Back to the home page

Privacy policy

Last updated: 25 September 2026

1. Data controller

The controller of personal data processed in connection with the use of this website is GP ENGINEERING SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, tax ID (NIP): 6211856675, KRS: 0001262659, registered at ul. Piłsudskiego 6, 63-700 Krotoszyn, Poland. Contact for data protection matters: kontakt@gp-engineering.pl.

2. What data we process and why

Contact form. When you send an enquiry through the form on our website, we process the data you provide (name, email address, optionally a phone number, and the content of your message) solely to reply to you and, where relevant, to prepare a proposal. The enquiry is delivered to our company mailbox and, as an enquiry card, to our Trello board, where we manage enquiries and booked calls (the form data, the topics you selected, your preferred contact method and the call time). It does not go into any marketing system. Legal basis: Art. 6(1)(b) GDPR (steps taken prior to entering into a contract) and Art. 6(1)(a) GDPR (your consent, given by ticking the box in the form).

Email: Zoho Mail. Our company email is provided by Zoho Corporation. This means that a message sent through the form or by email is stored on Zoho's servers, with Zoho acting as a processor on our behalf. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in conducting business correspondence).

Handling enquiries: Trello. We manage enquiries from the form in Trello, a service of Trello, Inc. (Atlassian group, United States), which processes the data on our behalf as a processor. The form reads booked times from the same board so it doesn't offer a slot that is already taken; only dates and times reach your browser, never anyone else's details. Data may be processed on servers in the United States; the transfer is based on the Standard Contractual Clauses approved by the European Commission and the EU-U.S. Data Privacy Framework. Legal basis: Art. 6(1)(b) GDPR (steps taken prior to entering into a contract) and Art. 6(1)(f) GDPR (our legitimate interest in handling enquiries and call bookings efficiently).

Email and telephone correspondence. When you contact us by email or phone, we process the data you provide (e.g. name, email address, phone number, content of your message) solely to reply to you and, where relevant, to prepare a proposal. Legal basis: Art. 6(1)(b) GDPR (steps taken prior to entering into a contract) or Art. 6(1)(f) GDPR (our legitimate interest in conducting business correspondence).

Website traffic analysis: Vercel Web Analytics. We use Vercel Web Analytics, a tool that does not use cookies and does not create identifiers that would allow a specific user to be tracked between visits. Only aggregated data is collected (e.g. number of page views, approximate country, device type). It is always active, regardless of your cookie consent. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in analysing and improving the quality of the website).

Website traffic analysis: Google Analytics. We use Google Analytics (Google Ireland Limited) in Google Consent Mode. Before you make a choice in the cookie banner, Google Analytics runs in a restricted mode: it does not set cookies or create an identifier that would allow you to be recognised as a specific user, and Google receives only an anonymised, aggregated signal that cannot be linked to you. Only when you click "Accept" does Google Analytics start setting cookies in your browser (including _ga and _ga_*) that allow a returning user to be recognised and make it possible to analyse how you move through the site, where traffic comes from and visit statistics. Data may be processed on Google servers outside the European Economic Area; Google provides appropriate safeguards in the form of the EU Standard Contractual Clauses. Legal basis for setting cookies: Art. 6(1)(a) GDPR (your consent). You can withdraw your consent at any time by deleting cookies in your browser settings and reloading the page to see the banner again.

Advertising and measurement: Google Ads. We use Google Ads (Google Ireland Limited) in Google Consent Mode to measure the effectiveness of our ads (conversion tracking, e.g. clicks on our email address or phone number) and for remarketing. Before you click "Accept", Google Ads runs in a restricted mode: it does not set cookies or identifiers, and Google receives only an anonymised, aggregated signal. Only after you give consent does Google Ads set cookies in your browser (including _gcl_au) and may use the ad_storage, ad_user_data and ad_personalization signals to attribute conversions and build remarketing lists. Data may be processed on Google servers outside the European Economic Area; Google provides appropriate safeguards in the form of the EU Standard Contractual Clauses. Legal basis: Art. 6(1)(a) GDPR (your consent). You can withdraw your consent in the same way as for Google Analytics.

