest in protecting our rights (Article 6(1)(f) GDPR).
• Showing a finished website in our portfolio with your company name or your full name: only with your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.

We do not send newsletters or advertising, we do not sell data, we do not profile you, and we do not make decisions about you based solely on automated processing.

Do you have to give us your data

Giving us your data is voluntary. Without your name, phone number, e-mail address, the services you need and a few sentences about the project, the form will not send, because we would not be able to reply. Instead of the form you can always just call. If we start working together, the data needed for the contract is a condition of entering into it, and the data needed for invoicing is required by tax law.

Who we share data with

Only we, Wiktor and Samuel, see your inquiries. Data may go to:

• companies that process it on our behalf, under data processing agreements and only as far as needed to run the website: Vercel Inc. (hosting for the website and the servers that handle the form, and visit statistics) and Turso (the database where we keep inquiries);
• providers with whom we set up services needed for the project on your instructions, for example a domain or hosting, as far as needed to set them up;
• banks and payment providers through which you pay us, as separate controllers;
• courts, tax authorities and other public authorities, where the law requires it.

A bot in the Telegram messenger lets us know about new inquiries. The notification contains only the services chosen and the budget, without your name, company name, contact details or message.

Transfers outside the European Economic Area

Vercel and Turso are based in the USA, so your data may be processed outside the European Economic Area. This happens on the basis of the European Commission's adequacy decision (the EU-US Data Privacy Framework), where the company is covered by it, or of standard contractual clauses approved by the European Commission. You can get a copy of these safeguards by contacting us.

How long we keep data

• Form inquiries: deleted automatically 12 months after they were sent. If we are working together at that point, the inquiry stays until the work ends.
• Messages (text, WhatsApp) and notes from calls: as long as they are needed to handle the inquiry or the work.
• Data related to a contract: for as long as we work together, then until the limitation period for claims ends.
• Invoicing documents: for 5 years from the end of the calendar year in which the tax payment deadline passed, as required by tax law.
• Data processed with your consent (portfolio): until you withdraw your consent.
• The IP address hash from the form: deleted automatically, usually after a day.
• Server logs: briefly, under Vercel's rules.
• Visit statistics: for the period set in Vercel's rules.

We will delete data processed on the basis of legitimate interest sooner if you successfully object. At your request we will also delete data sooner in other cases, unless the law requires us to keep it or we need it to establish, pursue or defend legal claims.

Your rights

Under the conditions set out in the GDPR, you have the right to:

• access your data and get a copy of it (Article 15 GDPR);
• have incorrect data corrected and incomplete data completed (Article 16 GDPR);
• have your data erased (Article 17 GDPR), unless we have to keep it, for example because of tax law or to pursue or defend legal claims;
• restrict processing (Article 18 GDPR);
• data portability (Article 20 GDPR), that is, to receive the data you gave us, which we process on the basis of a contract or consent, in a commonly used format;
• withdraw your consent at any time (Article 7(3) GDPR), without affecting the lawfulness of processing carried out before you withdrew it;
• object to processing (Article 21 GDPR), described in a separate section below;
• lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) if you believe we process your data unlawfully.

To exercise these rights, call +48 798 455 132 (Wiktor) or +48 504 299 553 (Samuel). We will reply without undue delay and within one month at the latest. If requests are numerous or complex, we may extend this by two further months, and we will tell you if we do. Before we share or change data, we may ask for information needed to confirm your identity, so that we do not hand it to someone pretending to be you. Handling requests is free of charge. If requests are manifestly unfounded or excessive, in particular because they are repeated, we may charge a reasonable fee or refuse to act on them (Article 12(5) GDPR).

Data security

We use technical and organisational measures appropriate to the risk. The website works only over an encrypted connection (HTTPS), the panel with inquiries is protected by a password that we store only as a hash, the number of login attempts is limited, and only we have access to the data. No way of sending data over the internet is completely secure, though. If there is a breach of your data, we will report it to the President of the UODO and notify you in the cases and within the time limits set by the GDPR.

Cookies and browser storage

The website does not use cookies for visitors. In your browser's storage it keeps only one small piece of information, which cannot identify you and is never sent to us: the fact that the logo animation has already been shown (it disappears when you close the tab). It is only needed for the website to work, so we do not ask for consent. Visit statistics (described above) work without cookies or storing anything in your browser. We do not use advertising pixels or social media plugins, and fonts and images load from our own server. The only cookie (sw_admin) is needed for the inquiries panel, and only we get it, when we log in to the panel.

Links to other services

The website contains links to other services, for example WhatsApp. Once you go there, their own data processing rules apply, and we are not responsible for them.

Children

The website and our services are meant for businesses and adults. We do not knowingly collect children's data.

Changes to this policy

This policy is for information and is not a contract. We may change it when the law or the way we process data changes. The current version is always on this page, with the date of the last update at the top. If important changes affect work we are doing together, we will tell you directly.