Privacy Policy of hrespresso.pl

Last updated: September 9, 2026

1. Definitions

Controller (We) – HR ESPRESSO SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. św. Judy Tadeusza 10, 52-116 Iwiny, Poland, Tax ID (NIP): 8961626650, REGON: 525638319, KRS: 0001043231, share capital: PLN 5,000.

Personal data – any information about an identified or identifiable natural person, including a device's IP address, location data, an online identifier, and information collected via cookies and similar technologies.

GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

Website – the website operated at hrespresso.pl.

User (You) – any natural person visiting the Website or using its functionalities.

2. Data controller and contact

The controller of your personal data is HR ESPRESSO SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, based in Iwiny, Poland (ul. św. Judy Tadeusza 10, 52-116 Iwiny), entered in the register of entrepreneurs under KRS number 0001043231, Tax ID (NIP) 8961626650, REGON 525638319. For any matters relating to the processing of your data, you can contact us:

• by e-mail: biuro@hrespresso.pl
• by post: ul. św. Judy Tadeusza 10, 52-116 Iwiny, Poland

3. Purposes and legal grounds for processing

Use of the Website

We process the personal data of Website users (IP address, identifiers, and information collected through cookies) for the purposes of:

• providing services electronically (making the Website's content available) – legal basis: necessity for the performance of a contract (Art. 6(1)(b) GDPR);
• ensuring the security and proper functioning of the Website, including system logs – legal basis: our legitimate interest (Art. 6(1)(f) GDPR);
• the possible establishment, exercise, or defence of legal claims – legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

Traffic analysis and visit statistics (Google Analytics 4) and advertising activities (Google Ads, Meta Ads) are not covered by the above basis – we describe them separately in section 5, as they require your consent.

Contact forms

The Website provides contact forms (including a form for booking a free consultation and a general contact form). Providing the data marked as mandatory is necessary to handle your inquiry; other data is provided voluntarily.

We process data from the forms for the purpose of:

• identifying the sender and handling the inquiry – legal basis: necessity to take steps prior to entering into a contract / performance of a contract (Art. 6(1)(b) GDPR);
• the possible establishment, exercise, or defence of legal claims – legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

Newsletter

If you sign up for the newsletter by providing your e-mail address, we process it for the purpose of:

• sending the newsletter – legal basis: your consent (Art. 6(1)(a) GDPR);
• analysing the effectiveness of our mailings (e.g. opens, clicks) – legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

You can withdraw your consent to the newsletter at any time by clicking the "unsubscribe" link in the footer of any message, without affecting the lawfulness of processing carried out before its withdrawal.

4. Marketing

With your consent, we direct marketing content to you, including advertising on Google Ads and Meta Ads, in particular in the form of remarketing ads tailored to your previous activity on the Website. Details of the specific technologies used for this purpose are described in section 5.

You can withdraw your consent to the processing of data for marketing purposes at any time – see section 6.

5. Cookies and similar technologies

Cookies are small text files stored on your device while you use the Website. We use three categories of cookies on the Website, which you manage yourself using the consent banner shown on your first visit and available afterwards as described in section 6.

Necessary cookies

These ensure the basic functioning of the Website (e.g. remembering your choices in the consent banner, form security). They do not require consent – without them, the Website would not function properly. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in ensuring the Website functions) in conjunction with Art. 173(3) of the Polish Telecommunications Law.

Analytics cookies (require consent)

We use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to analyse traffic on the Website – the number of visits, pages viewed, and time spent on the site. This data is collected in aggregated form and is not used to directly identify the User.

• Legal basis: your consent (Art. 6(1)(a) GDPR in conjunction with Art. 173 of the Polish Telecommunications Law) – Google Analytics 4 only runs in your browser after you give consent in the cookie banner.
• Data retention period in Google Analytics: up to 14 months.
• Google may process data outside the European Economic Area (USA), based on standard contractual clauses approved by the European Commission. More information: policies.google.com/privacy.

Advertising cookies (require consent)

We use the remarketing tools Google Ads and Meta Ads to display ads tailored to your previous activity on the Website.

Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) – the conversion and remarketing tag sets cookies (including _gcl_au) used to measure campaign effectiveness and display remarketing ads, stored for up to 90 days. More information: policies.google.com/privacy.

Meta Ads / Meta Pixel (Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) – sets cookies (including _fbp, _fbc) used to measure ad effectiveness and display ads tailored to your activity on the Website on Facebook and Instagram, stored for up to 90 days. More information: facebook.com/policy.php.

• Legal basis for both of the above: your consent (Art. 6(1)(a) GDPR in conjunction with Art. 173 of the Polish Telecommunications Law). These technologies only run after you give consent to the "advertising" category in the cookie banner.
• The controllers (Google, Meta) may process data outside the European Economic Area (USA), based on standard contractual clauses approved by the European Commission.

6. Managing consents and cookies

On your first visit to the Website, we display a banner where you can accept all cookies, reject all except the necessary ones, or customise your consent for individual categories.

You can change your decision at any time:

• by clicking here to withdraw your cookie consent;
• or by changing your settings directly in your browser (Chrome, Firefox, Safari, Edge) – disabling necessary cookies may make it difficult to use the Website.

7. Data retention period

We process data for as long as necessary to provide the service or handle your inquiry, until consent is withdrawn or an effective objection is raised (where the legal basis is our legitimate interest). This period may be extended if necessary to establish, exercise, or defend against legal claims, and to the extent required by law (e.g. tax regulations). After this time, the data is deleted or anonymised.

8. Your rights

You have the right to: access your data, obtain a copy of it, rectification, erasure, restriction of processing, data portability, object to processing (including marketing), withdraw consent at any time, and lodge a complaint with the President of the Personal Data Protection Office (UODO).

9. Recipients of data

We may disclose your data to trusted entities processing it on our behalf: IT and hosting service providers, Google (Google Analytics, Google Ads), Meta Platforms (Meta Ads), newsletter service providers, our accounting office, and payment operators. Data is not shared with other entities for their own purposes without your consent.

10. Transfers of data outside the EEA

Some recipients (Google, Meta) may process data outside the European Economic Area. In such cases, we ensure an adequate level of protection through standard contractual clauses approved by the European Commission or other mechanisms provided for under the GDPR.

11. Data security

We apply appropriate technical and organisational measures to ensure the security of the personal data processed, including restricting access to data to authorised persons only.

12. Contact

For any matters relating to this Policy and the processing of your personal data, please contact us at: biuro@hrespresso.pl.