Skip to content
spec od e-commerce, part of SPEC GROUPLet’s talk

Privacy policy

What data we process and under what terms

Effective from 18 October 2026

1. General provisions

  1. This Privacy Policy of the specodecommerce.pl website (the “Website”) is for informational purposes, which means it is not a source of obligations for Users or Clients of the Website. It primarily contains rules regarding the processing of personal data by the Administrator on the Website, including the legal basis, purposes and retention period for personal data processing, the rights of data subjects, and information about the use of cookies and analytical tools on the Website.
  2. The administrator of personal data collected through the Website is S.P.E.C. Group sp. z o.o., with its registered office at Międzyrzecze Górne 807, 43-300 Międzyrzecze Górne, Poland, tax ID (NIP) 9372782624, National Court Register (KRS) number 0001254822, email address: [email protected] — hereinafter referred to as the “Administrator.”
  3. Personal data on the Website is processed by the Administrator in accordance with applicable law, in particular with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) — hereinafter referred to as the “GDPR.”
  4. Use of the Website is voluntary. Similarly, providing personal data by the User of the Website is voluntary, except that a call cannot be booked through the booking calendar without a name and an email address.
  5. The Administrator takes special care to protect the interests of persons whose personal data is processed, and in particular is responsible for and ensures that the data collected is: (1) processed lawfully; (2) collected for specified, legitimate purposes and not further processed in a manner incompatible with those purposes; (3) substantively correct and adequate in relation to the purposes for which it is processed; (4) stored in a form that permits identification of data subjects for no longer than is necessary to achieve the purpose of processing; and (5) processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures.
  1. The Administrator is entitled to process personal data in cases where — and to the extent that — at least one of the following conditions is met: (1) the data subject has given consent to the processing of their personal data for one or more specified purposes; (2) processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract; (3) processing is necessary for compliance with a legal obligation to which the Administrator is subject; or (4) processing is necessary for the purposes of the legitimate interests pursued by the Administrator or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
  2. Processing of personal data by the Administrator requires the existence of at least one of the grounds indicated in Section 2.1. The specific grounds are indicated in the next section of the Privacy Policy, in relation to each purpose of processing.

3. Purpose, legal basis and retention period for data processing on the Website

  1. In each case, the purpose, legal basis, retention period and recipients of personal data processed by the Administrator result from the actions taken by the given User or by the Administrator.
  2. The Administrator may process personal data on the Website for the following purposes, on the following legal bases and for the following periods:

  • Use of the Website and ensuring its proper and secure functioning

    Data
    IP address, browser and device data, the page visited and the time of the visit (server logs of the hosting provider)
    Legal basis
    Article 6(1)(f) GDPR — the Administrator’s legitimate interest in making the Website available and protecting it against abuse
    Retention
    for the log retention period of the hosting provider, no longer than necessary to keep the Website secure

  • Booking a call through the booking calendar and holding the call

    Data
    name, email address, answers to the questions in the booking form, the chosen time slot and time zone and, if you provide them, your phone number and message; also the page and campaign (UTM parameters in the address) that brought you to the calendar
    Legal basis
    Article 6(1)(b) GDPR — taking steps at your request prior to entering into a contract (booking and holding the call)
    Retention
    until the call has taken place and any talks about working together have ended, and then until the limitation period for claims expires (the basic limitation period for claims related to business activities is three years)

  • Emails related to the booked call

    Data
    name, email address, time of the call
    Legal basis
    Article 6(1)(b) GDPR (confirmation and invitation) and Article 6(1)(f) GDPR — the Administrator’s legitimate interest in reminding you about the call and following up on it
    Retention
    until the call and the follow-up have taken place, or until you object

  • Maintaining statistics and analyzing traffic on the Website (Google Analytics 4)

    Data
    identifiers stored in cookies, pages visited, button clicks, traffic source, device and browser data, approximate location
    Legal basis
    Article 6(1)(a) GDPR — your consent given in the cookie banner (in connection with Article 399 of the Polish Electronic Communications Law)
    Retention
    until you withdraw consent; data in Google Analytics is kept for no longer than 14 months

  • Measuring the effectiveness of Google ads

    Data
    identifiers stored in Google advertising cookies, information about your visit and clicks on the Website
    Legal basis
    Article 6(1)(a) GDPR — your consent to advertising cookies given in the banner
    Retention
    until you withdraw consent, no longer than the lifetime of the cookie

  • Remembering your choice in the cookie banner

    Data
    your consent choices (analytics, advertising) and when you made them, stored only in your browser’s storage
    Legal basis
    Article 6(1)(c) GDPR in connection with Article 7(1) GDPR — the obligation to demonstrate consent, and Article 6(1)(f) GDPR
    Retention
    12 months, after which we ask again; you can change it at any time

  • Establishing, pursuing or defending claims

    Data
    the data listed above, to the extent necessary to establish, pursue or defend claims
    Legal basis
    Article 6(1)(f) GDPR — the Administrator’s legitimate interest
    Retention
    until the limitation period for claims set by law, in particular the Polish Civil Code, expires

