GDPR Notice

1. Data controller The controller of personal data is Szymon Lech, conducting business under the name Lech Forge - Szymon Lech, NIP: 5223331943, address: ul. Masztowa 13, 78-132 Grzybowo. Contact for personal data matters: - e-mail: kontakt@lech-forge.pl, - postal address: ul. Masztowa 13, 78-132 Grzybowo. 2. Purposes and legal bases for processing Data are processed for the purpose of: - responding to an enquiry submitted via the form or mini-chat, - taking steps prior to entering into a contract or performing cooperation — Article 6(1)(b) GDPR, - conducting correspondence, ensuring website security, protecting against spam, documenting contact, and establishing, pursuing, or defending claims — Article 6(1)(f) GDPR, - fulfilling obligations arising from law — Article 6(1)(c) GDPR. Lech Forge’s legitimate interest is efficient and secure communication related to its offering, protecting the system against abuse, and being able to demonstrate the course of contact. 3. Scope of data In the contact form, the following may be processed: - first and last name or company name, - e-mail or telephone, - preferred contact method, - subject, optional type of service, and message content, - submission reference number, website language, IP hash, and clause version. In the mini-chat, the following may be processed: - nickname, - conversation content, - thread identifier and private token hash, - IP hash, minimal anti-spam data, and the version of the terms and clause. In connection with server security, Turnstile, and the administrator panel, the full IP address and user-agent may be briefly processed in logs, during verification, or in security alerts. 4. Recipients of data Data may be disclosed to: - OVH — in connection with website, database, and e-mail hosting, - Cloudflare — in connection with the Turnstile service, - public authorities authorised to receive data on the basis of law. Cloudflare may also process technical data outside the European Economic Area. In such cases, mechanisms provided for by the GDPR are applied, including the EU–US Data Privacy Framework or standard contractual clauses — depending on the situation. 5. Retention period Form submissions are retained by default for 60 days. The period may be shortened, extended to a specified date, or excluded from automatic deletion if a specific purpose and legal basis for retention still exist. Mini-chat conversations are retained by default for 14 days. The period may be shortened, extended, or excluded from automatic deletion if further handling of the matter or another legitimate purpose so requires. After expiry, the content is deleted or anonymised. Data may be retained longer where required by law or where needed to establish, pursue, or defend claims. 6. User rights The user may — depending on the basis and circumstances of processing: - request access to the data and a copy thereof, - request rectification, erasure, or restriction of processing, - object to processing based on legitimate interest, - request data portability if the GDPR conditions are met, - lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). Requests may be sent to kontakt@lech-forge.pl. 7. Voluntary nature of providing data In the contact form, providing a first and last name or company name and at least one contact method is needed to obtain a response. In the mini-chat, only a nickname and message content are required. E-mail and telephone are not required in the mini-chat and should not be provided if the user does not wish to share them. 8. Automated decisions Data are not used for profiling or automated decision-making that produces legal effects. Security mechanisms may automatically limit spam submissions, exceeding a limit, or a request that has not passed Turnstile verification.