Privacy and cookie policy

Effective from 13 October 2026

1. Data controller

The controller of your personal data is Konfero sp. z o.o. with its registered office at Skoczowska 134, 43-450 Ustroń, Poland, entered in the National Court Register under KRS 0001174418, tax ID NIP 5482768563 and statistical ID REGON 541798424.

For any personal data enquiries, email [email protected], call +48 668 432 329 or write to our registered office. We have not appointed a data protection officer.

2. Purposes and legal bases for processing

Contact forms, price configurator, email and telephone

When you enquire through a form or configurator, email or call us, we process the information you provide: name, company name, email address, phone number, message and event details such as dates, guest numbers and package. We use it to answer your enquiry, prepare a proposal and agree event details.

• legal basis: steps at your request before entering a contract (GDPR Article 6(1)(b)); when you contact us on behalf of a company, our legitimate interest in answering enquiries and maintaining client contact (Article 6(1)(f));
• after a contract is concluded: contract performance (GDPR Article 6(1)(b)) and accounting and tax obligations (Article 6(1)(c));
• establishing or defending legal claims: our legitimate interest (GDPR Article 6(1)(f)).

Providing data is voluntary, but without an email address or phone number we cannot reply.

Analytics (Google Analytics 4, Microsoft Clarity)

With your consent, we measure how you use the website: pages visited, how you reached the site and form submissions. Microsoft Clarity also records mouse movements, clicks and scrolling as heatmaps and session recordings, without the contents entered into forms. This helps improve our website and offer. Legal basis: your consent (GDPR Article 6(1)(a) and Article 399 of Poland’s Electronic Communications Law).

Marketing (Meta Pixel, Google Ads)

With your consent, we measure Konfero advertising performance on Google, Facebook and Instagram, and may show ads to previous website visitors (remarketing). Meta and Google may link this information to your accounts on their services. Legal basis: your consent (GDPR Article 6(1)(a) and Article 399 of Poland’s Electronic Communications Law).

External content (Google Maps, YouTube)

We load directions maps and videos from Google’s servers only after consent, including when you click ‘Show map’ or ‘Play video’. Videos use YouTube’s privacy-enhanced mode. Legal basis: your consent (GDPR Article 6(1)(a) and Article 399 of Poland’s Electronic Communications Law).

Website operation and security

On each visit, servers automatically process technical data such as IP address, browser type and visit time to display the website and protect it from attacks. Website fonts are downloaded from Google Fonts servers, which receive your IP address. Legal basis: our legitimate interest in effective, secure website operation (GDPR Article 6(1)(f)).

3. How long we retain data

• enquiries that do not lead to a contract: for as long as needed to handle the enquiry and proposal discussions, then until the limitation period for potential claims expires;
• client data: during contract performance, then for the periods required by tax and accounting law and until claims become time-barred;
• data processed with consent: until consent is withdrawn, no longer than the relevant cookie’s lifetime (see below);
• data processed on legitimate-interest grounds: until a valid objection or the end of that interest.

4. Who receives data

We share data only with organisations supporting our website and enquiry handling, under processing agreements or as separate controllers:

• Basin (usebasin.com): contact form handling and forwarding submissions to our inbox;
• Cloudflare: website delivery and protection from attacks;
• Google Ireland Ltd.: Google Analytics, Google Tag Manager, Google Ads, Google Maps, YouTube and Google Fonts;
• Microsoft Ireland Operations Ltd.: Microsoft Clarity;
• Meta Platforms Ireland Ltd.: Meta Pixel;
• IT and email providers, and companies commissioned to develop the website and run marketing;
• public authorities where legally required.

Some providers (Google, Meta, Microsoft, Cloudflare and Basin) may process data in the United States. Transfers then rely on a European Commission adequacy decision (EU–US Data Privacy Framework) or Commission-approved standard contractual clauses.

We do not make decisions about you based solely on automated processing that have legal effects. Advertising profiling by Meta and Google takes place only with your consent.

5. Your rights

You have the right to:

• access your data and receive a copy;
• correct inaccurate data;
• request deletion or restriction of processing;
• receive and transfer data processed on the basis of consent or a contract;
• object to processing based on legitimate interests;
• withdraw consent at any time, without affecting the lawfulness of earlier processing;
• complain to the President of Poland’s Personal Data Protection Office (Stawki 2, 00-193 Warsaw).

To exercise these rights, email [email protected].

6. Cookies

Cookies are small files stored in your browser. We treat similar technologies, such as browser local storage, in the same way. On your first visit, our banner asks for consent: accept all categories, reject all or select categories in settings. Until consent is given, only necessary cookies are used, and Google, Microsoft and Meta tools do not load. We remember your choice for 12 months, then ask again.

Change or withdraw consent at any time using ‘Cookie settings’ in every page footer or the button below. You can also delete or block cookies in your browser settings.

Necessary (no consent required)

Analytics (with consent)

Marketing (with consent)

External content (with consent)

External providers describe their cookie policies here: Google, Meta, Microsoft, Cloudflare.

7. Policy changes

We update this policy and the date above when website tools or data processing change. If a change concerns cookies requiring consent, we will ask again.