Privacy Policy
Last updated: October 21, 2026
1. Data controller
The controller of your personal data is Kamil Kalicki, a sole trader running a business under the name Usługi Informatyczne Kamil Kalicki (brand: FastWebLab), ul. Magazynowa 9A/41, 02-652 Warsaw, Poland. Tax ID (NIP) 5272857438, statistical number (REGON) 380708138, entered in the Polish business register (CEIDG).
Contact for personal data matters: kontakt@fastweblab.pl.
We process personal data under Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”). This policy applies to everyone who uses fastweblab.com, wherever they are. Our Polish website, fastweblab.pl, has its own privacy policy, in Polish.
2. What data we process and where it comes from
We process only the data you give us and technical data related to your use of the site:
- Contact form: name, company name, email address, website or app URL, the service and package you choose, and your message.
- Correspondence: data you give us later in our exchange of messages (email address, phone number, details needed for a quote and a contract).
- Technical data: IP address, browser and device type, date and time of the request to the site. Our hosting provider records them in logs for security and diagnostics. To enforce the request limit in the contact form, we use a hash of your IP address. It expires after 10 minutes, and we delete expired entries automatically within 24 hours.
- Visit statistics: the page visited, the page you came from, your country and browser or device type. Cloudflare creates them when handling requests to the site, without cookies or scripts in your browser, as aggregate data only.
This policy covers data we process as a controller. When we review, fix or monitor your app and get access to personal data of its users, we process that data on your behalf, as a processor, under a data processing agreement with you.
3. Purposes and legal bases
| Purpose | Legal basis | Retention |
|---|---|---|
| Replying to your inquiry from the form or by email, and preparing a quote | If you ask on your own behalf: Art. 6(1)(b) GDPR (the contract for sending an inquiry under our Terms, and steps taken before entering into a contract). If you write on behalf of a company: Art. 6(1)(f) GDPR (legitimate interest: contact with a representative of a company asking about our services). | up to 12 months from the last contact if no contract is concluded |
| Protecting the form from abuse | Art. 6(1)(f) GDPR (legitimate interest: security of our services) | request counter (IP address hash): expires after 10 minutes, deleted within 24 hours |
| Concluding and performing a contract | Art. 6(1)(b) GDPR if you are the party to the contract; Art. 6(1)(f) GDPR if you represent a company (legitimate interest: contact regarding the contract) | for the duration of the contract |
| Invoicing and tax settlements | Art. 6(1)(c) GDPR (legal obligation under Polish tax law) | until the tax liability becomes time-barred, usually 5 years from the end of the calendar year in which the tax payment deadline passed |
| Establishing, pursuing or defending claims | Art. 6(1)(f) GDPR (legitimate interest: protecting our rights) | until the limitation periods expire |
| Site security and spam protection | Art. 6(1)(f) GDPR | up to 30 days (logs) |
| Visit statistics (aggregate Cloudflare server statistics, no scripts in your browser) | Art. 6(1)(f) GDPR (legitimate interest: assessing traffic on the site) | source data: as for logs, up to 30 days; then aggregate data only |
Providing data in the form is voluntary, but without your name and email address we won't be able to reply. Our Terms describe the rules for using the form.
4. Recipients of data
We entrust some data to providers who process it on our behalf (Art. 28 GDPR):
- Cloudflare, Inc. (USA): site hosting, CDN, database for the request counter (D1, Europe region), spam protection (Turnstile) and aggregate visit statistics from handling requests to the site. Data may be processed outside the European Economic Area (EEA); Cloudflare participates in the EU-U.S. Data Privacy Framework (DPF) and uses standard contractual clauses.
- Resend (Plus Five Five, Inc., USA): delivering emails from the contact form. It keeps copies of sent messages for up to 30 days. Resend participates in the DPF and also uses standard contractual clauses.
- home.pl sp. z o.o. (Poland): the kontakt@fastweblab.pl mailbox, where we handle inquiries from the form and further correspondence.
- Accounting office: bookkeeping of invoices.
With Cloudflare and Resend, the data processing agreement is part of the service terms. Transfers outside the EEA are based on the European Commission's adequacy decision for the DPF; the providers also use standard contractual clauses. We will provide a copy of these clauses on request sent to kontakt@fastweblab.pl.
Other recipients process data as independent controllers, under their own rules:
- Cloudflare, Inc. (USA): also uses data from Turnstile verification (IP address, browser and connection characteristics) to improve bot detection.
- Banks and payment service providers that handle payments of our invoices.
- Public authorities, where required by law.
We don't sell data or share it with others for marketing purposes.
5. Your rights
You have the right to access your data, to have it rectified or erased, to restrict its processing and, where applicable, to data portability. To exercise your rights, write to kontakt@fastweblab.pl.
You can also lodge a complaint with a data protection supervisory authority, in particular in the EU or EEA country where you habitually live or work, or where you believe the infringement took place. In Poland, where we are based, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland). If you are in the UK, see section 9.
Right to object. Where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then stop processing the data for that purpose, unless we demonstrate compelling legitimate grounds or need the data to establish, pursue or defend claims. Just email kontakt@fastweblab.pl or reply to our message.
6. Automated decisions and profiling
We don't make decisions based solely on automated processing, and we don't profile site users.
7. Cookies
The site stores in your browser only what the service you ask for needs: Cloudflare Turnstile verification data when you use the contact form. Cloudflare cookies appear only in special situations, for example during an additional check whether you are a bot. We don't use advertising or tracking cookies, and visit statistics work without cookies. Details are in our Cookie Policy.
8. Changes to this policy
We may update this policy when the law or the way the site works changes. The current version is always available at this address, with the date of the last update.
9. If you are in the UK or the USA
UK. If UK data protection law applies to our processing of your data, you have the rights described in section 5. You can complain to us at kontakt@fastweblab.pl: we'll confirm receipt within 30 days and reply without undue delay. You can also complain to the Information Commissioner's Office (ico.org.uk). Transfers of data of people in the UK to Cloudflare and Resend in the USA are based on the UK Extension to the DPF.
USA. We don't sell your personal information or share it for targeted advertising. We don't track you across other websites, so our site doesn't respond differently to “Do Not Track” signals. Apart from Cloudflare's bot protection described in section 4, no other party collects information about your activity across websites through our site.