Privacy Policy

1. Controller and contact

The data controller is Jonasz Jankowski, a sole proprietor trading as JFlow Labs Jonasz Jankowski. JFlow Labs is the brand of that business. The business details and the privacy contact are below.

Business owner

Jonasz Jankowski, a sole proprietor trading as JFlow Labs Jonasz Jankowski

Tax ID (NIP)

6351877080

REGON

542700210

Correspondence address

ul. Krakowska 16, 43-190 Mikołów, Poland

E-mail

kontakt@jflowlabs.pl

Phone

+48 780 632 008

Register

CEIDG register entry

2. What data do I process?

The form collects your name or company name, e-mail address, phone number, the description of your enquiry, the selected service if you pick one, the language of the page you write from, and confirmation that you have read the purpose of contact. Each enquiry receives a number and a date. In direct contact I process the data you provide in the conversation or correspondence. Do not send passwords, payment card details, health information or other special categories of data.

Anti-spam and duplicate protection uses a hash of the e-mail address, a hash of the submission content and information about time, attempts and delivery result. They serve efficient handling of the enquiry, not tracking you across other sites. The application does not attach your IP address or browser details to the enquiry record. The connection to the server itself requires the technical data needed to serve the request.

3. Purposes and legal bases

Providing data is voluntary and not required by law. Name or company, e-mail, phone, description and the contact-purpose confirmation are needed to send the form; the service is optional. The phone number lets us clarify the matter in a call. If you prefer not to provide all of these, you can e-mail or call without using the form.

Ticking the box at the form confirms you have read the notice. It is not marketing consent and not the basis of the enquiry handling described above. You are not subscribed to a newsletter.

• An enquiry about cooperation on your own behalf: replying, establishing needs and preparing a proposal — steps at your request before entering a contract, Art. 6(1)(b) GDPR.
• Other correspondence, including on behalf of a company: communication and replies — the controller’s legitimate interest, Art. 6(1)(f) GDPR.
• Security and confirmation of handling: limiting spam, preventing duplicates and verifying storage and delivery — the legitimate interest in keeping the form working correctly, Art. 6(1)(f) GDPR.
• Establishing, pursuing or defending claims: keeping necessary evidence — the legitimate interest in protecting the controller’s rights, Art. 6(1)(f) GDPR.

4. Who helps handle the enquiry?

Providers process data to the extent needed to perform their services, under the relevant processing agreements. Data may be disclosed to authorised authorities where the law requires it. The content of an enquiry is never published on the website and is not passed to AI models by the form.

• Zoho Mail hosts the business mailbox and further correspondence. The mailbox uses Zoho’s European data centre.
• Resend (Plus Five Five, Inc.) delivers the automatic notification to the studio and the confirmation with a copy of the message to you. Your copy is also received by your own mailbox provider.
• Microsoft Azure serves the website through a global hosting network. The form runs on a server in the USA (East US 2 region) and the private enquiry database is located in Poland (Poland Central region, EU).

5. Transfers outside the EEA

Data sent through the form is processed by a Microsoft Azure server in the USA and then stored in a private database in Poland. The EU location of the database does not mean the whole enquiry is handled within the EEA. Processing terms and transfer safeguards are described in the Microsoft Data Protection Addendum (DPA).

Resend stores message content and delivery data in the USA. Choosing Ireland as the sending region does not move storage to the European Union. The agreement with Resend includes the EU standard contractual clauses for data transfers. Details: the Resend DPA and Resend’s GDPR information. You can obtain information about the safeguards applied and how to get a copy by contacting the controller.

6. How long do I keep data?

Deleting an enquiry from the form storage does not automatically delete correspondence in Zoho or the copy in your mailbox. Deletion requests are handled with all storage locations and legal obligations in mind.

• Enquiries and correspondence: for as long as the matter and the cooperation discussions last. If a contract or a dispute arises, the necessary data may be kept for the duration of performance, as required by law or as needed to protect claims, taking limitation periods into account.
• Form storage: the enquiry for up to 365 days from saving, the delivery log for up to 365 days from the last update. Earlier deletion is possible.
• Anti-spam: the e-mail hash is used for the hourly limit and removed at the next write after that time. The whole rate-limit record expires after 48 hours without updates.
• Resend: messages and delivery logs for 30 days; backups for 7 days, under the provider’s retention rules.

7. Your rights

Within the scope of the GDPR you may request access to your data, rectification, erasure or restriction of processing. You may object to processing based on legitimate interest on grounds relating to your particular situation, and request data portability where its conditions are met.

Write to the controller’s contact address. Quote the e-mail address used in the enquiry or its number to help locate the matter. You will receive a reply without undue delay, generally within a month. If the law allows extending that period, I will tell you why. You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO). UODO information on your rights.

8. Automation and browser storage

I do not profile you or make decisions based solely on automated processing that produce legal or similarly significant effects. The form applies automated validation and rate limits to prevent abuse.

The website uses no analytics or advertising cookies. Your decision in the privacy notice is remembered in browser storage and in one first-party cookie for 12 months. Details of what is stored, for how long and how to change your decision are in the cookie and browser storage policy. Fonts, videos and graphics are served from the site’s own domain.