Privacy Policy
This policy explains what personal data Gilzor collects through www.gilzor.com, why, how long we keep it and what rights you have. It applies to visitors of the website, people who contact us through its forms and newsletter subscribers.
1. Who we are
The website is operated by Gilzor, which works through two offices that jointly decide how personal data from this website is used (joint controllers):
- Gilzor, Office 58, Adama Mickiewicza 37, 01-625 Warsaw, Poland;
- Gilzor CY Ltd, Office 113E, Block A, Agios Pavlos, 228 Makariou III, 3030 Limassol, Cyprus (EU VAT number CY10425669C).
Both use one point of contact for everything related to your data: contacts@gilzor.com. You can contact either office; we will handle your request together.
2. What we collect
When you contact us
The information you type into a form: your name, email address and message, and — depending on the form — your company or project name, a link to your app or repository and the tools you use. After sending a form you may optionally answer a few more questions (for example your preferred way of contact and phone or messenger handle, your LinkedIn or company website, your role, project stage, timeline and budget range); these answers are added to your request. If you subscribe to our newsletter, we collect your email address.
Collected automatically when you send a form
- your IP address and the approximate location derived from it (country, region, city, time zone) and the name of the network it belongs to;
- technical details of your device and browser: browser and operating system, screen size, language settings and time zone;
- how you reached our website and moved through it: the referring website, advertising and campaign parameters (such as UTM tags or ad click identifiers), the pages you viewed and the time spent on the site and on the form;
- how you engaged with those pages: active reading time, how far you scrolled, which links and buttons you clicked, text you copied, which form fields you used (not what you typed unless you sent the form), and how fast the pages loaded for you;
- identifiers set by our analytics tools (for example, your Google Analytics client ID), so we can connect your enquiry with your visit statistics.
Your browser keeps this browsing history locally (for up to the last 60 page views). It is sent to us only together with a form you submit; if you never send a form, it never reaches us. If you visit from the EEA, the UK or Switzerland, it is kept only after you accept analytics cookies — otherwise only the page you send the form from is included.
While you browse
We use analytics tools that collect usage data through cookies and similar technologies: see section 8.
We also keep our own anonymous statistics of how the website is used, without cookies and without storing anything in your browser. When you leave a page, your browser sends us a short summary of that page view: the page address, how you arrived (the referring website or campaign tag), how long you actively read, how far you scrolled, which sections were on screen, which links and buttons you clicked and where on the page, the screen width, how fast the page loaded, and whether a form was sent. We add the country and network type derived from your IP address and use them to filter out automated traffic. The IP address itself is not stored. To count unique visitors we use a code calculated from the IP address, browser details and the date with a secret key; it changes every day and cannot be used to identify you or to follow you across days. These statistics are only shown to us as totals and are not combined with the data you send in a form.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Replying to your enquiry, preparing an estimate or proposal | Steps at your request before entering into a contract — Art. 6(1)(b) |
| Following up on enquiries and managing our relationship with clients and prospects | Our legitimate interest in developing our business — Art. 6(1)(f) |
| Protecting our forms against spam, bots and abuse | Our legitimate interest in security — Art. 6(1)(f) |
| Understanding which channels and content bring enquiries | Our legitimate interest in improving our marketing — Art. 6(1)(f) |
| Considering job applications and CVs sent to us | Steps before a possible contract — Art. 6(1)(b) |
| Website analytics and session recordings that use cookies or browser storage (Google Analytics cookies, Hotjar, Contentsquare, Fastbase) for visitors from the EEA, the UK and Switzerland | Your consent — Art. 6(1)(a) and the ePrivacy rules; you can withdraw it at any time in the cookie settings |
| Our own anonymous, cookieless website statistics (section 2, “While you browse”) | Our legitimate interest in understanding and improving our website, Art. 6(1)(f) |
| Website analytics for visitors from other countries | Our legitimate interest in understanding and improving our website — Art. 6(1)(f); you can object at any time in the cookie settings |
| Sending our newsletter | Your consent — Art. 6(1)(a); you can unsubscribe at any time |
| Keeping contract and accounting records for clients | Legal obligations — Art. 6(1)(c) |
We do not sell your data and do not use it for decisions that have legal or similarly significant effects on you. Automatic spam filtering may hold back a message; such messages are kept for 30 days so we can recover anything filtered by mistake.
