Privacy and cookies policy

Version dated 11 October 2026.

This document combines information about the processing of personal data with the rules for cookies and similar technologies used on Szalapski.pl.

1. Controller and contact

The controller of personal data is Espresso Media Karol Szałapski, ul. Hausbrandta 32/70, 80-126 Gdańsk, Poland (the “Controller”).

For privacy, data-rights or cookie matters, use the dedicated contact form. You may also write to the postal address above. Data provided in such a request is used only to handle it; the form does not require marketing consent.

2. Data processed, purposes and legal bases

Enquiries and quotes

The standard form and quote assistant may collect your name, email address, optional phone number, project description, deadline, intended use of the recording, pasted script and attachments. The data is processed to:

• handle the enquiry, including sending an electronic response or offer relating to it, and take steps at the person's request before entering into a contract — Article 6(1)(b) GDPR;
• establish, exercise or defend legal claims — the Controller's legitimate interest under Article 6(1)(f) GDPR.

The response and offer relate only to the particular enquiry. Sending the form is not a newsletter subscription or consent to later marketing.

Service delivery and accounting

When an order is placed, contact and company details, invoice data, correspondence, production materials and payment information are processed to perform the contract (Article 6(1)(b) GDPR), comply with tax and accounting duties (Article 6(1)(c) GDPR) and protect against claims (Article 6(1)(f) GDPR).

Privacy requests

The dedicated form requires an email address and a description of the request; name and surname are optional. The data is processed to handle the request and meet GDPR obligations — Article 6(1)(c) GDPR. If the message concerns another matter, the basis may be steps taken at the person's request (Article 6(1)(b) GDPR) or the legitimate interest in handling correspondence and documenting it (Article 6(1)(f) GDPR).

Security and technical logs

The server may automatically record the request time, IP address, browser type and version, operating system, requested address, referring page and response code. This data is used to maintain security, diagnose errors and prevent abuse on the basis of the Controller's legitimate interest (Article 6(1)(f) GDPR).

Analytics, session recordings and campaign measurement

After the relevant consent has been obtained, the website may use Google Analytics 4, Hotjar and Google Ads Conversion Tracking. The Controller's legal basis for processing personal data is consent (Article 6(1)(a) GDPR), while storing or accessing information on a device relies on consent under Articles 399–400 of the Polish Electronic Communications Law. Consent may be changed or withdrawn at any time through “Cookie settings”. Withdrawal does not affect the lawfulness of earlier processing.

• Google Analytics 4 (Google Ireland Limited) measures traffic, acquisition sources and conversions. It may process online identifiers, approximate location derived from an IP address, device and browser information, pages visited, events and visit times. User-ID, Google Signals and advertising personalisation are not used.
• Hotjar (Hotjar Limited) creates heatmaps and recordings of website use after analytics consent. They may include cursor movements and clicks, scrolling, screen size, device and browser type, country, visited addresses and visit time. The data-hj-suppress attribute on forms and the quote assistant masks or suppresses their content and values, but does not by itself mean that all interaction metadata is excluded. Full exclusions for quote and privacy-policy pages and relevant areas, and disabling Identify and survey features, must therefore be maintained and verified in the Hotjar administration panel.
• Google Ads Conversion Tracking (Google Ireland Limited) attributes a submitted quote form to an earlier ad click and measures campaign effectiveness. After advertising consent, it may process the ad-click identifier, page and referrer URLs, timestamp, device and browser information, IP address and the conversion event. We do not provide Google Ads with a name, email address, phone number, form content, enquiry content or attachments. Enhanced conversions, remarketing and advertising personalisation are disabled.

The “Call” button does not send contact details to the server. Its click may be recorded as a measurement event only after the relevant consent has been given.

3. Quote assistant and local draft

The quote assistant is an interactive version of the form. It guides the user through a fixed sequence of questions and does not use artificial intelligence or an external conversation provider.

While the form is being completed, responses are automatically saved as a draft in the device's localStorage under szalapski-quote-assistant-v3. The draft may contain project information, pasted script and contact details, but not attachments or consent choices. It stays solely in the browser and is not sent to the Controller or analytics providers before the form is knowingly submitted. The draft remains valid for 24 hours after its last update. Once that period has passed, it is recognised as expired and removed the next time the assistant starts. It is also removed after a successful submission; it can be removed earlier with the “Delete draft” control in the assistant or by clearing this site's browser data.

The mechanism maintains continuity of the form-completion function requested by the user and is treated as necessary for that function. It is not used for tracking or advertising.

