01 Who is responsible for your data
The controller of your personal data is Undernapse Sp. z o.o. — the entity that decides what data is collected and for what purpose.
- Controller
- Undernapse Sp. z o.o.
- Legal form
- limited liability company
- Address
- ul. Hoża 86 lok. 410, 00-682 Warszawa, Polska
- NIP
- 7011145585
- REGON
- 525353982
- KRS
- 0001037160
- hello@undernapse.com
Send requests and questions about personal data to the address in the “Data protection contact” section. A short message is enough — you do not need a form or a specific legal wording.
02 What this policy covers
This policy covers processing connected with undernapse.com in both the Polish and English version: reading the content, the contact form, email correspondence, booking a call, and site analytics.
The policy does not cover data processed while delivering client projects. Where we sign a contract, the rules for project data are set out in a separate data processing agreement, and the scope and purpose follow from that agreement.
We do not process data in any way that would require consent beyond analytics. We do not sell data, we do not build marketing profiles, and we do not share data with parties who would use it for their own advertising purposes.
03 What data we process and on what basis
The table below lists every situation in which we process personal data in connection with the site. For each purpose we give the Article 6(1) GDPR legal basis and the retention period.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering an enquiry from the form or by email | Name, email address, company name (optional), project and timeline information, message content, date and language of the enquiry | Art. 6(1)(b) GDPR — steps taken before entering into a contract; otherwise Art. 6(1)(f) GDPR (answering the enquiry and developing our offer) | 24 months from the last contact |
| Booking a call | Name, email address, chosen time slot, answers given in the booking form | Art. 6(1)(b) GDPR — steps taken before entering into a contract; Art. 6(1)(f) GDPR | 24 months from the last contact |
| Contract performance and billing | Contact and company details, invoicing data, correspondence, scope and progress of the work | Art. 6(1)(b) GDPR — performance of the contract; Art. 6(1)(c) GDPR — tax and accounting obligations | 5 years from the end of the tax year in which the document was issued; longer where the law requires |
| Site analytics (Google Analytics 4) | Pseudonymous identifiers, device and browser information, pages visited, language, events (e.g. form submission, click through to booking) | Art. 6(1)(a) GDPR — your consent | 14 months in the analytics tool; cookies up to 2 years |
| Site security and infrastructure logs | IP address, date and time of the request, requested URL, browser information | Art. 6(1)(f) GDPR — keeping the site secure and preventing abuse | Up to 30 days, unless an incident requires longer retention |
| Establishing, pursuing and defending claims | Data needed to demonstrate how a collaboration ran and what was agreed | Art. 6(1)(f) GDPR — legitimate interest | Until the limitation periods for claims expire |
The scope of data in the form follows the fields you fill in. Required fields are marked in the form; the rest are optional.
The three legal bases in short: (b) covers what is necessary to answer an enquiry and prepare a contract; (a) is consent, which you give for GA4; (f) is our legitimate interest — answering enquiries, keeping the site secure, running cookieless Cloudflare Web Analytics and defending claims. Where we rely on (f), you can object at any time (see “Your rights”).
Consent is voluntary and you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
04 The contact form and correspondence
In the form you provide your name, email address, optionally your company name, information about what you need and when you want to start, and your message. We use this data only to reply and to establish whether we can help.
Technically, the submission goes to a function running on Cloudflare infrastructure, which stores it as a JSON file in a private R2 bucket. Our own n8n instance — self-hosted, maintained by us and not reachable from the internet — picks the submissions up from that bucket and forwards them to a mailbox. Submissions identified as spam are not stored.
We also correspond by email, at the address given in the contact section. Data from that correspondence is processed for the same purposes and for the same period as form submissions.
Do not send special categories of data through the form, for example health information. If such an exchange cannot be avoided, first write a few sentences without that data — we will then propose a safer channel and appropriate safeguards.
05 Booking a call
You can book a call through Calendly. The link opens Calendly in a new tab, and Calendly collects the data you enter there: name, email address, chosen time slot and answers in the booking form.
Calendly LLC, based in the USA, processes that data on our behalf as a processor. For its own purposes — account management, security and billing — it acts as a separate controller and applies its own privacy policy.
We receive the booking information and the data needed to hold the conversation. We do not record calls. If we ever want to record them, we will say so before the call and ask for your consent.
06 Site analytics
We use Google Analytics 4 to learn which pages are read and where the content should improve. GA4 only starts after you consent: before that we load no Google script, send no events and set no _ga cookies.
GA4 is provided by Google Ireland Limited. The analytics data is pseudonymous — it contains no name, email address or form message content. We have no access to your IP address in GA4 reports, and we do not combine analytics data with contact data.
We do not run remarketing and we do not use analytics data to personalise advertising. If you do not consent, GA4 simply does not run — and the site still works in full.
Independently of GA4 we use Cloudflare Web Analytics: aggregated visit and performance statistics. It sets no cookies and stores no information in your browser, does not identify you and does not track you across sites. Its legal basis is our legitimate interest (Art. 6(1)(f) GDPR) — knowing which content is read and how the site performs. It needs no consent, because it neither stores nor reads information on your device; you can object to this processing at any time.
You can withdraw consent in the cookie settings panel. Withdrawal removes the GA4 cookies and switches GA4 off. Cloudflare analytics runs independently of consent because it stores nothing on your device; you can object to it. Names, lifetimes and how to change your decision are described in the Cookie Policy.
