Privacy policy

1. General information

This Privacy and Cookie Policy (the “Policy”) explains how personal data are processed in connection with the use of the website available at https://digitaldumpling.studio/ (the “Website”), contacting Digital Dumpling, submitting an enquiry, requesting a meeting and using cookies and similar technologies.

This Policy applies to the Website. The processing of data in connection with the subsequent conclusion and performance of an agreement with a client or cooperation with a contractor may be described in a separate privacy notice.

2. Joint controllers of personal data

The joint controllers of personal data processed in connection with the Website are:

1. Adam Wójtowicz, carrying on business under the registered business name Adam Wójtowicz Nowe Multimedia, Tax Identification Number (NIP): 7781444823, National Official Business Register Number (REGON): 381405115;
2. Magdalena Marek, carrying on business under the registered business name Magdalena Marek Ogarnie, Tax Identification Number (NIP): 8431576973, National Official Business Register Number (REGON): 520796203;

who jointly carry on business as Digital Dumpling Spółka Cywilna, with its registered address at Łopuchowo 9B, 62-095 Łopuchowo, Poland, Tax Identification Number (NIP): 7773443890, National Official Business Register Number (REGON): 541250790 (the “Joint Controllers” or “Digital Dumpling”).

The Joint Controllers jointly determine the purposes and means of processing personal data in connection with the Website and are jointly responsible for complying with their obligations under data protection legislation. The common contact point for privacy-related matters is:

• email address: hello@digitaldumpling.studio;
• postal address: Digital Dumpling Spółka Cywilna, Łopuchowo 9B, 62-095 Łopuchowo, Poland.

Rights under the GDPR may be exercised against either Joint Controller. Sending a request to the common contact address will help ensure that it is handled efficiently.

3. How we obtain data

Data may be obtained:

• directly from the user when they complete a form, submit attachments, contact us by email or telephone, or request a meeting;
• automatically when the Website is used — in the form of technical logs, online identifiers and data stored or accessed using cookies and similar technologies;
• from providers of analytics and marketing tools — solely to the extent resulting from the Website settings and the choice made by the user in the consent panel;
• from a person who provides a testimonial or consents to its publication.

4. Purposes, scope and legal bases for processing

4.1. Use of the Website and technical logs

When the Website is used, technical data may be recorded automatically, such as the IP address, connection time, address of the page visited, referring page address, browser and device type, operating system, and information about errors and technical events.

These data are processed to ensure the correct and secure operation of the Website, diagnose errors, prevent misuse, create backups and document incidents. The legal basis is the legitimate interests of the Joint Controllers in maintaining the security, availability and correct operation of the Website (Article 6(1)(f) of the GDPR).

4.2. Contact form and correspondence

The contact form may include the following data:

• first name and surname;
• company name;
• email address;
• telephone number;
• message content;
• the content and metadata of up to five attachments added voluntarily.

The data are used to receive and handle the enquiry, prepare a response, provide information about services, conduct further correspondence and — where the enquiry concerns potential cooperation — take steps prior to entering into an agreement.

The legal basis for processing is:

• Article 6(1)(b) of the GDPR — where contact is made to obtain a quotation, discuss a project or take other steps at the person’s request before entering into an agreement;
• Article 6(1)(f) of the GDPR — in other cases, on the basis of the Joint Controllers’ legitimate interests in conducting correspondence, responding to enquiries and developing business relationships;
• Article 6(1)(f) of the GDPR — for the establishment, exercise or defence of legal claims, where necessary.

Submissions are sent to a mailbox operated using Zoho Mail and stored in Elementor Submissions in the Website database maintained on Zenbox hosting. Data are not automatically transferred to a CRM or project management system.

4.3. “Book a call” form

The “Book a call” form is used to request contact and arrange a conversation about potential cooperation. The Joint Controllers process the data entered in the form, in particular identification and contact details, company information and the message content.

The legal basis is taking steps at the person’s request before entering into an agreement (Article 6(1)(b) of the GDPR) and, with regard to organising communications, documenting arrangements and safeguarding legal claims, the legitimate interests of the Joint Controllers (Article 6(1)(f) of the GDPR).

