Privacy Policy
This policy explains what personal data cklicky.com collects when you use this website, why we collect it, who we share it with and what rights you have under the EU General Data Protection Regulation (GDPR).
Version 1.5 · Effective 12 November 2026
1. Who is responsible for your data
cKlicky.com is the service trade name. The legal service provider, and the controller of your personal data, is:
Tomasz Szymoński
VAT ID 6792895776
ul. Białoruska 61/7, 30-638 Krakow, Poland, European Union
Email: hi@cklicky.com
For any question about this policy or your data, write to hi@cklicky.com. We have not appointed a Data Protection Officer because we are not required to.
2. What data we process and why
2.1 Visiting the website
When you open any page, your browser sends technical data to our hosting provider, Cloudflare: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. This is necessary to deliver the website, keep it secure and protect it from attacks.
Legal basis: our legitimate interest in running a secure, working website (Art. 6(1)(f) GDPR).
2.2 Contact form
When you send the contact form we receive your name, email address, the type of project and your message. We also record that you confirmed reading this policy, and which version. The form is processed by Formward, an EU form service based in Sweden, which stores the submission on servers in Sweden and emails it to us.
Spam protection: to stop automated spam, Formward checks submissions with a hidden trap field, rate limiting and automated filters. The form can additionally use Cloudflare Turnstile, a privacy-friendly human check that usually needs no interaction. Turnstile is loaded only when you start filling in the form, not when you open the page; it processes technical signals such as your IP address, browser and device information, and does not read what you type into the form. Legal basis: our legitimate interest in protecting the form from abuse (Art. 6(1)(f) GDPR); the processing is strictly necessary to provide the form you are using.
Purpose: to answer your enquiry and prepare an estimate. Legal basis: your consent (Art. 6(1)(a) GDPR), which you give by ticking the box above the "Send" button. Without it the form cannot be sent. You can withdraw your consent at any time by emailing hi@cklicky.com; we will then stop working on your enquiry and delete it. Withdrawal does not affect processing that took place before it. If we go on to negotiate or sign a contract with you, we process the data needed for that as steps taken at your request before entering into a contract and to perform it (Art. 6(1)(b) GDPR).
2.3 Email
If you email us at hi@cklicky.com, we process your email address, name and anything you include in the message. Email sent to this address is forwarded by Cloudflare Email Routing to our mailbox at Proton Mail, provided by Proton AG in Switzerland.
Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering messages sent to us (Art. 6(1)(f) GDPR).
2.4 Booking a call
You can book a call through our calendar hosted by Cal.com. The calendar opens on Cal.com's website only after you confirm you have read this policy and click "Open booking calendar"; nothing from Cal.com is loaded on our site before that. Cal.com receives your name, email address, the chosen time and any notes you add, and sends the meeting invitation.
Legal basis: your consent (Art. 6(1)(a) GDPR), which you give by ticking the box next to the booking button. You can withdraw it at any time by cancelling the booking or emailing hi@cklicky.com, without affecting processing that took place before. Once a call is booked we also rely on steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). Cal.com's own privacy policy also applies on its website.
2.5 Website analytics (only with your consent)
If you click "Accept" in the cookie banner, we load Cloudflare Web Analytics to count visits and see which pages are useful. It does not use cookies, does not store anything on your device and does not build a profile of you. It processes the page address, the referring page, your browser and device type, your country and page-load timings.
Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law). If you click "Reject" or ignore the banner, analytics is never loaded. You can withdraw your consent at any time, with effect for the future, using "Cookie settings" at the bottom of every page.
3. Service providers we use
We use the following providers. They process personal data on our behalf and on our instructions, under a data processing agreement. There are two exceptions: the booking calendar runs on Cal.com's own website, where Cal.com's privacy policy applies as well; and Cloudflare also uses Turnstile signals for its own bot-detection purposes, as described in its Turnstile privacy addendum.
| Provider | What for | Data | Location |
|---|---|---|---|
| Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA | Website hosting (Cloudflare Pages), content delivery and security | IP address, technical request data | Global network incl. EU; USA |
| Cloudflare, Inc. – Email Routing | Forwarding email sent to hi@cklicky.com | Email addresses and message content | USA |
| Cloudflare, Inc. – Web Analytics | Anonymous visit statistics, only after consent | Page, referrer, browser and device type, country | USA |
| Proton AG (Proton Mail), Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland | Our mailbox: storing and answering email | Email addresses and message content | Switzerland (covered by an EU adequacy decision) |
| EGF Group AB (Formward), Stockholm, Sweden, org. nr 559501-3573 | Receiving, storing and emailing contact form messages to us; spam filtering | Name, email, project type, message, IP address (hashed for rate limiting) | EU: servers in Sweden (Hostup AB); email delivery via Mailjet/Sinch in France |
| Cloudflare, Inc. – Turnstile | Human check on the contact form, only when you start filling it in | IP address, browser and device signals | USA |
| Cal.com, Inc., USA | Scheduling calls, only when you open the booking calendar | Name, email, chosen time, notes | USA |
What we do not use: we do not use any Google services (no Google Analytics, Tag Manager, Fonts or Maps), Meta (Facebook) Pixel, advertising or remarketing cookies, or embedded social media content. Text uses your device's built-in fonts and all icons are part of our own code, so no font or icon service is contacted. If we ever add a new service that processes your data, we will update this policy before it goes live.
We do not sell your personal data. We may share it with public authorities only where the law requires it.
4. Transfers outside the EU
Our mailbox provider is based in Switzerland, which the European Commission has recognised as providing adequate data protection (Art. 45 GDPR). Some other providers listed above are based in the USA. Where data is transferred outside the European Economic Area, it is protected either by the provider's certification under the EU–US Data Privacy Framework (an adequacy decision of the European Commission, Art. 45 GDPR) or by the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for a copy of the relevant safeguards. Contact form submissions are stored and delivered within the EU.
5. How long we keep data
- Technical request data at Cloudflare: for the short period set by Cloudflare's logging and security systems.
- Contact form submissions at Formward: 30 days, after which they are deleted from Formward. The copy delivered to our mailbox is kept as described in the next point.
- Enquiries (contact form, email, call bookings): up to 12 months after our last contact, unless a contract follows or you withdraw your consent earlier.
- Contract and invoice data: for as long as Polish tax and accounting law requires (generally 5 years from the end of the year in which the tax payment was due).
- Your cookie choice: 12 months in your browser, after which we ask again.
- Analytics: only aggregated statistics, which do not identify you.
7. Your rights
Under the GDPR you have the right to:
- access your personal data and get a copy (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- restrict processing (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on our legitimate interest (Art. 21);
- withdraw your consent at any time, without affecting processing that happened before (Art. 7(3)).
To use any of these rights, email hi@cklicky.com. We will reply within one month.
You also have the right to lodge a complaint with a data protection authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You can also contact the authority in your own EU country.
8. Other information
Giving us your data is voluntary, but without your name, email address and message we cannot answer your enquiry or schedule a call. We do not use automated decision-making or profiling.
We may update this policy when our services or the law change. The version number and effective date at the top of this page always show the current version. If the change affects your cookie choice, we will ask you again.