Notice on the processing of personal data (GDPR)

Effective from 12 November 2026.

This is a translation of the Polish original. If the two versions differ, the Polish version prevails.

This notice fulfils the obligations under Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR). It concerns persons whose data we process in connection with running our business: clients, businesses for which we prepare website projects, counterparties, persons who contact us, and persons who submit notices of illegal content. What happens to data during visits to our websites is described in the Privacy Policy.

1. Controller

The controller of personal data is Agnieszka Makowej, trading as ALM Agnieszka Makowej, ul. Słoneczna 32/9, 33-100 Tarnów, Poland, NIP (tax identification number) 8732999786, REGON 121015025 (“ALM”, “we”). ALM Host is the name under which ALM builds, publishes and maintains websites.

Contact on personal data matters: rodo@almhost.pl or in writing to the address given above. We have not appointed a data protection officer.

2. Clients and persons acting on their behalf

This section concerns clients who are natural persons (e.g. sole traders or partners in a civil-law partnership) and persons who represent a client or have been designated by the client as contact persons.

We process: full name, business name, address, NIP and REGON, e-mail address and telephone number, position or role, content of correspondence, billing data (e.g. bank account number) and materials provided for the project. If you act on behalf of a client, we have received your data from that client.

Providing the data is a condition for concluding and performing the contract, and the data needed to issue an invoice is required by tax legislation. Without it, we cannot conclude or perform the contract.

3. Businesses for which we prepare a website project

On our own initiative, without an order, we prepare website projects for selected businesses and present them together with an offer. If a business is run by a natural person (e.g. as a sole trader or in a civil-law partnership), the business’s data is that person’s personal data.

• Purpose: preparing a demo project of the business’s website, presenting it to the business together with an offer, and holding discussions about cooperation.
• Legal basis: Article 6(1)(f) GDPR: our legitimate interest, namely promoting our own services to businesses (direct marketing).
• Data: business name, full name of its owner or partners, business address, NIP and REGON, business telephone numbers and e-mail addresses, information about the business and its offering, photographs and other content published by the business, and short excerpts from public reviews by its customers, signed with a first name and initial.
• Sources: publicly available registers (the Central Register and Information on Economic Activity (CEIDG), KRS, REGON), the business’s existing website, its business profile on online maps, social media profiles and industry websites.
• Recipients: we publish the project at a demo address in the almhost.pl domain. It is not indexed by search engines or publicly promoted; we show it to the business it concerns. Persons working with ALM on sales and the recipients listed in section 8 also have access to it.
• Period: the project is available for the duration of the presentation and the discussions about cooperation. If you object or ask for the project to be removed, we will take it offline without delay. We keep information about the prepared project and the offer made until the limitation period for claims expires (3 years, counted to the end of the calendar year), so that we can demonstrate the course of our contacts.
• Commercial information is sent by us by e-mail, by telephone or via instant messaging only to persons who have given their prior consent to this (Article 398 of the Electronic Communications Law).

You may object at any time to the processing of your data for direct marketing purposes, without giving reasons (Article 21(2) and (3) GDPR). A message to rodo@almhost.pl is sufficient. Once you object, we will stop processing the data for that purpose and take the project offline.

People whose reviews we quote in a project. If a project contains short excerpts from public reviews by the business’s customers, we process the author’s first name and initial and the excerpt, taken from public review services (e.g. online maps), on the basis of Article 6(1)(f) GDPR (showing how the website can present reviews), for as long as the project is available. The author of a review may object at any time by writing to rodo@almhost.pl; we will then remove the review from the project.

4. Persons who contact us

This section concerns e-mails, telephone calls, instant messaging and meetings.

• Purpose: replying and dealing with the matter.
• Legal basis: Article 6(1)(f) GDPR, namely replying to correspondence; Article 6(1)(b) GDPR, where the matter concerns the conclusion or performance of a contract with you; Article 6(1)(c) GDPR, where we are giving effect to your rights under the GDPR.
• Data: contact details and the content of correspondence, i.e. whatever you provide to us.
• Period: until the matter is closed, and then until the limitation period for any claims that may arise from it expires. We keep correspondence on personal data matters until the limitation period for claims relating to its handling expires.

5. Counterparties, suppliers and collaborators

This section concerns persons running a business who provide services to us or work with us, and their employees and representatives.

