Privacy Policy
Effective from 16 October 2026. This policy explains how we process personal data on aqrat.eu, in correspondence and when we carry out orders, and what the website stores in and reads from your browser (cookies and similar technologies).
1. Who is the controller
The controller of your personal data is AQRAT Maja Sakowska, a sole proprietorship registered in the Polish business register (CEIDG), ul. Gorlicka 40, 51-314 Wrocław, Poland, VAT ID PL8991596936, REGON 932172700 (“AQRAT”, “we”). For anything related to your data, write to info@aqrat.eu, call +48 512 482 372 or send a letter to our registered address.
2. What data we process and where it comes from
- Data you give us in the quote form: the product you need, approximate quantity, delivery country, job details, a link to your artwork, company name, your name, work e-mail and phone number, your consent, and the address of the page you sent the form from.
- Data you give us by e-mail or phone, and when you place an order: invoice and delivery details.
- Contact details of our customers’ and suppliers’ staff: name, work e-mail, phone, position. We receive them from you or from the company you represent.
- Device data: IP address, browser and device type, pages visited, how you reached the site (for example by clicking an ad) and identifiers stored in your browser, collected by the tools described in section 7.
- Personal data contained in print files (for example on business cards): we process them on behalf of the customer, who is their controller, to carry out the order, and keep them after the job for reprints and complaints.
3. Purposes, legal bases and how long we keep data
| Purpose | Legal basis | How long |
|---|---|---|
| Replying to your enquiry, preparing a quote, correspondence | Art. 6(1)(b) GDPR: steps taken at your request before entering into a contract; if you act for a company, Art. 6(1)(f) GDPR: our legitimate interest in contacting customers | Until the correspondence ends, then 3 years from the last contact, for further enquiries and possible claims (Art. 6(1)(f) GDPR; this is the limitation period for business claims under Art. 118 of the Polish Civil Code), unless you object earlier. Entries from the quote form are also stored in the website database for the same period. |
| Concluding and performing a contract, delivery, complaints | Art. 6(1)(b) GDPR; contact persons: Art. 6(1)(f) GDPR (our legitimate interest in concluding and performing the contract with the company you represent) | For the duration of the contract, then until claims under it become time-barred (usually 2 or 3 years) |
| Archive of print files and order data for reprints and complaints | Art. 6(1)(f) GDPR: our legitimate interest in reprinting an order and handling complaints | No longer than 3 years from the last order, unless you ask us to delete it earlier or object |
| Invoices, accounting, taxes | Art. 6(1)(c) GDPR together with tax law | Until the tax liability becomes time-barred, as a rule 5 years from the end of the calendar year in which the tax was due (Polish Tax Ordinance, Art. 70 and 86; VAT Act, Art. 112) |
| Establishing, pursuing and defending claims | Art. 6(1)(f) GDPR | Until claims become time-barred and, in case of a dispute, until it ends |
| Visit statistics (Google Analytics) | Art. 6(1)(a) GDPR: consent given in the cookie banner | Until you withdraw consent; Google Analytics keeps user-level data for 14 months from the last activity |
| Ad performance measurement and remarketing (Google Ads) | Art. 6(1)(a) GDPR: consent given in the cookie banner | Until you withdraw consent; cookie lifetimes in section 7 |
| Limited cookieless signals to Google when you do not consent (section 7) | Art. 6(1)(f) GDPR: our legitimate interest in estimating traffic and ad performance | According to Google’s rules, without cookie identifiers |
| Protecting the form against spam (Cloudflare Turnstile) | Art. 6(1)(f) GDPR: our legitimate interest in protecting the website | We do not store this data; Cloudflare processes it for the check |
| Map on the contact page (Google Maps) | Art. 6(1)(f) GDPR: our legitimate interest in showing how to find us | We do not store this data; Google receives your IP address and browser data |
4. Who receives your data
- Service providers who process data on our behalf: website and e-mail hosting (servers in Germany), invoicing and quoting system, IT support, accounting and legal services, the Stape tag server (Stape Europe OÜ, Estonia; server in Poland), the CookieYes consent tool (CookieYes Limited, United Kingdom).
- Google Ireland Limited, for the tools described in section 7. For some of them Google acts as a separate controller under its own rules: policies.google.com/privacy and business.safety.google/privacy.
