Privacy policy
How we process personal data on gfood.love.
Effective date: 25 April 2026 · Version: 1.0
This Privacy Policy sets out how personal data are processed in connection with use of the website gfood.love and the conduct of business communications by the controller. The Polish-language version applies as the legally binding text; this English translation is provided for convenience.
The policy has been prepared in compliance with:
- Regulation (EU) 2016/679 of 27 April 2016 — the GDPR;
- The Polish Personal Data Protection Act of 10 May 2018;
- Directive 2002/58/EC on privacy in the electronic communications sector (ePrivacy);
- The Polish Telecommunications Act of 16 July 2004 (Article 173).
1. Data controller
The controller of your personal data is:
ND Norbert Dykiel — sole proprietorship registered in CEIDG (Polish business register)
VAT ID: PL5262658973 · REGON: 015859179
Registered place of business / correspondence:
ul. Kołobrzeska 52E, apt. 10, 05-510 Konstancin-Jeziorna, Poland
Contact email: e-mail
2. Contact for GDPR matters
For all matters relating to processing of your personal data, please contact the controller:
- email (preferred): e-mail
- by post: at the controller’s address indicated in section 1.
A Data Protection Officer has not been appointed — the controller’s profile and processing scale (sole proprietorship) do not meet the criteria of Article 37 GDPR.
3. Purposes and legal bases for processing
3.1. Contact via the website form
- Data: name / company or school name, email, phone (optional), role or position, message content, IP address, browser User-Agent, timestamp.
- Legal basis: Article 6(1)(f) GDPR — legitimate interest of the controller (handling enquiries and conducting business correspondence); for natural persons requesting an offer: Article 6(1)(b) GDPR (steps prior to entering into a contract).
- Purpose: reply to the enquiry, prepare an offer, establish contact about the gfood programme.
3.2. Email and phone correspondence
- Legal basis: Article 6(1)(f) GDPR (B2B communications) and Article 6(1)(b) GDPR if leading to a contract.
3.3. Site security and abuse prevention
- Data: IP address, User-Agent, timestamps, Cloudflare Turnstile verification data.
- Legal basis: Article 6(1)(f) GDPR — legitimate interest (site security, prevention of spam and automated attacks).
3.4. Compliance with legal obligations
- Legal basis: Article 6(1)(c) GDPR — obligations under tax and accounting law.
4. Retention periods
| Category / purpose | Retention |
|---|---|
| Form enquiries with no business relationship | 3 years from last contact |
| Customer correspondence (after contract) | 5 years after end of cooperation |
| Accounting data (invoices, contracts) | 5 years from end of tax year |
| Server logs / security data | 12 months |
| Technical cookies (Cloudflare Turnstile) | up to 30 minutes (session tokens) |
5. Data recipients
To the extent necessary for service provision we use trusted processors:
5.1. Technical processors
- Hosting provider (the company hosting the gfood.love website and email).
- Cloudflare, Inc. (San Francisco, USA) — Turnstile (form bot protection).
- Google LLC (Mountain View, USA) — Google Fonts (web fonts loaded by the browser).
5.2. Supporting parties
- Accountancy firms / tax advisors — for bookkeeping.
- Postal and courier operators — for paper correspondence.
- Law firms — in the event of disputes or claims.
All processors operate under written data processing agreements (Article 28 GDPR) including confidentiality and appropriate security obligations.
6. Transfers to third countries
Some data may be transferred outside the European Economic Area (EEA), in particular to the USA:
- Cloudflare, Inc. (USA) — for Turnstile.
- Google LLC (USA) — for Google Fonts.
Transfers comply with Chapter V GDPR on the basis of:
- EU-U.S. Data Privacy Framework — Commission Implementing Decision (EU) 2023/1795 of 10 July 2023;
- Standard Contractual Clauses (SCC) — Commission Implementing Decision 2021/914.
7. Your rights
Under the GDPR you have the following rights:
| Right | GDPR | Description |
|---|---|---|
| Access | Art. 15 | Obtain a copy of your data and information about processing. |
| Rectification | Art. 16 | Correct inaccurate or incomplete data. |
| Erasure ("right to be forgotten") | Art. 17 | Erase data when the purpose ceases. |
| Restriction | Art. 18 | Temporarily limit use of your data. |
| Portability | Art. 20 | Receive data in a machine-readable format. |
| Objection | Art. 21 | Object to processing based on legitimate interest. |
| Withdraw consent | Art. 7(3) | Without affecting prior processing. |
| Complaint to a supervisory authority | Art. 77 | President of the Polish Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl |
To exercise your rights please contact us: e-mail. We respond without undue delay, no later than 30 days from receipt of the request (Article 12(3) GDPR).
8. Voluntariness
Providing data via the contact form is voluntary but necessary in order to receive a reply. Failure to provide data in required fields will make it impossible to handle the enquiry.
9. Automated decision-making and profiling
Your data are not used for automated decision-making, including profiling, within the meaning of Article 22 GDPR. The only automated operation concerns form security verification (Cloudflare Turnstile), aimed solely at distinguishing human visitors from bots.
10. Data security
We apply appropriate technical and organisational measures to protect personal data, including:
- HTTPS encryption (TLS 1.3);
- multi-layer protection of the contact form: Cloudflare Turnstile, honeypot, rate limits, anti-spam filters (HMAC time-trap, blacklists, Cyrillic filter, link cap);
- regular software updates;
- access controls (strong passwords, least-privilege principle);
- encrypted backups.
12. Changes to this Privacy Policy
We reserve the right to amend this Privacy Policy. We will notify you of material changes by updating this page and dating the new version. Previous versions are archived and available on request.
13. Final provisions
Matters not regulated by this Privacy Policy are governed by the GDPR, the Polish Personal Data Protection Act and other applicable provisions of Polish and EU law.