Ask about setupContact

Privacy policy

Effective from: 2026-10-14

Data controller

The controller of personal data is CodeTheWeb, running a business under the name CodeTheWeb, address: ul. Przykładowa 1, 00-000 Miasto, Polska, Polish tax ID (NIP): 9491562544 (the “Controller”). Contact for data protection matters: kontakt@codetheweb.pl or the contact form on codetheweb.dev.

What data we process, why and on what basis

  • Contact form: name and company, e-mail address, store address and the message — to reply to your enquiry (Art. 6(1)(f) GDPR, the Controller’s legitimate interest; where the enquiry concerns entering into a contract — Art. 6(1)(b) GDPR).
  • Orders: name or company name, address, e-mail address, Polish NIP or EU VAT number, licence Domain, amounts and payment status — to conclude and perform the contract (Art. 6(1)(b) GDPR), to issue invoices and keep accounting records (Art. 6(1)(c) GDPR) and to establish or defend any claims (Art. 6(1)(f) GDPR).
  • Licences: licence key, e-mail address, the store domain given at purchase or in “My licenses”, and download history — to perform the licence contract and provide updates (Art. 6(1)(b) GDPR) and to prevent unauthorised use (Art. 6(1)(f) GDPR). The modules do not send us any data from your store. We keep them for the duration of the licence and the limitation period for claims.
  • Google Analytics statistics: data on how the website is used, collected with cookies — only after you give consent in the banner (Art. 6(1)(a) GDPR). You can withdraw consent at any time using the “Cookie settings” link in the footer.
  • Website security: a hash of your IP address used to limit the number of requests to the form and to payments (Art. 6(1)(f) GDPR).

Payments

Payments are processed by Stripe Payments Europe, Ltd. (Ireland). You enter card and other payment details directly with Stripe; the Controller neither receives nor stores them. Stripe also processes data as an independent controller under its own privacy policy available at stripe.com.

Recipients of data

  • website hosting provider: Homecloud;
  • e-mail provider: home.pl S.A.;
  • Stripe Payments Europe, Ltd. — payment and tax processing;
  • Google Ireland Limited — Google Analytics, only with your consent;
  • public authorities, where required by law.

Transfers outside the EEA

Stripe and Google may transfer data to the United States. Such transfers are based on the European Commission’s adequacy decision for the EU–US Data Privacy Framework or on standard contractual clauses.

How long we keep data

  • contact form enquiries — until we reply, and then for the limitation period of any claims, no longer than 3 years;
  • order data and invoices — for 5 years from the end of the tax year in which the tax payment deadline fell, as required by tax law;
  • Google Analytics data — according to the retention setting in Google Analytics, no longer than 14 months;
  • IP address hashes used to limit requests — for a few minutes, until the next request removes entries older than the limit window.

Cookies and browser storage

  • essential: remembering the light or dark theme, the selected currency and your cookie choice (browser localStorage); in the admin panel — a login session cookie;
  • analytics, only with consent: Google Analytics cookies (_ga, _ga_*), kept for up to 2 years.

You can change your cookie choice using the link in the footer or in your browser settings.

Your rights

You have the right to access your data, rectify it, have it erased, restrict its processing, data portability, to object to processing based on legitimate interest and to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the supervisory authority of your country of residence.

Whether you must provide data

Providing data in the contact form is voluntary but necessary for us to reply. Providing data when ordering is a condition for concluding the contract and issuing an invoice.

Automated decisions

The Controller does not make decisions about you based solely on automated processing, including profiling.