4. Data recipients on the Website

  1. For the proper functioning of the Website, it is necessary for the Administrator to use the services of external entities. The Administrator uses only the services of processors who provide sufficient guarantees of implementing appropriate technical and organizational measures so that processing meets the requirements of the GDPR and protects the rights of data subjects.
  2. The transfer of data by the Administrator does not occur in every case and not to all recipients indicated in the Privacy Policy — the Administrator transfers data only when it is necessary for the given purpose of processing and only to the extent necessary to achieve it.
  3. Personal data of Website Users may be transferred to the following recipients or categories of recipients:
    1. the Website hosting provider — Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), which serves the Website through Cloudflare Pages and processes technical visit data (e.g., IP address);
    2. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) — for Google Tag Manager (the tool that loads measurement scripts), Google Analytics 4 and Google advertising cookies (only after consent in the banner), and for Google Workspace, where the Administrator runs email and calendars: a booked call is added to Google Calendar and the invitation contains a Google Meet link;
    3. the booking panel server provider — IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany), whose server runs the booking calendar embedded on the Website (the Administrator’s panel at admin.specodit.pl), where the booking form data is stored;
    4. providers of accounting, legal and advisory services supporting the Administrator (in particular accounting offices and law firms) — only when and to the extent necessary for the given purpose of processing.
  4. Cloudflare and Google may also process data outside the European Economic Area, in particular in the USA. Such transfers are based on the European Commission’s adequacy decision (the EU-US Data Privacy Framework, in which both companies participate) or on standard contractual clauses.

5. Profiling on the Website

  1. The GDPR requires the Administrator to inform about automated decision-making, including profiling, as referred to in Article 22(1) and (4) GDPR, and — at least in those cases — to provide meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
  2. The Administrator does not make decisions about Website users based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect them. If you consent to advertising cookies, Google may use information about your visit to measure and tailor ads in its services; this does not affect your ability to use the Website.
  3. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

6. Rights of the data subject

  1. Right of access, rectification, restriction, erasure or portability — the data subject has the right to request from the Administrator access to their personal data, their rectification, erasure (“right to be forgotten”) or restriction of processing, and has the right to data portability. Detailed conditions are set out in Articles 15–21 GDPR.
  2. Right to withdraw consent at any time — a person whose data is processed on the basis of consent has the right to withdraw it at any time without affecting the lawfulness of processing carried out before its withdrawal. You can withdraw cookie consent by clicking “Cookie settings” in the Website footer or here: .
  3. Right to lodge a complaint with a supervisory authority — the data subject has the right to lodge a complaint with a supervisory authority in the manner specified in the GDPR and Polish law, in particular the Personal Data Protection Act. The supervisory authority in Poland is the President of the Personal Data Protection Office (UODO).
  4. Right to object — the data subject has the right at any time to object, on grounds relating to their particular situation, to the processing of personal data concerning them based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. In such a case, the Administrator may no longer process this personal data unless it demonstrates compelling legitimate grounds for processing which override the interests, rights and freedoms of the data subject, or grounds for the establishment, exercise or defense of legal claims.
  5. Right to object to direct marketing — where personal data is processed for direct marketing purposes, the data subject has the right at any time to object to such processing, including profiling, to the extent that it is related to such direct marketing.
  6. To exercise the rights referred to in this section, you may contact the Administrator in writing at its registered office address or by email at [email protected].

7. Cookies on the Website and analytics

  1. Cookies are small pieces of text information sent by the server and stored on the side of the person visiting the Website (e.g., on the hard drive of a computer or laptop, or on the memory card of a smartphone, depending on the device used). Browser storage (localStorage), which the Website uses to remember your consent choice, works in a similar way.
  2. On your first visit, the Website shows a banner where you decide whether you agree to analytics and advertising cookies. The “Accept” and “Decline” buttons are equal, and under “Settings” you can choose each category separately. Until you consent, the Website does not store any analytics or advertising cookies.
  3. The Website uses Google Analytics 4 and Google Tag Manager in Google Consent Mode (v2). If you decline, Google receives only cookieless signals without a browser identifier (e.g., that a page view or a click happened), which Google Analytics uses to estimate statistics in aggregate.
  4. The Administrator may process data contained in cookies for the following specific purposes:
    1. essential — remembering your banner choice (the sec:zgody_v1 entry in browser storage, 12 months); the booking calendar embedded from admin.specodit.pl may store only technical security cookies (e.g., an anti-abuse token), with no analytics or advertising;
    2. analytics (only after consent) — Google Analytics 4 cookies _ga and _ga_*, used for anonymous statistics on how the Website is used (up to 2 years);
    3. advertising (only after consent) — Google cookies used to measure and tailor Google ads.
  5. You can change your choice at any time by clicking “Cookie settings” in the Website footer. Independently, everyone can set the conditions for using cookies in their own browser settings — for example, partially restrict or completely disable cookies and delete stored ones. See your browser’s help pages for details.
  6. The Administrator uses Google Analytics 4 on the Website, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). This service helps the Administrator maintain statistics and analyze traffic on the Website. The collected data is processed to generate statistics helpful in administering the Website and is aggregated in nature. When using the service, the Administrator collects data such as the sources and medium of acquiring visitors and their behavior on the Website, information about the devices and browsers used, and approximate location. Google’s privacy policy: policies.google.com/privacy.
  7. You can also block the sharing of information about your activity on the Website with Google Analytics, e.g., by installing Google’s browser add-on: tools.google.com/dlpage/gaoptout.

8. Final provisions

  1. The Website may contain links to other websites. The Administrator encourages you to review the privacy policy of those sites after navigating to them. This Privacy Policy applies only to the Administrator’s Website.
  2. The Administrator may change this Privacy Policy, e.g., when new tools are added to the Website. The current version is always available at this address, and the date at the top shows when it took effect.

Back to the page to book a call