Datenschutzerklärung

Full privacy policy (English)

About this policy

This policy explains how we process personal data when you visit paulskah.com, subscribe to the Paul Skah newsletter, register for a webinar, contact us or use services offered through this website. It also covers our associated social media profiles. Last updated: 12 October 2026.

Controller and contact

The controller is Midea Sp. z o.o., ul. gen. T. Kutrzeby 14, 52-213 Wrocław, Poland. Company register (KRS): 0000069836; tax number (NIP): 8981962322; REGON: 932639769; share capital: PLN 50,000. Paul Skah is the brand through which we operate this website.

For privacy questions or to exercise your rights, email [email protected] or write to the controller at the postal address above. We have not appointed a data protection officer. We may need proportionate information to verify your identity before disclosing or changing personal data.

What we collect and why

Browsing and security: our servers and infrastructure providers process technical request information, including IP address, time, requested page, browser information and security signals. This lets us deliver the website, prevent abuse and diagnose failures. The GDPR basis is our legitimate interest in providing and protecting the service (Article 6(1)(f)).

Contact and bookings: we process the details you provide, such as your name, email address, message and requested service or meeting time. We use them to answer you, arrange a meeting and manage the resulting correspondence. The basis is taking steps at your request before entering a contract (Article 6(1)(b)) or our legitimate interest in handling enquiries (Article 6(1)(f)), depending on your request.

Newsletter and webinars: we process your email address, chosen language, subscription and confirmation information, registration details and relevant email delivery or interaction information. We use this to provide the material you requested and manage subscriptions. Promotional email requires your opt-in; you can withdraw it using the unsubscribe link or by contacting us. Consent is the basis for consent-based processing (Article 6(1)(a)). We may retain necessary subscription and consent evidence on the basis of our legitimate interest in demonstrating lawful communications and handling claims (Article 6(1)(f)).

Orders and accounts, where these services are offered: we process the contact, account, billing, purchase and transaction information needed to provide the service (Article 6(1)(b)), meet tax and accounting obligations (Article 6(1)(c)), and establish, exercise or defend legal claims (Article 6(1)(f)). Payment providers process payment data under their own terms and privacy notices. We do not need your complete payment-card details.

First-party conversion measurement: when you complete an action, we record its type, reference, brand, language, campaign source and time; for a purchase, this may include its value, currency and payment status. To recognise repeated actions, we derive a keyed hash from a normalised email address. The conversion ledger does not store the raw email address. This hash is pseudonymous personal data, not anonymous data. Our GDPR basis for this first-party analysis is our legitimate interest in understanding which content and campaigns produce enquiries, subscriptions and purchases (Article 6(1)(f)). You may object to this processing. The cookie used for it is described below.

Cookies and advertising choices

Cookies are small values stored by your browser. Necessary service cookies support functions such as sessions, security and choices. Where optional advertising or analytics tools are enabled, their use follows your separate consent choice. You can change that choice through the site’s consent controls and manage or delete cookies in your browser. Blocking necessary cookies can affect site functions.

Our own pt_attr cookie is an explicit exception to consent-based optional advertising measurement: our server sets it independently of your consent-banner choice. It identifies the campaign or referring site behind a purchase, newsletter or webinar signup, contact form submission, or free-call booking. It stores first and last visit sources: utm_source, utm_medium, utm_campaign, utm_content, utm_term, utm_id, click IDs fbclid and gclid, the referring domain, landing-page path and visit time. It stores no full referrer URL, email address or persistent visitor ID.

pt_attr is host-only, cannot be read by JavaScript, uses Secure and SameSite=Lax, and expires after 30 days. A new campaign signal renews this period; ordinary navigation does not. It is limited to 2 KB. Deleting it removes the browser’s stored attribution but does not automatically erase conversion records already created on our server. We do not send the contents of pt_attr to advertising platforms. Advertising measurement and advertising identifiers remain subject to a separate consent choice.

For conversion processing we may temporarily retain a bounded technical context: the raw consent choice, allowlisted advertising cookies if present, IP address, user agent, language and page URL without query parameters or fragment. This context expires after six days and is cleared by a daily maintenance task, normally within seven days. It is separate from the campaign facts retained in the ledger. This release does not introduce advertising-platform reporting from the conversion ledger.

If you follow an external link or use an embedded service, its provider may process data under its own privacy policy. Optional tools that need consent must not be treated as necessary merely because they are provided by a third party.

Who receives data

Authorised staff and service providers receive only the data needed for their work. Our infrastructure uses OVH hosting, Cloudflare for network delivery and security, and Amazon Web Services for email delivery and storage. We use Plunk for newsletter subscriptions and delivery and HubSpot for contact enquiries. Providers supporting payments, accounting, scheduling or community services receive relevant information when you use those services. Professional advisers and public authorities may receive information where necessary for legal obligations or claims.

We do not sell personal data. Providers act under applicable data-processing arrangements or, for their own services, as independent controllers. Social platforms also process data under their own notices; depending on the platform feature, we and the platform may share responsibility for profile statistics. Please review the provider’s notice when interacting with its service.

International transfers

Some providers or their support teams may process information outside the European Economic Area, including in the United States. Where such a transfer occurs, we rely on an applicable adequacy decision or appropriate safeguards such as the European Commission’s standard contractual clauses, with additional measures where required. Contact us for information about the safeguards relevant to your data and how to obtain a copy.

How long we keep information

We keep information for the purpose for which it was collected and any applicable legal retention period. Enquiries and booking information are kept while we handle the request and, where needed, for the applicable period for legal claims. Subscription data is kept while the subscription is active; necessary withdrawal, suppression and consent evidence may be kept afterwards so we can respect your choice and demonstrate compliance.

Contract and accounting records are retained for the periods required by applicable tax, accounting and limitation rules. Security information is retained as needed to investigate and prevent abuse. Campaign facts and pseudonymous conversion records are retained for business analysis and relevant claims; they do not inherit the cookie’s 30-day expiry. The ledger currently has no automatic deletion after 30 days. You can ask us about the retention applicable to a particular record or request erasure or object where those rights apply. Temporary conversion device context follows the shorter period described above.

Your rights and choices

Subject to the conditions in the GDPR, you can request access to your personal data, correction, erasure, restriction of processing or portability. You may object to processing based on legitimate interests, including profiling based on those interests. You can object to direct marketing at any time. You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

You may complain to your local supervisory authority or to the Polish President of the Personal Data Protection Office (UODO), https://uodo.gov.pl/. To contact us about any of these rights, use [email protected]. We normally respond within one month; the GDPR permits an extension for complex or numerous requests, in which case we will tell you why.

Providing data is generally voluntary. Information marked as necessary is required to answer your request, deliver a subscription, arrange a service or perform a contract; without it we cannot provide that function. Statutory billing information may be required by law. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

Changes to this policy

We may update this policy when our services, processing or legal obligations change. The current version and its update date are available on this page. A material change to consent-based processing requires the appropriate consent rather than being authorised simply by an update to this document.