Website chat. The website has a chat window where you can ask a question and receive a reply from our assistant. We process the content of the messages you send in the chat and any personal data you include in them (e.g. name, email address, company name) solely to reply to you and handle your enquiry. Please do not share sensitive data or confidential information in the chat. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and Art. 6(1)(f) GDPR (our legitimate interest in handling enquiries submitted through the website).

The chat runs on the n8n automation platform, provided by n8n GmbH, based in Germany, and replies are generated by an OpenAI language model, provided by OpenAI, L.L.C., based in the United States. For this purpose the content of the messages you type in the chat is transferred to these companies, which process it on our behalf as processors. Data may be processed on servers in the United States; such transfers are based on the Standard Contractual Clauses approved by the European Commission. Under OpenAI's terms, data sent through the API is not used to train models, and its retention for abuse monitoring is time-limited (as a rule, up to 30 days), after which it is deleted.

The chat window stores a random session identifier in your browser's local storage (localStorage) so that consecutive messages are linked to a single conversation. It is not a cookie, it is not sent to our servers and it is not used for tracking or profiling. You can remove it by clearing this site's data in your browser settings.

3. How long we keep data

We keep correspondence data for as long as necessary to reply to you and, if we start working together, for the duration of our cooperation and for the period required by law (e.g. tax law). We keep enquiry cards in Trello for the same period. We keep the content of chat conversations for as long as necessary to handle your enquiry and any follow-up correspondence; execution logs on the n8n platform are kept temporarily, in line with that service's configuration, and data held by OpenAI is deleted after 30 days at the latest. Aggregated data from Vercel Web Analytics is kept for the period set by that tool's configuration. Google Analytics cookies are kept for up to 14 months, and Google Ads cookies (_gcl_au) for up to 90 days from the last activity, in line with Google's default configuration.

4. Recipients of data

The website is hosted by Vercel Inc., which acts as a processor in this respect. If you consent to analytics and advertising cookies, data about your use of the website is also processed by Google Ireland Limited (Google Analytics and Google Ads). The website chat is provided by n8n GmbH (automation platform, Germany) and OpenAI, L.L.C. (language model generating replies, United States), acting as processors; in this respect data may be transferred to the United States on the basis of the Standard Contractual Clauses. Enquiries sent through the form also go to Trello, Inc. (Atlassian group, United States), acting as a processor; in this respect data may be transferred to the United States on the basis of the Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. Data sent by email goes only to the controller's mailbox. We do not sell personal data or share it with third parties for marketing purposes.

5. Your rights

In connection with the processing of your personal data, you have the right to:

6. Cookies

On its own, the website sets only one cookie, gp-lang, and only when you manually choose a language version in the PL / EN / DE switcher. It stores nothing but the language you chose, so that next time you open the home page you are not redirected to a different version. It is strictly necessary for a feature you yourself request, so it does not require consent; it expires after 12 months. When you open the home page without this cookie, we choose the language version based on the country that Vercel's server determines from your IP address; the country is not stored anywhere. Any other cookies come from Google Analytics and Google Ads, and only if you click "Accept" in the banner shown on your first visit. Until you do (or if you click "Reject"), Google's tools run in the restricted mode described above, without setting cookies and without identifying you as a specific user.

You can change your decision at any time by deleting this site's cookies in your browser settings; the consent banner will appear again on your next visit.

Separately from cookies, the chat window stores a random conversation session identifier in your browser's local storage (localStorage), as described in section 2. It is not a cookie, it is not sent to our servers and you can remove it at any time by clearing this site's data in your browser.

7. Changes to this privacy policy

We may update this policy from time to time. We will announce any significant changes by publishing the new version on this page together with the date of the update.