Privacy and cookie policy

Last updated: 16 October 2026

1. Data controller

The controller of your personal data is Tomasz Rydz, trading as Code&Pixel Agencja interaktywna Tomasz Rydz, at ul. Solskiego 14A, second floor, 32-800 Brzesko, Poland, referred to below as the “Controller”.

For questions about privacy and data processing, contact us:

• by email: biuro@codeandpixel.pl,
• by phone: +48 696 612 373,
• by post at the address above.

2. Contact form and CRM

When you submit the contact form, we process your name, email address and message. You may also provide your company name, phone number and the service your enquiry concerns.

We use this data to:

• answer and correspond about your enquiry,
• prepare a proposal or quote,
• manage the enquiry in our internal CRM, including its handling stage,
• establish, exercise or defend potential legal claims.

Our legal basis is Article 6(1)(b) GDPR when taking steps at your request before entering into a contract, and Article 6(1)(f) GDPR: our legitimate interest in handling correspondence, organising our sales process and protecting against claims.

Acknowledging this privacy policy is not marketing consent. We do not store your IP address in the CRM or send data entered in the form to Google Analytics.

3. Emails after form submission

After you submit the form, the system records the enquiry in our internal CRM and notifies Code&Pixel at biuro@codeandpixel.pl. Your email is used as the reply-to address so we can respond directly.

We also send an automatic acknowledgement to the address you provide. This is a transactional email without marketing content, and you can reply directly to our team. We send a substantive response after reviewing your enquiry.

4. Data retention

We retain enquiry data while handling your request and conducting discussions. Afterwards, retention is limited to information needed to evidence our arrangements and establish, exercise or defend claims for the applicable limitation period. If we work together, data may be retained for the contract’s duration and then for periods required by tax and accounting rules or until relevant claims become time-barred.

Withdrawing consent stops further processing based on that consent. A cookie’s expiry period is not the same as the analytics or advertising provider’s data retention period. For information about retention of data relating to your visit, email biuro@codeandpixel.pl.

When you submit an enquiry, we attach the permitted campaign source data and your current analytics/marketing consent choices to the CRM record, to assess enquiry quality and campaign effectiveness. We do not store full referring URLs or URL query strings in these source fields. Campaign data is retained with the enquiry under the retention rules in section 4. Withdrawing consent stops further collection; you can contact us to request erasure of data already recorded.

5. Google Analytics 4

The website uses Google Analytics 4, provided by Google Ireland Limited, to produce usage statistics and evaluate effectiveness. It may process information about your device and browser, approximate location, visit source, pages viewed and interactions with the website.

We also measure successful form recording and clicks on the business phone number. We do not add your name, email, message or a phone number entered in the form to these events.

The website uses Google Consent Mode v2. Before you make a choice, optional analytics and advertising consent is denied by default. In advanced mode, Google tags may send limited technical signals without storing optional cookies. Full measurement using identifiers is enabled according to your selected settings.

The legal basis for storing analytics identifiers on your device and full analytics measurement is your consent under Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law.

6. OpenAI Ads measurement

After you grant marketing consent, the website loads the OpenAI Ads pixel. This measures advertising effectiveness and may process technical browser and device information, the page visited, visit source and campaign-related identifiers.

The OpenAI Ads script is not downloaded before marketing consent. After consent is withdrawn, the page reloads to stop previously activated marketing tools. The basis for processing and storing marketing identifiers is your consent.

7. Cookies and browser storage

The website may use the following mechanisms:

You can change your choice at any time using the “Cookie settings” button on the website. You can also delete stored data in your browser settings. Restricting essential mechanisms may affect some website functions.

8. Server logs and external resources

When you use the website, the server may automatically record technical data such as your IP address, request date and time, page URL, server response code and browser information. This supports security, fault diagnosis and website protection. The legal basis is Article 6(1)(f) GDPR.

The form also uses anti-spam measures: a hidden control field, a signed form start time, submission rate limits and basic content analysis. Short-term rate limiting uses a cryptographic hash of the IP address and email address. The raw IP address is not stored in the CRM, and counters expire after approximately 15 minutes.

The website loads fonts from Google Fonts. Your browser connects to Google’s servers when downloading them, transmitting your IP address and technical request information. Some project presentations also use Adobe Fonts. These resources are used to display the website.

9. Data recipients

Providers supporting our website may access data only to the extent necessary for their tasks:

• hosting and server infrastructure providers,
• our email provider,
• IT, legal or accounting support providers,
• Google Ireland Limited in connection with Google Analytics 4 and advertising services,
• OpenAI in connection with the OpenAI Ads pixel, if you grant marketing consent,
• external font providers: Google and Adobe.

Analytics and marketing providers may also process data outside the European Economic Area. Transfers use applicable legal mechanisms, including adequacy decisions under the EU–US Data Privacy Framework or standard contractual clauses.

10. Your rights

Depending on the basis and circumstances of processing, you have the right to:

• access your data and obtain a copy,
• rectify your data,
• have data erased or processing restricted,
• data portability,
• object to processing based on legitimate interests,
• withdraw consent at any time without affecting the lawfulness of earlier processing.

Send requests to biuro@codeandpixel.pl. You also have the right to complain to the President of the Polish Personal Data Protection Office. Information on submitting a complaint is available at uodo.gov.pl.

11. Providing data is voluntary

Providing data is voluntary, but your name, email, message and acknowledgement of this policy are necessary to submit the form and receive a response. Your company name, phone number and service selection are optional.

12. Automated decisions

Data submitted through the form is not used for solely automated decisions producing legal effects. CRM enquiry status is used to organise the team’s work. After marketing consent, advertising providers may use activity information to create audiences and personalise ads. This is not a decision producing legal or similarly significant effects on you.

13. Policy changes

We may update this policy when website functions, providers or regulations change. The current version is published here with its last updated date.

14. Provider information

Details of providers’ data processing are available in Google’s privacy policy, OpenAI’s European privacy policy and Adobe Fonts privacy information. Contact the Controller about data recipients, transfers outside the EEA and copies of applicable safeguards.