Privacy policy
Last updated: .
1. Data controller
The controller of personal data is L4web, Bobowa Węgierska 24, 38-350 Bobowa, Poland. Tax ID (NIP): 738-215-18-87, business register (REGON): 366685885. Contact: kontakt@l4web.pl, tel. +48 608 183 994.
2. What we collect
We only collect data you give us yourself:
- through the contact form: name, e-mail address, optionally a phone number, the message, the selected topic and an indicative budget;
- by e-mail or phone: whatever you choose to tell us during the conversation;
- in server logs: IP address, date and time of the request, the URL and the browser type — recorded automatically by the server software.
3. Purpose and legal basis
- Replying to your enquiry — Art. 6(1)(a) and (b) GDPR (consent, and steps prior to entering a contract).
- Delivering and invoicing a project — Art. 6(1)(b) and (c) GDPR (contract, and tax and accounting obligations).
- Site security and legal claims — Art. 6(1)(f) GDPR (legitimate interest of the controller).
4. Retention
- Correspondence that does not lead to a project — up to 12 months from the last contact.
- Data relating to a signed contract — for the term of the contract plus 5 years from the end of the tax year in which payment fell due.
- Server logs — up to 90 days.
5. Recipients
Data may be entrusted to providers we need in order to operate: hosting and e-mail providers, and our accountancy office. Each acts under a data processing agreement. We do not sell or share data for marketing purposes.
We use two Google Ireland Limited services — Google Analytics and reCAPTCHA, described in sections 7 and 8. Through them data may be transferred to the United States under the European Commission's adequacy decision of 10 July 2023 for the EU–US Data Privacy Framework. Otherwise data does not leave the European Economic Area.
6. Your rights
You have the right to:
- access your data and receive a copy of it;
- have inaccurate or incomplete data corrected;
- have data erased and processing restricted;
- data portability;
- object to processing based on legitimate interest;
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
- lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
We act on requests promptly once they reach kontakt@l4web.pl.
7. Cookies and analytics
This site shows no advertising, does not profile visitors and loads no social media plugins. We use one measurement tool — Google Analytics 4 — and it runs only after you explicitly agree.
Until you agree, no Google script is fetched at all and no analytics
cookies are set. We use Google Consent Mode v2 with every consent category defaulting to
denied. Consent is collected through a banner shown on your first visit, and your choice is
stored in your browser's local storage (key l4web-consent-v1) — it is not a
cookie and it is never transmitted anywhere.
Once you agree, Google Analytics sets the _ga and _ga_* cookies
(retained for up to 2 years) and collects the pages you visit, your approximate city-level
location, device type and referral source. Google truncates your IP address before storing
it. The legal basis is Art. 6(1)(a) GDPR — your consent.
You can withdraw or narrow consent at any time — use the "cookie settings" link in the footer of any page. It opens a panel with separate switches for analytics and advertising signals. You can also clear cookies in your browser settings or install Google's Analytics opt-out add-on.
Consent categories
We use Google Consent Mode v2. Your choice in the panel maps directly onto the four signals sent to Google — every one of them starts as denied:
| Category | Consent Mode v2 signals | Default |
|---|---|---|
| Necessary | functionality_storage, security_storage |
granted (the site does not work without them) |
| Analytics | analytics_storage |
denied |
| Advertising | ad_storage, ad_user_data, ad_personalization |
denied |
We additionally enable ads_data_redaction (ad click identifiers are stripped
while consent is denied) and url_passthrough (campaign data travels in the URL
rather than in a cookie).
Cookies and local storage in use
| Name | Type | Category | Retention | Purpose |
|---|---|---|---|---|
l4web-consent |
local storage | necessary | 12 months | Remembers your consent choice and when you made it. Never transmitted anywhere. |
_GRECAPTCHA |
Google cookie | necessary | 6 months | Spam protection for the contact form. Set only once you start filling the form in. |
_ga |
Google cookie | analytics | 2 years | Distinguishes visitors in Google Analytics 4. |
_ga_<ID> |
Google cookie | analytics | 2 years | Maintains session state in Google Analytics 4. |
Analytics cookies appear only after you have agreed. Until then your browser makes no connection to Google Analytics servers at all.
The performance figures shown on the homepage are calculated in your own browser from the standard Performance API. They are never sent or stored anywhere and work regardless of your analytics choice.
8. reCAPTCHA
The contact form is protected by Google reCAPTCHA v3, which distinguishes people from bots without asking you to solve a puzzle. The reCAPTCHA script loads only once you begin filling the form in — simply opening the contact page contacts Google not at all.
To perform the check, Google analyses how the page is being used (cursor movement, IP address and browser information among others) and returns to us only a numeric score between 0 and 1. We receive no personal data from that process. The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in protecting the form from spam.
Use of the form is subject to the Google Privacy Policy and Terms of Service. If you would rather not use reCAPTCHA, write to us directly at kontakt@l4web.pl or call +48 608 183 994.
9. Security
The site is served exclusively over encrypted HTTPS. The inbox that receives form submissions is protected by two-factor authentication. The form itself is protected by a bot trap, reCAPTCHA verification and a rate limit per IP address.
10. Changes to this policy
The current version is always available at this address, with the date of the last change at the top. Clients under contract are told about material changes directly.