4. Who processes your data for us
We use service providers who process data on our behalf under data processing agreements:
- Cloudflare — website hosting and delivery, security, bot protection (Turnstile), the database where form submissions are stored and the storage of our anonymous website statistics;
- Google — Google Tag Manager and Google Analytics (website statistics) and Google Workspace (our email);
- HubSpot — newsletter and subscription forms;
- Hotjar — analysis of how visitors use the website;
- Fastbase — identification of the organisation a visit comes from, based on the IP address;
- Contentsquare — website usage analytics on selected pages.
Within Gilzor, your data is accessible only to the people who handle enquiries and projects.
5. International transfers
Some of these providers are based in, or use infrastructure in, the United States or other countries outside the European Economic Area. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.
6. How long we keep your data
| Data | Retention |
|---|---|
| Messages identified as spam | 30 days, then deleted |
| IP address, device details and the browsing history sent with a form (pages viewed and how you engaged with them) | 90 days, then removed; only country, city, browser family and the traffic source are kept |
| Anonymous website statistics (page views without cookies) | 3 months, then deleted |
| Enquiries and the related correspondence (including job applications) | 5 years from our last contact or activity on the enquiry, then anonymised so it no longer identifies you. We keep them this long because B2B projects often return after a long time and to be able to establish or defend legal claims. |
| Contracts and accounting records of clients | As long as required by the tax and accounting laws applicable to the Gilzor entity that signed the contract |
| Newsletter subscription | Until you unsubscribe |
Anonymised records (form type, date, country, traffic source and outcome) may be kept for statistics; they no longer contain personal data.
7. Your rights
You have the right to access your data and receive a copy, to have it corrected or erased, to restrict its processing, to data portability, and to object to processing based on our legitimate interests — including, at any time and without giving reasons, to direct marketing. Where processing is based on consent, you can withdraw it at any time without affecting earlier processing.
To exercise your rights, write to contacts@gilzor.com. We reply within one month. We may ask you to confirm your identity before acting on a request.
You also have the right to lodge a complaint with a data protection authority, in particular the President of the Personal Data Protection Office (UODO) in Poland, the Commissioner for Personal Data Protection in Cyprus, or the authority in your country of residence or work.
8. Cookies and similar technologies
We use cookies and browser storage in two groups:
- Necessary — always on: bot protection on our forms (Cloudflare Turnstile), remembering your cookie choice, and sending a form you submit together with the page you sent it from.
- Analytics — Google Analytics cookies (such as
_ga), Hotjar, Contentsquare and Fastbase, and remembering how you arrived at the site (landing page, campaign tags, pages viewed) so that a form you later send can include it.
If you visit from the EEA, the UK or Switzerland, analytics cookies and storage are used only after you click “Accept” in the cookie banner. Until then Google Analytics runs in Google’s Consent Mode: it receives cookieless, aggregated signals (such as a page view) that do not identify you or your device across visits. Visitors from other countries see no banner; analytics is on by default and you can switch it off at any time.
Your choice is kept in your browser for 12 months. You can change it at any time: . You can also block or delete cookies in your browser settings. Declining analytics does not affect your ability to contact us.
9. Security
All traffic to the website is encrypted. Form submissions are stored in a database accessible only to authorised Gilzor staff through a password-protected interface. Technical data is reduced after 90 days and enquiries are anonymised as described above.
10. Changes to this policy
We may update this policy when our website or services change. The date at the top shows the latest version.