- Cloudflare, Inc. (USA), for the Turnstile spam check on the quote form.
- Carriers and courier companies, to the extent needed for delivery.
- Banks, for payments, and public authorities where the law requires it.
5. Transfers outside the European Economic Area
Data from Google tools may be transferred to Google LLC in the USA, and data from the Turnstile check to Cloudflare, Inc. in the USA. Both companies participate in the EU-US Data Privacy Framework, and the transfer is based on Commission Implementing Decision (EU) 2023/1795 on the adequate level of protection. CookieYes Limited is based in the United Kingdom, for which the European Commission has found an adequate level of data protection. You can ask for information about these safeguards at info@aqrat.eu.
6. Your rights
You have the right to access your data, have it corrected or deleted, restrict its processing and receive it in a portable format (where we process it on the basis of consent or a contract). You may object at any time to processing based on our legitimate interest (Art. 21 GDPR), and to direct marketing without giving a reason. You may withdraw consent at any time; this does not affect processing before the withdrawal. To use your rights, write to info@aqrat.eu. You also have the right to lodge a complaint with a supervisory authority: in Poland the President of the Personal Data Protection Office (ul. Stanisława Moniuszki 1A, 00-014 Warsaw, uodo.gov.pl), or the authority in the EU country where you live or work.
7. Cookies and similar technologies
Cookies are small text files saved by your browser. Browser storage (localStorage) works in a similar way. Information that is necessary to run the website you are using is stored and read without consent. For everything else we ask for consent in the banner shown on your first visit. The table shows when each tool works; tools that work regardless of your banner choice are marked “always”.
Until you make a choice in the banner, analytics and advertising tools run in “denied” mode. You can change your choice at any time with the cookie settings icon in the bottom left corner of the page. You can also block or delete cookies and site data in your browser settings; blocking necessary ones may stop the quote form from working.
| Tool (provider) | Purpose | What it stores in your browser | When it works |
|---|---|---|---|
| CookieYes consent banner (CookieYes Limited) | remembering and documenting your choice | cookie cookieyes-consent, 1 year; record of your choice in the CookieYes consent log | always, necessary |
| Cloudflare Turnstile (Cloudflare, Inc.) | telling people from bots on the quote form | nothing is stored by us; Cloudflare receives your IP address and browser data | always, necessary (on pages with the form) |
| Google Tag Manager (Google) | runs the tools in this table and tells events apart | browser storage gtmBrowserId, a random browser number, until you clear site data | always |
| Google Analytics 4 (Google), via our Stape tag server in Poland | visit statistics | cookies _ga and _ga_*, up to 2 years | after consent |
| Google Ads conversion measurement (Google) | checking whether an ad led to an enquiry or a call | cookies _gcl_au and _gcl_aw, up to 90 days; browser storage _gcl_ls, which may also be saved before consent | after consent |
| Google Ads remarketing (Google) | showing AQRAT ads to past visitors on other websites and Google services | Google cookies, according to Google’s rules | after consent |
| Google Ads phone number replacement (Google) | if you arrive from an ad, the phone number on the page may be replaced with a Google forwarding number to measure calls from ads; Google receives call data such as time and duration | browser storage: the company number and the expiry of the replacement | always |
| “gclid” script (AQRAT) | linking an enquiry to a Google ad click | browser storage gclid, 90 days, only after consent | after consent |
| Google Maps (Google) | map on the contact page | nothing is stored by us; Google receives your IP address and browser data | on the contact page |
If you do not consent, Google tools do not store analytics or advertising cookies, but they send limited signals to Google without cookie identifiers (for example about a page view), which Google uses to estimate statistics and ad performance. If you arrive from an ad, the click identifier may be carried in the addresses of the site’s pages instead of in cookies. We do not send the contents of the quote form to Google.
8. Do you have to give us your data
Giving data is voluntary. Without an e-mail address we cannot reply to your enquiry, and without invoice and delivery details we cannot conclude and perform a contract.
9. Profiling
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. With your consent, Google advertising tools may build profiles used to tailor ads.
10. Changes to this policy
We update this policy when the tools on the website, the way we process data or the law change. The current version is on this page, with its effective date at the top.