07 Recipients and processors
We do not sell data and we do not share it for marketing purposes. Recipients are service providers who process data solely on our behalf, within the scope described below and under a data processing agreement.
| Entity | Role | Scope | Location and safeguards |
|---|---|---|---|
| Cloudflare, Inc. | processor | site hosting and CDN, attack protection, storing enquiries in the R2 bucket, aggregated site analytics (Cloudflare Web Analytics — no cookies) | USA — EU-US Data Privacy Framework and standard contractual clauses |
| Google Ireland Limited | processor | GA4 analytics, only after consent | Ireland; data may reach Google LLC in the USA under the DPF and standard contractual clauses |
| Calendly LLC | processor; separate controller for its account operations | booking call slots | USA — standard contractual clauses |
| n8n on our own infrastructure | not a separate entity — the controller's own tool | picking enquiries up from the R2 bucket and forwarding them to a mailbox | controller infrastructure in the EEA; not reachable from the internet |
To a limited extent, data may reach our advisers — accounting and legal support — and public authorities where a statutory obligation requires it. Every recipient receives only the data necessary for that purpose.
08 Transfers outside the EEA
Some of our providers are based in the United States, so data may be transferred outside the European Economic Area. We only do this where an adequate level of protection is in place:
- an adequacy decision (the EU-US Data Privacy Framework, Commission Implementing Decision of 10 July 2023) — where the provider is certified under it;
- standard contractual clauses approved by Commission Implementing Decision 2021/914 together with supplementary measures: encrypted transit, data minimisation and access limited to named people.
If you would like a copy of the safeguards used for a transfer, write to the address in the “Data protection contact” section. We will identify the provider and the transfer basis.
09 How long we keep data
Retention periods are listed for every purpose in the table under “What data we process and on what basis”. Once they expire, we delete or anonymise the data so that it can no longer be linked to a person.
We keep contract and billing data for 5 years from the end of the tax year in which the document was issued, as required by tax and accounting law. We may pursue claims until the limitation periods expire — generally 6 years (Article 118 of the Polish Civil Code); if proceedings are pending, we keep the data until they end.
Data may remain in backups during their rotation cycle. We do not use it for day-to-day work, and only the people responsible for infrastructure have access to the backups.
We remember your analytics consent decision for 180 days. After that we ask again. You can change your decision earlier, at any time.
10 Your rights
In connection with the processing of your data, you have the following rights:
- Right of access
- You can find out whether we process your data and, if so, receive a copy together with information about purposes, legal basis, recipients and retention (Art. 15 GDPR).
- Right to rectification
- We will correct inaccurate data or complete incomplete data (Art. 16 GDPR).
- Right to erasure
- We will delete data when there is no longer a basis for processing, when you withdraw consent or when you object — unless the law requires us to keep it (Art. 17 GDPR).
- Right to restriction
- While a matter is being clarified, we may restrict processing to storage only (Art. 18 GDPR).
- Right to data portability
- Data you provided to us and that we process under a contract or consent will be provided in a machine-readable format (Art. 20 GDPR).
- Right to object
- You can object to processing based on our legitimate interest. We will then stop processing unless we demonstrate compelling grounds that override your rights (Art. 21 GDPR).
- Right to withdraw consent
- You can withdraw analytics consent at any time in the cookie settings panel. Withdrawal does not affect the lawfulness of earlier processing (Art. 7(3) GDPR).
Send your request to the address in the “Data protection contact” section. We reply without undue delay and in any case within one month of receiving the request (Art. 12(3) GDPR). If the matter is complex, we will tell you that the deadline is being extended and why. Exercising your rights is free of charge; in the exceptional case of a manifestly unfounded or excessive request we may charge a reasonable fee or refuse — always with reasons.
You also have the right to lodge a complaint with a supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl. You may complain in the Member State where you habitually reside, where you work, or where the alleged infringement took place. A complaint to the Polish authority does not prevent you from seeking a judicial remedy.
11 How we protect data
The site runs over HTTPS only. Enquiries land in a private bucket with no public access, and only named people can reach the mailboxes and the data, with two-factor authentication. Permissions are granted for the duration of a task and revoked when it ends.
We keep backups, update dependencies and limit the data we collect to what is needed to reply or perform a contract. In the event of a personal data breach we assess the risk to data subjects and — where the risk is high — notify the Polish supervisory authority within 72 hours and inform the people concerned (Art. 33–34 GDPR).
12 Automated decisions and AI tools
We do not make decisions about you solely by automated means that would produce legal effects or similarly significantly affect you (Art. 22 GDPR). We do not profile you for marketing purposes.
In day-to-day work we use AI tools — to tidy notes, summarise documents and draft text. A person reviews every reply and every decision about your matter. We do not train models on client data, and we do not pass personal data to external model providers without an appropriate legal basis.
13 Changes to this policy
We update the policy when the scope of processing, our providers or the law change. Every version carries a number and a date, and previous versions are available on request.
- Version 1.0 — effective from 10 November 2026. First version of the document.
We announce material changes on the site and, where the law requires it, by email to the people who have a contract with us. A change to the policy does not change the rules for data already collected under an existing contract.
14 Data protection contact
For anything related to personal data — requests for access, rectification, erasure or restriction, objections, questions about recipients and transfers — write to:
- Data protection contact
- hello@undernapse.com
Messages sent to this address are flagged as data protection matters and passed to the person responsible for handling them. We reply within one month of receiving a request.
If you are not sure how to word a request, describe briefly what the matter is — we will work out the rest in correspondence. We do not charge for making a request and we do not require a specific form.
In the event of any discrepancy between the Polish and English versions, the Polish version prevails. The rules on cookies and local storage are described in the Cookie Policy.