The form does not use an external booking system. The time of the call is agreed directly by correspondence or telephone. Telephone calls are not recorded.

4.4. Attachments and data included in messages

Attachments are voluntary. Users should provide only the information necessary to handle their enquiry and ensure that they have the right to disclose the data contained in the attachments. Passwords, access credentials, identity documents, financial data, special categories of personal data or data relating to other persons should not be sent through the forms unless this is necessary and there is an appropriate legal basis for providing them.

If data beyond the scope required to handle the matter are provided, they may be deleted or disregarded.

4.5. Publication of testimonials

The Website may publish testimonials containing the first name and surname of a business owner and the content of their statement. Publication takes place after obtaining the consent of the person providing the testimonial (Article 6(1)(a) of the GDPR) and within the scope agreed with that person.

Consent to publication may be withdrawn at any time by contacting hello@digitaldumpling.studio. Withdrawal of consent does not affect the lawfulness of publication carried out before its withdrawal.

4.6. Website analytics

The Website uses Google Analytics 4 together with Google Consent Mode v2. Before a consent choice is made, analytics and advertising data storage settings are set to “denied” by default. The Google tag may be loaded in this restricted mode and transmit a signal concerning the consent status and limited technical data without storing optional identifiers on the device. Full analytics functionality and the related cookies are enabled after consent to analytics has been given.

The legal basis for processing is the user’s consent (Article 6(1)(a) of the GDPR) and the consent to store or access information on a device required under the Polish Electronic Communications Law. Consent may be withdrawn or changed at any time in the cookie settings.

4.7. Advertising measurement, remarketing and audience creation

After consent to marketing cookies has been given, the Website uses Meta Pixel. This tool is used to measure the effectiveness of advertising activities, analyse conversions, conduct remarketing and create advertising audiences in Meta services such as Facebook and Instagram.

Meta may combine information about activity on the Website with other information it holds about the user, particularly where the user uses Meta products. The legal basis for processing by the Joint Controllers is consent (Article 6(1)(a) of the GDPR) and the consent required under the Polish Electronic Communications Law.

4.8. Managing cookie consent

The Website uses the GDPR Cookie Compliance plugin provided by Moove Agency. The tool records cookie choices and allows users to change or withdraw consent. Information about the user’s choice is stored locally within the Website. The plugin provider states that it does not collect Website users’ data on its servers.

The legal basis for processing information required to record and demonstrate the user’s choice is the obligation to provide a legally compliant consent mechanism (Article 6(1)(c) of the GDPR) and the legitimate interests of the Joint Controllers in demonstrating compliance with applicable legislation (Article 6(1)(f) of the GDPR).

5. Whether providing data is mandatory

Providing data is voluntary; however, data marked as required in a form are necessary to submit an enquiry and receive a response. Without contact details, it may not be possible to handle an enquiry or arrange a call.

Adding attachments, providing a telephone number and consenting to the publication of a testimonial are voluntary unless a particular form states otherwise. Consent to analytics and marketing cookies is also voluntary, and refusing it does not restrict access to the Website’s basic content.

6. Recipients of data

Personal data are not sold. They may be disclosed or entrusted to the following categories of recipients, solely to the extent required for the purposes described:

• the hosting service provider operating under the Zenbox brand — in connection with maintaining the Website, the Elementor Submissions database, logs and backups;
• Zoho and members of its group — in connection with the operation of email through Zoho Mail;
• providers of technical support for WordPress, Elementor and the Website — where access to data is necessary to remedy a failure or carry out technical work;
• Google Ireland Limited and members of the Google group — in connection with Google Analytics 4, Google Tag Manager, Google Consent Mode v2, reCAPTCHA and YouTube content;
• Meta Platforms Ireland Limited and members of the Meta group — in connection with Meta Pixel, advertising measurement, remarketing and audience creation;
• Adobe and members of its group — in connection with the provision of Adobe Fonts;
• the accounting software provider, accountancy firm, banks, legal and tax advisers — if an enquiry results in an agreement or where settlement or protection of the Joint Controllers’ rights becomes necessary;
• public authorities and other authorised bodies — where disclosure is required by law.

