Privacy Policy
Effective from 12 November 2026.
This is a translation of the Polish original. If the two versions differ, the Polish version prevails.
This policy explains what personal data we process when you visit the almhost.pl and makowej.pro websites (the “Sites”) or send us an e-mail: for what purpose, on what legal basis, for how long, and what rights you have.
- Data of clients, counterparties and businesses for which we prepare website projects is covered by a separate document: GDPR Notice.
- Websites that we build for clients have their own privacy policies.
1. Controller
The controller of your personal data is Agnieszka Makowej, trading as ALM Agnieszka Makowej, ul. Słoneczna 32/9, 33-100 Tarnów, Poland, NIP (tax identification number) 8732999786, REGON 121015025, entered in the Central Register and Information on Economic Activity (“ALM”, “we”). ALM Host is the name under which ALM builds, publishes and maintains websites.
You can contact us about personal data matters:
- by e-mail: rodo@almhost.pl;
- in writing: ALM Agnieszka Makowej, ul. Słoneczna 32/9, 33-100 Tarnów.
We have not appointed a data protection officer.
2. Key points in brief
- The Sites have no forms or user accounts and do not ask you for any data.
- We do not use cookies or analytics, advertising or tracking tools. The Sites do not load scripts, fonts or images from other domains (the only exception, Cloudflare’s verification page, is described in section 4).
- The Sites run on Cloudflare infrastructure. The technical data needed to display a page is processed only for as long as it takes to handle the request. We do not keep logs of visits containing IP addresses.
- If you send us an e-mail, we process the data in the message in order to deal with it.
3. What data we process, for what purpose and for how long
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Displaying the Sites and protecting them against attacks and abuse | IP address, date and time, page address, data sent automatically by the browser (e.g. type and version of the browser and operating system, language, the page you came from), country determined from the IP address | Article 6(1)(f) GDPR: our legitimate interest, namely making the Sites available and ensuring their security | only for as long as it takes to handle the request; we do not record this data in the Sites’ logs |
| The “Status” section and response-time measurement on almhost.pl | the code of the Cloudflare data centre handling your request and the country determined from the IP address; we send them back only to your browser, in order to display them | Article 6(1)(f) GDPR: our legitimate interest, namely showing how the hosting works | we do not store them |
| Replying to e-mails and conducting correspondence | e-mail address, full name or business name, content of the message and any other data you provide yourself | Article 6(1)(f) GDPR: our legitimate interest, namely replying to correspondence; Article 6(1)(b) GDPR, where the message concerns the conclusion or performance of a contract; Article 6(1)(c) GDPR, where we are handling your request concerning personal data or a notice of illegal content | until the matter is closed, and then until the limitation period for any claims that may arise from it expires |
| Establishing, pursuing and defending claims | data from correspondence and technical data relating to the matter | Article 6(1)(f) GDPR: our legitimate interest, namely protecting our rights | until the limitation period for claims expires |
As a rule, the limitation period for claims is 6 years, and 3 years for claims connected with running a business. The period ends on the last day of a calendar year (Article 118 of the Civil Code).
4. Cookies and browser storage
The Sites do not set cookies. In the browser’s storage (localStorage) we store only your own choices, and only when you make them:
| Key | When we store it | What it holds |
|---|---|---|
alm-theme |
when you click the theme switch | the chosen theme: light or dark |
alm-lang |
when you choose a language version in the menu | the chosen language |
alm-lang-hint |
when you close the hint about another language version | a note that the hint has been closed |
This information does not leave your device and is not sent to us. Its sole purpose is to make the page look, on your next visit, the way you set it, which is a function that you yourself request. On that basis, it does not require separate consent (Article 399(3) of the Electronic Communications Law of 12 July 2024). You can delete it at any time by clearing the site data in your browser settings.
If Cloudflare considers traffic to be suspicious and displays a verification page, it may set a cookie necessary to
carry out the verification (e.g. cf_clearance). Such a cookie serves security purposes only, not tracking.
5. Recipients of data
We do not sell personal data or share it for marketing purposes. Data may be received by:
- Cloudflare, Inc. (USA), which provides hosting for the Sites, a content delivery network, DNS, protection against attacks (including DDoS) and forwarding of e-mail sent to our e-mail addresses. Cloudflare acts as a processor under a data processing agreement (Cloudflare Customer Data Processing Addendum). When forwarding e-mail, Cloudflare logs the sender’s and recipient’s addresses and the subject of the message (without its content) for about 30 days. Cloudflare also uses information about network traffic to detect and block attacks on its network, on the terms described in Cloudflare’s privacy policy.
- the e-mail service provider on whose servers we store correspondence;
- our advisers, e.g. legal advisers, where this is necessary to deal with a matter or to defend against claims; they are bound by professional secrecy or a confidentiality agreement;
- courts, authorities and other public bodies, where an obligation to disclose the data to them arises under the law.
6. Transfers of data outside the European Economic Area
Cloudflare and the e-mail provider may also process data outside the European Economic Area, in particular in the United States. This takes place on the basis of a European Commission decision finding an adequate level of data protection (Implementing Decision (EU) 2023/1795, the so-called EU-U.S. Data Privacy Framework) in respect of entities participating in that programme, and otherwise on the basis of standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR). You can obtain a copy of these safeguards by writing to rodo@almhost.pl.
7. Your rights
On the terms set out in the GDPR, you have the right to:
- access your data and obtain a copy of it (Article 15 GDPR);
- rectification of your data (Article 16 GDPR);
- erasure of your data (Article 17 GDPR);
- restriction of processing (Article 18 GDPR);
- portability of the data that we process on the basis of a contract by automated means (Article 20 GDPR).
Right to object. You may at any time object, on grounds relating to your particular situation, to the processing of your data on the basis of our legitimate interest (Article 21 GDPR). We will then stop processing the data for that purpose, unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or grounds for establishing, pursuing or defending claims.
You can send a request to rodo@almhost.pl or in writing to our address. We will reply within one month of receiving it; in exceptional cases, of which we will inform you, this period may be extended by a further two months (Article 12(3) GDPR). We may ask for information needed to confirm your identity.
You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland, uodo.gov.pl.
8. Do you have to provide data?
No. The Sites do not ask for any data. The technical data described in section 3 is sent automatically by the browser with every request; without it, the pages could not be displayed. Providing data in an e-mail is voluntary, but without an e-mail address we will not be able to reply.
9. Automated decisions and profiling
We do not make decisions based solely on automated processing, including profiling, within the meaning of Article 22 GDPR.
10. Security
The Sites are available only over an encrypted connection (HTTPS). We use security headers, including a Content Security Policy, which allows the browser to load resources only from our domain. Only authorised persons have access to the configuration of the Sites.
11. Links to other websites
The Sites contain links to websites that we have built for ourselves, our partner and clients, and to other websites. Each of these websites has its own controller and its own privacy policy. Clients’ websites are the responsibility of their owners; where we maintain such a website, we process the data of its users only on the instructions and on behalf of the owner.
12. Changes to the Privacy Policy
We update this policy when the way we process data or the law changes. The current version is always available on the Sites, and the date from which it is effective is shown at the top of the page.