Privacy notice

1. Who the controller is

The controller of your personal data is Castomo prosta spółka akcyjna, ul. Powstańców Śląskich 5/212, 53-332 Wrocław, Poland, registered in the Polish National Court Register under number 0001188843, VAT ID PL8993033031.

Write to hello@castomo.com about anything to do with your data. We have not appointed a data protection officer — we are not required to — so the same person who reads the briefs answers these emails.

2. What we collect

Only what you type, plus what any web server records while answering a request. We do not buy data, we do not enrich it from third parties and we do not build a profile of you.

• Brief form: email address (required), name, website address, the plugin kinds you tick, your description of the job, preferred timing, the language you are reading in, the page the form was sent from, and the time it was sent.
• Call booking: name, email address, an optional note and the slot you pick.
• Payment: name and email on the payment summary. We never see card details — you enter those on Stripe's own page.
• Server logs: IP address, browser type, the address requested and the response time, recorded by the hosting company as they are for any site on the internet.
• Browser storage: two localStorage entries — your chosen theme (light or dark) and the fact that you dismissed the other-language banner. They stay on your device and never reach us.

3. Why, and on what legal basis

The bases are those of Article 6(1) GDPR.

• Answering your enquiry, quoting and building the plugin — Article 6(1)(b): steps taken at your request before a contract, and performance of it.
• The consent tick box under the form — Article 6(1)(a). You may withdraw consent at any time by writing to hello@castomo.com; withdrawal does not affect what was lawfully done beforehand.
• Booking and remembering a call — Article 6(1)(b).
• Invoices and accounts — Article 6(1)(c): tax and accounting obligations.
• Site security, abuse prevention and defending claims — Article 6(1)(f), our legitimate interest.

4. Who else sees it

We do not sell data and we do not share it for marketing. It reaches only the providers without which the site and the service would not run, and only as far as they need it.

Every server this site and our services run on is inside the European Economic Area — Poland and the Netherlands, as at the date of this notice. Stripe is the exception: as a global payment provider it may transfer data outside the EEA under the European Commission's standard contractual clauses.

• Website hosting: SeoHost, servers in Poland.
• Our own castomAPI infrastructure (the form, the calendar, our side of payments): servers in Poland and the Netherlands.
• Email that carries your enquiry to us: our own mailboxes on servers in Poland.
• Card and BLIK payments: Stripe Payments Europe, Ltd., Ireland.
• Our advisers and accountants, for accounting documents only.

5. How long we keep it

• An enquiry that did not lead to work: 24 months from the last contact.
• Records of work delivered: for the term of the contract and 3 years after it, the limitation period for claims.
• Invoices and accounting records: 5 years from the end of the year the tax fell due — the law requires this.
• Call bookings: 12 months after the meeting.
• Server logs: per the hosting company's policy, typically around a year.

6. Your rights

You have the right of access to your data, and to rectification, erasure, restriction, portability, and objection to processing based on our legitimate interest. Where the basis is consent, you may withdraw it at any time.

One email to hello@castomo.com exercises any of them — there is no form to fill in. We respond within a month at the latest.

You may also lodge a complaint with the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, or with the authority of your own country of residence.

7. Do you have to give it

Providing data is voluntary, but the email address and the description of the job are what a quote is made from — without them there is no way to answer you. Every other field can be left empty.

8. What we do not do

• No analytics: no Google Analytics, no visitor counter of any kind.
• No tracking or advertising cookies. The site sets no cookie at all.
• No third-party fonts, scripts or CDN — everything is served from our own server.
• No profiling and no automated decision-making.
• No newsletter, and nobody is added to any list.

9. Changes to this notice

If we change how we handle data, we change this document and the date at the top of it. We do not apply changes backwards: what we already hold is handled under the rules that applied when we collected it.