4. Recipients

Data may be disclosed to recipients whose involvement is necessary to operate the website or fulfil an order:

• hosting, server infrastructure, email and SMTP providers;
• accounting, legal and IT service providers;
• banks, payment providers and authorised public authorities where required by a contract or law;
• Google Ireland Limited — for Google Tag Manager, Google Analytics 4 and Google Ads conversion measurement;
• Hotjar Limited — as a processor for session recordings and heatmaps.

Personal data is not sold. Providers of optional tools receive data only after the relevant consent has been given.

5. Transfers outside the European Economic Area

Google and Hotjar may use affiliates or subprocessors outside the EEA, particularly in the United States. A transfer is based on an appropriate legal mechanism, such as a European Commission adequacy decision — including the EU–US Data Privacy Framework where it applies to a recipient — or Standard Contractual Clauses together with any required supplementary measures. Information about the applicable mechanism or a copy may be requested using the form identified in section 1.

6. Retention

• local assistant draft: remains valid for 24 hours after its last update and is removed the next time the assistant starts after that period, following successful submission, use of “Delete draft”, or when site data is cleared earlier;
• enquiries that do not result in an order: no more than 12 months from the last contact, unless data is needed longer to handle a claim;
• completed-order records and correspondence: for the performance of the contract and until the relevant limitation periods expire;
• tax and accounting documents: for the period required by law;
• data-rights requests: while handled and then for the period needed to demonstrate compliance and defend claims;
• standard server logs: for the period necessary for security and diagnostics under the infrastructure configuration;
• Google Analytics 4: event and user data is retained for the period configured at GA4 property level; the criterion is the shortest period needed to compare statistics and assess the website's effectiveness. This is separate from cookie lifetimes in section 10;
• Hotjar: session recordings and heatmaps are retained for no more than 30 days; Hotjar cookie lifetimes are described separately in section 10;
• Google Ads: conversion data is retained under the account settings and service rules for the period needed to attribute and evaluate campaign effectiveness; cookie and local-storage lifetimes are described separately in section 10.

Withdrawing consent stops future collection by optional tools on that device, but it does not automatically erase data collected lawfully before withdrawal. A deletion request can be submitted through the form identified in section 1; whether it can be fulfilled depends, among other things, on whether the data can be linked to the requester and whether it must still be retained.

7. Whether data is required

Providing data in an enquiry is voluntary, but fields marked as required are necessary to respond or prepare a quote. Without them, the enquiry cannot be handled. Data necessary to enter into or perform a contract is a contractual requirement; failure to provide it may prevent the contract from being entered into or performed. Data needed for accounting documents is a statutory requirement. Consent to optional analytics and campaign measurement is voluntary, and refusing it does not restrict access to the website or the ability to send an enquiry.

8. Data-subject rights

Depending on the legal basis and circumstances, you have the right to:

• access your data and receive a copy;
• rectify your data;
• erase your data;
• restrict processing;
• data portability where data is processed by automated means on the basis of consent or a contract;
• object, on grounds relating to your particular situation, to processing based on legitimate interests;
• withdraw consent at any time without affecting the lawfulness of earlier processing;
• lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.

A request may be submitted using the dedicated form or by post to the Controller's address. Identity may need to be verified to an extent proportionate to the risk before a request is fulfilled.

9. Automated decisions

The Controller does not make solely automated decisions that produce legal or similarly significant effects. Enquiries are not profiled to determine prices, priority or access to the service automatically.

10. Cookies and similar technologies

Cookies are small pieces of information stored on or read from a device. Browser localStorage may serve a similar function. Before any mechanism other than a necessary one is activated, the website explains its purpose and allows separate consent for analytics and advertising categories. Inaction, scrolling or closing the settings does not constitute consent.

Mechanisms used

Google Tag Manager controls the activation of optional tools but is not itself consent. Optional categories are denied by default, and the container and tools are loaded only after the relevant choice is saved. The exact set of cookies may change following provider updates; the category or purpose will not change without prior notice and, where required, renewed consent.

Changing or withdrawing consent

Your choice can be changed at any time through “Cookie settings” in the footer. Rejecting is as easy as accepting. After withdrawal is saved, the website blocks future collection by optional tools and removes known optional cookies from this domain; refreshing the page stops scripts that were already loaded. Withdrawal does not automatically erase processing history held by providers. Cookies can also be deleted or blocked in browser settings. Blocking necessary storage may prevent the website from remembering a choice or draft, but refusing analytics and campaign measurement does not restrict the website's core functions.

11. Changes to this policy

This policy may be updated when the website, providers or law changes. If a change affects the scope of consent already given, the website will ask for a new choice. The current version date appears at the beginning of this document.