This policy explains how we process personal data when you use meza.agency or contact us, as required by Article 13 of the GDPR.
1. Controller
The controller of your personal data is MEZA prosta spółka akcyjna, ul. Leśna 1, 81-876 Sopot, Poland, KRS 0001041932, NIP 5851501354 (company details). For any privacy matter, write to [email protected] or call +48 889 009 550.
2. What data we process
- Enquiry form: your name, email address, what you need, your answers to the optional questions about a solution, the message and anything you choose to include in it, plus the address of the page you sent the form from.
- Email or phone: the data contained in your correspondence with us.
- Technical data: to deliver the site and protect it from attacks, requests to it pass through the Cloudflare network, which processes technical connection data such as your IP address, the date and time, the requested address and browser information. Our own server keeps no access logs with visitors' IP addresses.
- Error logs: if an enquiry from the form cannot be delivered for technical reasons, the server's error log records only the type of error and a random enquiry number. The logs do not contain the contents of the form: no name, email address, message or IP address.
Providing data is voluntary, but without it we cannot reply to you.
3. Purposes and legal bases
- Answering your inquiry and taking steps you ask for before a possible contract — Art. 6(1)(b) GDPR.
- Our legitimate interest in handling correspondence, keeping the site secure and, where needed, establishing or defending legal claims — Art. 6(1)(f) GDPR.
We do not use your data for automated decision-making or profiling.
4. Who receives the data
- The provider hosting the server on which the site runs. The server is located in the EU.
- Cloudflare (Cloudflare, Inc.): delivers the site and protects it from attacks. All traffic to the site passes through its network, including what you send through the form (e.g. your name, email address and message), so as our processor it processes that content and the technical connection data described above, including your IP address. Cloudflare is based in the USA and participates in the EU-U.S. Data Privacy Framework; the transfer relies on the European Commission's adequacy decision (Art. 45 GDPR). Cloudflare determines how long it keeps this data; we have no access to these logs. Details are in Cloudflare's privacy policy.
- Email provider: enquiries from the form reach our business mailbox by email, and the mailbox is run by our email provider on servers in the EU (Germany). Messages you write to us directly also reach us through this provider.
We do not sell your data or share it for marketing.
5. How long we keep it
Inquiries and correspondence are kept for up to 12 months after our last contact. If a contract follows, we keep the data for the duration of the contract and then for as long as the law requires (e.g. accounting rules) or until related claims expire. Server error logs are deleted whenever the site is updated, so they are kept only briefly, and their size is limited.
6. Your rights
You have the right to:
- access your data and receive a copy of it,
- have it rectified,
- have it erased,
- restrict its processing,
- data portability,
- object to processing based on our legitimate interest,
- lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).
To exercise your rights, write to [email protected].
7. Cookies and analytics
The site sets no cookies and uses no advertising or cross-site tracking tools. To see which pages are useful, visits are counted by our server, without storing anything on your device or reading anything from it. After serving a page, the server reports the view to our own instance of Plausible Analytics (stats.meza.agency) on a server in the EU. It passes the page address (of its parameters, only source and campaign tags: utm, ref, source), the referring address if your browser sent one, a shortened IP address (IPv4 to /24, IPv6 to /48; the full address never leaves our server) and a shortened browser description (browser family, major version and operating system). Plausible turns these into a visit ID that lasts one day (a hash with a salt that changes daily) and works out the country; it stores neither the IP address nor the browser description. What remains is page, source, country, device type, browser and operating system. This is pseudonymous data, not anonymous data; we do not use it to identify visitors.
If your browser sends a Global Privacy Control or Do Not Track signal, the server does not count your visits at all. This is also a way to object to this processing (Art. 21 GDPR).
Until 20 October 2026 we are comparing this method with the previous one, so for this week the agency pages also still load the Plausible script from the same instance. The script sets no cookies and stores nothing on your device; it only reads one setting from browser storage, which we use to exclude visits from our own devices. It sends the full page address, the referring address, how far the page was scrolled and how long it was open. With that request Plausible also receives your full IP address and full browser description; it uses them in the same way as above and does not store them. The script sends no other events and does not respond to Global Privacy Control or Do Not Track signals. We will remove it after this week.
The legal basis is our legitimate interest in improving the site — Art. 6(1)(f) GDPR. When you send the enquiry form, the server also records a "Lead" event (page, solution and section) with no name, contact details, IP address or browser data, so it cannot be linked to your visits; for the same reason it is recorded even when your browser sends one of those signals. Statistics data is deleted automatically after 24 months.
8. Changes
If we change this policy, we will publish the new version on this page with a new date.