Privacy policy

1. Basic information

The controller of personal data in connection with the ValueMind website is ValueMind Sp. z o.o., registered office in Warsaw, Al. Wilanowska 325/3, 02-665 Warszawa, KRS 0000802743, NIP 5213875707, referred to as the “Controller”. The website is available at valuemind.pl.

Contact for data protection matters and exercising your rights: contact@valuemind.pl, and by post: ValueMind Sp. z o.o., Al. Wilanowska 325/3, 02-665 Warszawa.

This policy covers browsing the website, contact by form and email, and statistics on visits and form operation. The Controller processes data in accordance with the GDPR. Providing contact details is voluntary, but the form cannot be submitted without the required information.

2. Short version

• We process data only for a specific purpose and on an appropriate legal basis.
• The form is used to respond to your enquiry. Your message passes through Web3Forms to the ValueMind mailbox; the form provider may also store the submission.
• Cloudflare provides website hosting and security. Umami Cloud measures visits, traffic sources and three form events. Form field contents are not sent to our analytics integration.
• We do not use cookies to measure visits or record sessions. A manual opt-out from Umami measurement can be stored in localStorage, as described in section 7.
• You have the rights described in section 3, including the right to object to processing based on legitimate interests and to complain to the President of the Polish Personal Data Protection Office.

3. Your rights

In connection with the processing of personal data, you have the rights provided by the GDPR, in particular:

1. access to your data and a copy of it;
2. rectification;
3. erasure;
4. restriction of processing;
5. objection, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR;
6. data portability where processing is automated and based on consent or a contract;
7. withdrawal of consent where it is the basis for processing, without affecting the lawfulness of earlier processing;
8. a complaint to the President of the Polish Personal Data Protection Office (uodo.gov.pl).

Not every right applies in every situation. Their scope depends on the purpose and legal basis of processing. To exercise your rights or request information about your data, contact the Controller using the details in section 1. Submitting the form does not constitute consent to processing; its legal bases are described in section 6.2.

4. Data recipients and service providers

Data may be received by authorised people handling enquiries and by providers supporting the website and communications:

Provider / category	Scope and purpose
Cloudflare, Inc.	Serving static files through Cloudflare Workers, traffic handling and security.
Web3Creative, operator of Web3Forms	Receiving, validating, storing and forwarding form submissions to ValueMind. Infrastructure and spam prevention subprocessors are described in section 6.2.
Umami Software, Inc.	Analytics of visits, traffic sources and form events in Umami Cloud, without field contents.
UTI.PL S.A., Kielce, ul. Olszewskiego 6	Hosting the ValueMind mailbox and handling email correspondence.
LinkedIn	A separate recipient only after you follow a profile link, under that platform’s terms.

Team and company LinkedIn profiles are ordinary links without embedded widgets. After you follow a link to LinkedIn, the LinkedIn Privacy Policy applies.

Statistical reports are available to people maintaining the website through a view-only link (Share URL), without the ability to make changes. Reports contain no form contents or data identifying individuals. Data may also be disclosed to authorities or other entities entitled to receive it under law.

5. Transfers outside the EEA

Web3Creative operates from India and uses infrastructure in several regions. Form data may be transferred outside the European Economic Area, including through subprocessors. The Web3Forms DPA provides for Standard Contractual Clauses for transfers requiring such a mechanism. The exact submission database region has not been confirmed; Hetzner infrastructure in Germany and Finland does not mean all data remains in the EEA.

Cloudflare and Umami use international infrastructure. Both providers’ DPAs provide for transfer mechanisms, including Standard Contractual Clauses where applicable. Selecting an EU region in Umami does not in itself confirm the location of all operations, access and backups.

Information about safeguards for transfers outside the EEA, including how to obtain a copy, is available from the Controller at contact@valuemind.pl. Providers process data under their data protection documents and the agreements governing the services used.

6. Purposes, legal bases and retention periods

6.1. Website use and logs

The website consists of static files served by Cloudflare Workers. When handling requests, Cloudflare processes technical data which may include IP addresses, traffic routing data, system configuration and information about traffic to and from the website. The scope depends on the service provided.