• Purposes and legal bases: concluding and performing the contract (Article 6(1)(b) GDPR, and for persons acting on behalf of the counterparty, Article 6(1)(f) GDPR), settling accounts and tax obligations (Article 6(1)(c) GDPR), establishing, pursuing and defending claims (Article 6(1)(f) GDPR).
• Data: identification and contact details, business registration data, billing data, content of correspondence.
• Period: for the term of the contract, and then until the limitation period for claims and the retention periods for tax documents expire (5 years from the end of the calendar year in which the tax payment deadline expired).

6. Persons who submit notices of illegal content and persons concerned by the notices

As a provider of a hosting service, we accept notices of illegal content at abuse@almhost.pl (Article 16 of Regulation (EU) 2022/2065 of the European Parliament and of the Council, i.e. the Digital Services Act).

• Purpose: receiving and processing the notice, informing the notifier and the client of the decision, and passing information to authorities where required by law.
• Legal basis: Article 6(1)(c) GDPR in conjunction with Articles 16–18 of the Digital Services Act; after the matter is closed, Article 6(1)(f) GDPR (demonstrating that the notice was handled properly, defending claims).
• Data: the notifier’s full name and e-mail address, the content of the notice and the information indicated in it, and the data of the client whose content the notice concerns.
• Period: until the matter is closed, and then for 3 years, counted to the end of the calendar year, in order to demonstrate to authorities and courts that the notice was handled properly.

7. Users of websites we maintain for clients

When we publish and maintain a client’s website, the controller of the data of its users (e.g. persons submitting a form) is the client. We process that data only on the client’s behalf, as a processor, under a data processing agreement. The rules are described in the privacy policy of the website concerned; for matters concerning your data, contact its owner. If you write to us, we will forward your request to the website owner.

We operate the demo websites that we prepare for businesses before a contract is concluded (section 3) in our own name: the controller of the data sent through their forms is ALM, as stated in the privacy policy of each of them.

8. Recipients of data

We do not sell personal data. Data may be received, to the extent necessary for the purpose concerned, by:

• providers of the infrastructure and tools we use: Cloudflare, Inc. (website hosting, DNS, e-mail forwarding, protection against attacks), GitHub, Inc. (repositories of website code and content), the e-mail service provider;
• Polish Developer Network sp. z o.o., with its registered office in Tarnów, our regular partner, which works with us on delivering projects;
• persons working with ALM on sales and service delivery, who are bound by confidentiality;
• entities providing us with accounting, legal and payment services, including banks;
• tax authorities, including through the National e-Invoicing System, courts and other public authorities, where an obligation to disclose the data arises under the law.

Providers that process data on our behalf do so under data processing agreements and only on our instructions.

9. Transfers of data outside the European Economic Area

Cloudflare, Inc. and GitHub, Inc. have their registered offices in the United States, and the e-mail provider may also process data outside the European Economic Area. Data is transferred on the basis of a European Commission decision finding an adequate level of protection (Implementing Decision (EU) 2023/1795, the so-called EU-U.S. Data Privacy Framework) in respect of entities participating in that programme, and otherwise on the basis of standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR). You can obtain a copy of these safeguards by writing to rodo@almhost.pl.

10. Your rights

On the terms set out in the GDPR, you have the right to:

• access your data and obtain a copy of it (Article 15 GDPR);
• rectification of your data (Article 16 GDPR);
• erasure of your data (Article 17 GDPR);
• restriction of processing (Article 18 GDPR);
• portability of the data that we process on the basis of a contract or consent by automated means (Article 20 GDPR);
• withdraw consent at any time, where the processing is based on it; withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Right to object. You may at any time object, on grounds relating to your particular situation, to the processing of data on the basis of our legitimate interest (Article 21(1) GDPR). An objection to direct marketing does not require any justification and is always effective (Article 21(2) and (3) GDPR).

You can send a request to rodo@almhost.pl or in writing to our address. We will reply within one month of receiving it; in exceptional cases, of which we will inform you, this period may be extended by a further two months. We may ask for information needed to confirm your identity.

You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland, uodo.gov.pl.

11. Automated decisions and profiling

We do not make decisions based solely on automated processing, including profiling, within the meaning of Article 22 GDPR.

12. Changes

We update this notice when the way we process data or the law changes. The current version is always available on this page.