1. Controller and contact
The original site publishes Sapphire Project Sp. z o.o., Rynek 60 / 2, 50-116 Wrocław, Poland; KRS 0000983551, NIP 8952244618, REGON 522634812; info@sp-sapphireproject.com. These are site-published disclosures, not an independent register check. The company must confirm its controller details and whether this general email handles privacy requests before adopting the notice. Do not send identity documents through the Contact us form.
2. Information collected
The contact form stores your name, email address, optional phone number and message in Lovable Cloud. Hosting providers may also process technical request data, such as IP addresses and security logs. The precise production logging settings and provider agreements require verification. This copy does not collect payment-card details or identity documents.
3. Purposes and legal bases
Responding to a request for a quote or a service may rely on steps taken at your request before a contract under GDPR Article 6(1)(b). Other correspondence and proportionate security measures may rely on legitimate interests under Article 6(1)(f), subject to an assessment. Statutory accounting duties may rely on Article 6(1)(c). Marketing requiring consent must not begin without a separate valid opt-in. The final notice must map each actual purpose to its legal basis.
4. Recipients and international transfers
Contact submissions are handled through Lovable Cloud. The company must verify which staff, hosting providers and contracted processors can access them. Any disclosure must have an appropriate purpose and legal basis. Before transfers outside the EEA, verify the destination, adequacy decision or appropriate safeguards, such as standard contractual clauses, and describe them in the final notice. No particular hosting location or transfer safeguard is asserted here.
5. Retention and security
The company must adopt and document retention periods for enquiries, contracts, accounting records and security logs. No automatic deletion schedule has been confirmed in this copy. Keep data only as long as justified by the relevant purpose and legal obligations. Access controls, incident handling, backups and deletion procedures must be checked in practice; this draft is not evidence that they are implemented.
6. Your rights
Subject to the GDPR conditions, you may request access, correction, erasure, restriction, portability and object to processing based on legitimate interests. Consent can be withdrawn without affecting earlier lawful processing. You may complain to the Polish supervisory authority, the President of UODO. Requests normally require a response within one month, with extensions only where the GDPR permits them. Necessary identity verification should be proportionate.
7. Optional data and automated decisions
You choose whether to submit an enquiry; name, email and message are needed to use this form, while phone is optional. No automated decision producing legal or similarly significant effects is implemented by the contact form. Any later analytics, marketing, profiling or AI processing of contact data requires a fresh assessment and an updated notice.