The purposes are website availability, security and diagnostics. The legal basis for processing personal data is the Controller’s legitimate interest in maintaining and protecting the website, Article 6(1)(f) GDPR. We do not use logs to identify visitors unless necessary to investigate an incident or establish, exercise or defend legal claims.

The website does not maintain its own request log database or archive. The hosting provider processes technical data for the time needed to handle traffic, security and diagnostics, under the rules and settings of the Cloudflare service. Data relating to a specific incident may be retained while it is investigated and for the period necessary to establish, exercise or defend legal claims.

6.2. Email contact and the form

The form collects your name, email address, optional company name and message. Name, email and message are required. Please give a general outline of your matter without unnecessary third-party data or sensitive information. For email contact, we process the data contained in the correspondence.

The purposes are responding to enquiries, handling correspondence and, where relevant, establishing, exercising or defending legal claims. The basis is the Controller’s legitimate interest, Article 6(1)(f) GDPR; where we take steps at your request before entering into a contract, Article 6(1)(b) GDPR applies. We do not require consent to handle an enquiry. Omitting required data prevents form submission, and without a reply address we cannot respond.

On submission, data is sent to Web3Forms and then to the ValueMind mailbox. Web3Forms also processes technical submission metadata, such as IP address and submission time. According to its Privacy Policy and DPA dated 13 July 2026, submissions are stored in an encrypted AWS database for up to 3 years by default, unless a shorter period or earlier deletion applies. Dashboard history visibility is not the data retention period.

Web3Forms subprocessors include AWS, Cloudflare and Hetzner (Germany and Finland), and spam prevention services CleanTalk and Akismet (Automattic), which may receive the sender’s IP address and email. The provider states that server logs are regularly deleted. Submissions are retained under the Web3Forms rules described above; we do not claim that form data is located exclusively in the EEA.

We retain correspondence while handling the enquiry or working together. We then keep only messages needed to establish, exercise or defend legal claims until the limitation period applicable to the matter expires. Copies held by the email provider are retained under the terms of that service. Deleting a message from the mailbox does not automatically delete its copy at Web3Forms.

6.9. Analytics and statistics

Analytics aims to understand visits, traffic sources, content effectiveness and form operation, and to improve website performance. Insofar as the information constitutes personal data, the basis is the Controller’s legitimate interest, Article 6(1)(f) GDPR, in maintaining limited statistics and improving the website.

Umami Cloud. Measures pageviews, referrers, browser, operating system, device type and country, UTM parameters, and the events inquiry_started, inquiry_sent and inquiry_failed. These represent the start of form editing, confirmed API success and submission failure; API success does not confirm email delivery. Events contain no form field contents. Page URLs, referrers and UTM may be measured, so they must not contain personal data. We do not add an identifier for a specific person or record sessions.

Umami does not use cookies; the provider states that it anonymises data. The script may read a manually set umami.disabled opt-out flag in localStorage. Our integration does not write that flag. The version selected for this website is Umami Cloud in the EU region, on the Hobby plan with 6 months of data retention. Choosing the EU region does not mean all provider operations, access and backups are located exclusively in the EEA.

This version of the website does not display an analytics consent banner. We do not use marketing tools or session recording.

7. Cookies and similar technologies

The public website does not use cookies or similar browser storage to track visits. The exception to the absence of storage is a voluntarily set Umami opt-out flag, used to disable measurement rather than track visitors. You can set it for this domain in the browser console with localStorage.setItem('umami.disabled', '1'), and remove it with localStorage.removeItem('umami.disabled'). The setting applies to that browser and domain and remains until removed.

Cloudflare Access cookies apply only to protected previews, not to the public website described by this policy.

8. Automated decision-making and profiling

The Controller does not profile users or make decisions about them based solely on automated processing that produce legal effects or similarly significantly affect them. Statistics are used to assess website operation, not specific individuals.

9. Data security

The Controller selects technical and organisational measures appropriate to the scope of processing and the risks. Data protection includes limiting access to people and entities that need it for specified purposes and using encrypted HTTPS transmission. Providers process data under their service terms and the relevant data processing agreements.

10. Changes to this privacy policy

This policy may be updated if legislation, tools, website features or the scope of processing changes. The current version is available on the website at this address.

Last updated: 3 November 2026.