Privacy policy

This policy explains what personal data the essa.digital website collects, why, how long we keep it and what rights you have. It is written under the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The controller of your personal data is the company named above (“ESSA Digital”, “we”), registered in Poland. For anything related to your data, write to [email protected].

2. What we collect

When you send a request through the form (“Apply for development” or “Book a technical audit”):

• your name;
• the reply channel you chose (email or WhatsApp) and your email address or phone number;
• the text of your request, the solution you picked on the pricing block, and the address of the site to audit, if you gave one;
• the language version of the site you used.

Where you came from. With the request we save how you first arrived at the site during that visit: the first page you opened, the address of the external site that linked to it (referrer), advertising campaign tags in the link (UTM tags, gclid, fbclid) and the time of that first visit. We keep this only together with a request: if you don’t send one, it disappears when your session ends.

When you write to us directly — by email or in WhatsApp — we receive what you send and what the service shows us (your name, email address or phone number).

Technical data. Our server processes your IP address and browser details to deliver the pages and to protect the site from abuse.

We don’t ask for and don’t want special categories of data (health, beliefs and the like) — please don’t include them in your request.

3. Why we process it and on what legal basis

• To reply to your request and prepare a proposal — steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• To perform the contract if we start working together — Art. 6(1)(b) GDPR.
• To understand which advertising and channels bring requests (the “where you came from” data) — our legitimate interest in managing our marketing (Art. 6(1)(f) GDPR).
• To keep the site secure and prevent abuse of the form — our legitimate interest (Art. 6(1)(f) GDPR).
• To meet accounting and tax obligations for clients — Art. 6(1)(c) GDPR.
• Analytics and marketing cookies — only with your consent (Art. 6(1)(a) GDPR). The site doesn’t use them at the moment; see section 6.

Giving us your details is voluntary, but without a contact we can’t reply. We don’t make decisions about you by automated means and don’t build profiles.

4. How long we keep it

• Requests that didn’t lead to cooperation — 12 months after our last contact, then we delete them.
• Client data — for the duration of the cooperation, and invoices and accounting records for as long as Polish tax law requires (5 years from the end of the year in which the tax was due).
• Session data (including the “where you came from” data before a request is sent) — until the session ends, at most 2 hours of inactivity.
• Server logs — no longer than 30 days.

5. Who receives your data

We don’t sell personal data. We share it only with providers we need to run the site and the business:

• Hosting provider — our server is located in the European Union.
• Telegram — a notification about a new request (name, contact, request text, site address) is sent to our team’s private Telegram chat, so we can reply quickly.
• WhatsApp (Meta) — when we reply in WhatsApp; your conversation is then also governed by WhatsApp’s privacy policy.
• Accounting office, bank and payment providers — for clients, to issue invoices and receive payments.
• Public authorities — only when the law requires it.

6. Cookies and similar technologies

The site uses only what it needs to work:

• a session cookie — keeps the form and the attribution data of your visit; expires after 2 hours of inactivity;
• a security cookie (XSRF-TOKEN) — protects the form from forged submissions;
• your cookie choice — saved in your browser’s local storage so the banner doesn’t ask again.

These don’t require consent. Analytics and marketing tools would run only after you choose “Accept all” in the banner; the site doesn’t use any at the moment. Before we add one, we’ll update this policy and name the provider here. You can change your choice at any time via “Cookie settings” in the footer.

7. Transfers outside the European Economic Area

Our server and data are in the EU. Telegram and WhatsApp are international services and may process data outside the EEA; such transfers take place under the safeguards those providers apply under Chapter V GDPR (such as the European Commission’s standard contractual clauses). We send them only what we need to reply to you.

8. Your rights

You have the right to:

• access your data and get a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict processing;
• data portability;
• object to processing based on our legitimate interest — including the “where you came from” data;
• withdraw consent at any time, without affecting processing before the withdrawal.

Write to [email protected] — we’ll reply within one month. You also have the right to lodge a complaint with a supervisory authority: in Poland it is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or the authority of the EU country where you live or work.

9. Security

The site works only over an encrypted connection (HTTPS). Access to requests and client data is limited to the team members who work with them and protected by individual accounts.

10. Children

The site and our services are intended for businesses. We don’t knowingly collect data of persons under 16.

11. Changes to this policy

When the site starts collecting something new, we update this policy and the date at the top. If the change affects an ongoing project, we’ll tell the client directly.