The Joint Controllers do not use an external CRM or project management system to automatically handle submissions from the Website and do not share such submissions with freelancers or other studios.

7. Transfers of data outside the European Economic Area

In connection with the use of Zoho, Google, Meta, Adobe and YouTube services, data may be processed outside the European Economic Area (the “EEA”), particularly in the United States or in countries where the providers and their subprocessors maintain infrastructure or provide technical support.

Transfers of data outside the EEA are carried out using mechanisms permitted under the GDPR, in particular:

• an adequacy decision issued by the European Commission;
• the EU–US Data Privacy Framework — in relation to certified organisations in the United States;
• standard contractual clauses approved by the European Commission and, where necessary, additional safeguards.

Information about the safeguards used may be obtained by contacting the Joint Controllers.

8. Data retention periods

Data are retained for no longer than necessary to fulfil the purpose for which they were collected, taking account of legal obligations and applicable limitation periods. In particular:

• data from the contact form and “Book a call” form, attachments and related correspondence — for up to 12 months after the contact has ended;
• where contact results in an agreement or the data become necessary for the establishment, exercise or defence of legal claims — for the term of the agreement and until the applicable limitation period has expired;
• data included in tax or accounting records — for the period required under the relevant legislation;
• submissions stored in Elementor Submissions and their copies in Zoho Mail — for no longer than 12 months, unless one of the grounds for further retention specified above applies;
• data in backups — until the backup is overwritten or deleted in the hosting provider’s ordinary backup cycle;
• server and security logs — as a rule, for up to 12 months, unless longer retention is necessary to investigate an incident, prevent misuse or safeguard legal claims;
• Google Analytics 4 user and event data — for up to 14 months; aggregated reports that do not identify a user may be retained for longer;
• data processed on the basis of cookie consent — until consent is withdrawn or the relevant identifier expires;
• information used to demonstrate a cookie choice — for the duration of the choice and for the period necessary to demonstrate compliance with the law;
• testimonials — until consent is withdrawn or publication ends earlier.

9. Rights of data subjects

Subject to the conditions set out in the GDPR, a data subject may have the right to:

• access their data and obtain a copy;
• rectify inaccurate data and complete incomplete data;
• have their data erased;
• restrict processing;
• data portability — where data are processed by automated means on the basis of consent or an agreement;
• object to processing based on the legitimate interests of the Joint Controllers, on grounds relating to the data subject’s particular situation;
• object at any time to the processing of data for direct marketing purposes;
• withdraw consent at any time — without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

To exercise these rights, please write to hello@digitaldumpling.studio. The Joint Controllers may request information required to verify the identity of the person submitting the request where this is necessary to protect personal data.

A person who considers that their data are being processed unlawfully has the right to lodge a complaint with the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych). Information about lodging complaints is available at uodo.gov.pl.

10. Automated decision-making and profiling

The Joint Controllers do not make decisions concerning users based solely on automated processing which produce legal effects or similarly significantly affect them.

After consent has been given, Meta Pixel may be used to analyse user activity, conduct remarketing and assign users to advertising audiences. Google Analytics 4 may be used to analyse behaviour on the Website. These activities may constitute profiling, but they are not used to make decisions producing the significant effects described above.

11. Cookies and similar technologies

11.1. What cookies are

Cookies are small text files stored on a user’s device when they use the Website. Similar technologies may include pixels, tags and identifiers stored or accessed by a browser. They enable, among other things, the correct operation of the Website, the recording of cookie choices, form protection, the creation of statistics and the evaluation of advertising effectiveness.

Cookies may be session cookies — deleted when the browser is closed — or persistent cookies, stored until a specified period expires or they are deleted manually. They may be set by Digital Dumpling or by providers of external services.

11.2. Categories of cookies used

• necessary — required for the operation of the Website, security, form protection and recording the user’s choice;
• functional and external-content cookies — enabling additional functionality, including embedded content;
• analytics cookies — helping measure traffic and how the Website is used;
• marketing cookies — used for advertising measurement, remarketing and audience creation.

