Privacy policy.

Who is responsible for your data

The controller of your personal data is Gustaw Gawrysiak Consulting, Konopnica 97G, 21-030 Konopnica, Tax ID (NIP) 7133143989 (“ostoio”, “we”).

For anything to do with your personal data, write to us at contact@ostoio.com.

What data we process and why

The forms on this site (the offsite brief, the contact form and the house application) only help you write a message. Nothing you type into them is sent to us through the site: it stays in your browser until you send the message yourself, by e-mail or on Instagram.

We process:

• what you send us by e-mail (contact@ostoio.com) or on Instagram (@ostoio.team): usually your name, e-mail address, company, phone number, and details of the offsite or the house. We use it to reply, to prepare an offer or to check whether a house meets our standard and, if we work together, to deliver what we agreed;
• technical data from your visit: IP address, browser and device type, date and time. It is logged automatically by the server and used to keep the site running and secure;
• what you type into the place search, or the coordinates of a point you pick on the map. It is used to find the place’s name and is not linked to who you are.

Giving us your data is voluntary, but without contact details we can’t reply.

Legal basis

• replying to your message — our legitimate interest in answering people who contact us (Art. 6(1)(f) GDPR);
• preparing an offer and entering into or performing a contract — steps taken at your request before a contract, and the contract itself (Art. 6(1)(b) GDPR);
• accounting and tax records if we work together — a legal obligation (Art. 6(1)(c) GDPR);
• server logs, site security and establishing or defending legal claims — our legitimate interest (Art. 6(1)(f) GDPR).

Who we share data with

We don’t sell your data or share it for marketing. It may reach the service providers we use:

• Vercel Inc. — website hosting (server logs);
• OpenFreeMap — the map on the site. Your browser loads the map directly, so the provider sees your IP address;
• OpenStreetMap Foundation (Nominatim) — place search. Our server sends the requests, so only the search text or coordinates reach it, never your IP address;
• OVH Sp. z o.o. (OVHcloud) — our mailbox;
• Meta Platforms Ireland Ltd. — if you write to us on Instagram; Instagram’s own privacy policy applies there too.

We may also disclose data to public authorities where the law requires it.

Transfers outside the European Economic Area

Some providers (e.g. Vercel Inc.) are based or host data outside the EEA, including in the United States. Such transfers rely on a European Commission adequacy decision (e.g. the EU-US Data Privacy Framework) or on the Commission’s standard contractual clauses. You can ask us for a copy of these safeguards.

How long we keep data

• messages that don’t lead to working together — as long as needed to handle them, then no longer than 12 months after our last contact;
• data related to a contract — for its duration, then until legal claims become time-barred;
• accounting records — for as long as Polish tax law requires (usually 5 years from the end of the year in which the tax was due);
• server logs — for a short period set by the hosting service, 30 days.

Your rights

You have the right to:

• access your data and get a copy of it;
• have your data corrected;
• have your data erased;
• restrict processing;
• data portability, for data processed under a contract;
• object to processing based on our legitimate interest.

To use any of these rights, write to contact@ostoio.com.

You can also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland), or with the authority in your own EU country.

We don’t make automated decisions about you and don’t profile visitors.

Cookies

The site uses one cookie, NEXT_LOCALE. It remembers your language so the site opens in the same language next time. It is needed for a feature you use, so it doesn’t require consent.

We use no analytics, advertising or tracking cookies. You can delete or block cookies in your browser settings at any time.

Changes to this policy

We may update this policy when the site or the law changes. The current version is always on this page, with the date of the last change under the title.