Privacy policy

The controller of your personal data is DOPEST, based in Poland. For any data protection matter, email hello@dopest.studio or call +48 732 106 104.

We have not appointed a data protection officer, as the scale of our processing does not require one. Every request is handled by the person running the studio.

We only receive data you provide yourself: through the form on the contact page (name, company, email, phone, approximate budget, message), by email, by phone or via a message on social media.

When you visit the site, the server and Cloudflare record technical data: IP address, browser and device type, request time and the page visited. This is used solely to run and protect the site.

Replying to your message, a call booked through the calendar on this site and preparing a proposal: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

Performing the contract once you become our client: contract performance (Art. 6(1)(b) GDPR) and accounting and tax obligations (Art. 6(1)(c) GDPR).

Keeping in touch with people who represent companies and institutions, and establishing, exercising or defending legal claims: our legitimate interest (Art. 6(1)(f) GDPR).

Site security, blocking bots and abuse, and server logs: our legitimate interest (Art. 6(1)(f) GDPR).

Visit statistics (Google Analytics) and, in the future, measuring ad performance: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

We do not send a newsletter. Without consent to marketing cookies we do not profile visitors. We make no decisions based solely on automated processing.

Data is processed on our behalf by providers bound by data processing agreements: OVHcloud (servers in the European Union that run this site), Cloudflare (CDN and protection against attacks), Amazon Web Services (delivery of contact form messages, EU region) and Google (email and office tools and, if you agree, Google Analytics).

Once we sign a contract, billing data also goes to our accounting firm and, in the event of a dispute, to a law firm. We do not sell data and we do not share it with advertisers.

The site's servers and our mailboxes run in the European Union. Cloudflare and Google may process some technical data in the United States; both are certified under the EU-US Data Privacy Framework and the transfer is additionally covered by the European Commission's standard contractual clauses.

Contact form messages and proposal correspondence: until the conversation ends, for a maximum of 12 months after the last contact.

Client data: for the duration of the contract and then for the period required by tax law (5 years from the end of the year the invoice was issued) and until claims become time-barred.

Server and Cloudflare logs: up to 30 days.

Google Analytics data: 14 months. The _ga and _ga_<ID> cookies in your browser: up to 2 years or until you withdraw consent.

You have the right to access your data, to have it rectified or erased, to restrict its processing, to data portability, and to object to processing based on our legitimate interest.

If you believe we process data unlawfully, you can lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or your local supervisory authority.

Providing data is voluntary. Without an email address or phone number, however, we will not be able to reply.

Essential cookies are always on: NEXT_LOCALE remembers your language (up to a year), Cloudflare's __cf_bm tells humans from bots (up to 30 minutes) and dopest_consent stores your choice in the cookie banner (12 months). The law does not require consent for these.

Analytics, only with your consent: Google Analytics 4 by Google Ireland Limited. We measure visits, traffic sources and whether someone sent the form, tapped the phone number or email address, or watched the showreel. We do not combine this data with the content of form messages.

Marketing, only with your consent: Google Ads for measuring ad performance and remarketing. We are not running campaigns today, so this category switches nothing on. Before that changes, we will update this policy.

The legal basis is your consent (Art. 6(1)(a) GDPR and the Polish Electronic Communications Law). Until you give it, the Google script does not load at all. You can change or withdraw your consent at any time with the “Cookie settings” link in the site footer. Withdrawal does not affect the lawfulness of earlier processing.

Embedded videos are served from our own server, not YouTube or Vimeo, so they set no third-party cookies.

We update this policy whenever the way we process data or the list of providers changes. The current version is always available at this address, with the date of the last change at the top of the page.

For anything related to personal data, email hello@dopest.studio. We reply within 24 hours on business days and handle requests to exercise your rights within a month at the latest.