11.3. Main tools using cookies or similar technologies

The names, functions and lifetimes of individual cookies may change as providers update their services. The user’s current choice is available in the cookie settings panel.

11.4. Giving and withdrawing consent

Necessary cookies may operate without additional consent to the extent permitted by law. Functional cookies relating to optional external content, analytics cookies and marketing cookies are enabled after the appropriate choice has been made in the GDPR Cookie Compliance panel.

Users may accept or reject optional categories of cookies and subsequently change or withdraw their choice at any time. Withdrawal of consent does not affect the lawfulness of actions taken before consent was withdrawn.

Change cookie settings

Cookies may also be deleted or blocked in the browser settings. Restricting necessary cookies may prevent certain Website functions from operating correctly.

12. External services available on the Website

12.1. Google Analytics 4 and Google Tag Manager

Google Analytics 4 and Google Tag Manager are provided by Google Ireland Limited. Before consent, the default Consent Mode v2 signals indicate that analytics and advertising storage has been denied. Cookies and the full functionality of Google Analytics 4 are enabled after consent to analytics has been given, and the retention period for user and event data is up to 14 months. Google Tag Manager is used for technical tag management and respects the choice communicated through the consent mechanism.

Further information: Google Privacy Policy.

12.2. Meta Pixel

Meta Pixel is provided by Meta Platforms Ireland Limited. Within a specified scope relating to the collection of event data, measurement and advertising matching, Digital Dumpling and Meta may act as joint controllers. Meta is independently responsible for the subsequent processing of data within its services.

Further information: Meta Privacy Policy and Meta Cookies Policy.

12.3. Google reCAPTCHA

The forms are protected using Google reCAPTCHA. The service analyses technical information and interactions with a form to distinguish user activity from automated misuse. Google may receive, among other things, the IP address, device and browser parameters, and information about interactions with the Website.

The legal basis for processing by the Joint Controllers is their legitimate interest in protecting the forms and the Website against spam, bots and misuse (Article 6(1)(f) of the GDPR). Information about processing by Google is available in the Google Privacy Policy.

12.4. YouTube

The Website may contain video content embedded from YouTube. Activating the player may cause information about the device, IP address, page visited and interaction with the content to be transferred to Google, even where the user is not signed in to a Google account. The player is activated after the appropriate consent has been given in the cookie settings.

12.5. Adobe Fonts

The Website uses typefaces provided by Adobe Fonts through the use.typekit.net domain. When fonts are downloaded, the browser connects to Adobe servers and transmits the technical data required to deliver the files, including the IP address. According to information provided by Adobe, the Adobe Fonts service for websites does not set cookies to deliver fonts, and the IP address is received to deliver the file but is not stored by the service.

The legal basis for processing by the Joint Controllers is their legitimate interest in ensuring a consistent and legible presentation of the Website (Article 6(1)(f) of the GDPR). Further information: Adobe Fonts privacy information.

12.6. Links to social media services

The Website contains links to Digital Dumpling profiles on Facebook, Instagram and LinkedIn. A standard link does not itself transfer data to these services until it is used. After clicking the link, the user is taken to the external operator’s website, where data are processed in accordance with that operator’s own privacy rules.

13. Data security

The Joint Controllers apply organisational and technical measures appropriate to the nature of the data and the identified risks, including SSL/TLS transmission encryption, restricting access to authorised persons, updating software, using secure passwords and the automatic creation of backups by the hosting provider.

No method of transmitting or storing data can guarantee complete security. The safeguards used are adapted to technological and organisational changes and identified threats.

14. Minors

Digital Dumpling’s services and the Website are intended primarily for businesses and other commercial clients, rather than being directed at children. The Joint Controllers do not intend knowingly to obtain children’s data through the Website without an appropriate legal basis.

15. Changes to this Policy

This Policy may be updated in response to changes to the Website, the tools used, processing activities or applicable legislation. The current version will be published on the Website. Where the nature of a change requires it, users will be appropriately informed or asked to provide consent again.