1. Controller
The controller of your personal data is Paweł Porowski, running a business under the name Lykta Paweł Porowski, ul. Władysława Pytlasińskiego 16/13, 00-777 Warsaw, Poland, tax ID (NIP) 9661363371, REGON 541716521 (the “Controller”).
For any data protection matter you can contact us:
- by email: biuro@lyktaofficial.eu,
- by post: at the Controller’s address above.
The Controller has not appointed a data protection officer because it is not required to do so (Article 37 GDPR).
This policy applies to the website available at https://lyktaofficial.eu (the “Website”). It sets out how we process personal data under Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and how we use cookies under Article 399 of the Polish Electronic Communications Law of 12 July 2024.
2. Purposes, legal bases and retention periods
We process only the data needed for a given purpose. Each purpose has its own legal basis and retention period.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering enquiries sent via the contact form or by email | name, email, phone number, company, message | Article 6(1)(f) GDPR – legitimate interest in answering the enquiry; where the enquiry concerns entering into a contract – Article 6(1)(b) GDPR | until the correspondence ends, no longer than 12 months after the last message, unless a contract is concluded |
| Preparing an offer, concluding and performing a contract | client contact and identification data | Article 6(1)(b) GDPR | for the term of the contract and then until claims become time-barred |
| Contact with representatives of clients and business partners (B2B) | name, position, business email and phone | Article 6(1)(f) GDPR – legitimate interest in performing the contract with the entity the person represents | for the duration of cooperation with that entity and then until claims become time-barred |
| Invoicing, tax and accounting obligations | data on invoices and accounting records | Article 6(1)(c) GDPR in conjunction with tax and accounting laws | 5 years from the end of the calendar year in which the tax payment deadline expired |
| Establishing, exercising or defending legal claims | data needed to prove a claim | Article 6(1)(f) GDPR – legitimate interest in protecting the Controller’s rights | until claims become time-barred or proceedings are finally concluded |
| Website security and spam protection of the form | IP address, technical data, server logs | Article 6(1)(f) GDPR – legitimate interest in keeping the Website secure | server logs: according to the hosting provider’s settings, as a rule no longer than 90 days |
| Visitor statistics (Google Analytics 4) | cookie identifiers, device data and data on how the Website is used | Article 6(1)(a) GDPR in conjunction with Article 399 of the Polish Electronic Communications Law – consent | until consent is withdrawn; data kept in Google Analytics for 14 months |
| Managing and documenting cookie consents | consent ID, date and scope of choice, shortened IP address | Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR – obligation to demonstrate consent | 12 months from the choice being made |
Data in the contact form comes directly from you. If you contact us on behalf of a company or institution, or were named as a contact person, we may have received your data from that entity.
The Website is not used to send newsletters or marketing messages. If we ever wish to send you marketing information electronically, we will do so only with your separate consent (Article 398 of the Polish Electronic Communications Law).
3. Recipients and transfers outside the EEA
We do not sell your data. We share it only with entities that help us run the Website and our business, under data processing agreements:
- Hostinger International Ltd., 61 Lordou Vironos, 6023 Larnaca, Cyprus – Website hosting and sending messages from the contact form,
- Google Cloud EMEA Limited (Ireland) – email in Google Workspace,
- Google Ireland Limited (Ireland) – Google Analytics 4, only after you give consent,
- our accounting office – for accounting documents,
- IT service providers, law firms and advisers – where necessary.
Public authorities may also receive data where required by law.
Using Google Analytics and Google Workspace email may involve transferring data to Google LLC in the USA. The transfer is based on the European Commission decision of 10 July 2023 on the adequate level of protection under the EU-US Data Privacy Framework (Article 45 GDPR), supplemented by standard contractual clauses (Article 46(2)(c) GDPR). Otherwise, we do not transfer data outside the European Economic Area.
4. Your rights
Under the GDPR you have the right to:
- access your data and obtain a copy (Article 15),
- rectification (Article 16),
- erasure (Article 17),
- restriction of processing (Article 18),
- data portability for data processed on the basis of consent or a contract (Article 20),
- object to processing based on the Controller’s legitimate interest, on grounds relating to your particular situation (Article 21),
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Article 7(3)),
- lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
Send requests to biuro@lyktaofficial.eu. We will reply without undue delay and in any event within one month. You can withdraw cookie consent at any time via the “Privacy settings” link in the Website footer.
5. Voluntary provision, profiling and security
Providing data is voluntary. Without contact details we cannot answer your enquiry, and without data required by law we cannot conclude a contract or issue an invoice.
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
We apply technical and organisational measures appropriate to the risk, including encrypted connections (SSL/TLS), regular updates of the Website software, backups and restricted access to data.
6. Cookies
Cookies are small files stored on your device. We treat similar technologies, such as local storage, the same way.
Under Article 399 of the Polish Electronic Communications Law, we use cookies strictly necessary for the Website to work without consent. All others, including statistics cookies, are stored only after you consent in the banner. You can accept all, reject all or choose categories. Refusing does not limit access to the Website.
You can change or withdraw your choices at any time via the “Privacy settings” link in the footer. You can also delete or block cookies in your browser settings.
| Category | Name | Provider | Purpose | Retention | Basis |
|---|---|---|---|---|---|
| Necessary | real_cookie_banner* | Controller (Real Cookie Banner plugin) | remembering your cookie choices | 365 days | no consent required (Article 399(3) PKE) |
| Necessary | real_cookie_banner-test | Controller (Real Cookie Banner plugin) | checking whether the browser accepts cookies | deleted right after the test | no consent required (Article 399(3) PKE) |
| Statistics | _ga | Google Ireland Limited (Google Analytics 4) | distinguishing users for statistics | 2 years | consent |
| Statistics | _ga_<ID> | Google Ireland Limited (Google Analytics 4) | keeping session state for statistics | 2 years | consent |
The Google Analytics script is blocked until you give consent, so without your consent it stores no cookies. More on how Google processes data: https://policies.google.com/privacy.
7. Changes to this policy
We update this policy when the law, the tools used on the Website or the way we process data change. The current version is always available on the Website.
Last updated: 6 October 2026.