Privacy policy

1. Data controller

  1. The controller of personal data is Oleksii Smirnov (RedCachalot Digital Studio), based in Krakow, Poland, Tax ID (NIP): 9452293436 (the “Controller”, “we”).
  2. Contact: e-mail redcachalot@gmail.com, phone +48 452 946 539, or in writing to the registered address.
  3. Pursuant to Article 37 of the GDPR, the Controller has not appointed a Data Protection Officer.
  4. This Privacy Policy forms an integral part of the Terms of Service of redcachalot.com. It sets out the rules for processing personal data and using cookies.
  5. We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and the Polish Act of 10 May 2018 on the Protection of Personal Data.

2. Purposes, legal bases and retention periods

We process your personal data for the following purposes:

  1. Responding to an enquiry sent via the contact form or quote form (brief) — basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract) and Art. 6(1)(f) GDPR (legitimate interest — handling correspondence). Retention: for the duration of the correspondence and then until the limitation periods for potential claims expire.
  2. Conclusion and performance of a service agreement — basis: Art. 6(1)(b) GDPR. Retention: for the duration of the agreement and then until the limitation periods for contractual claims expire (as a rule, no longer than 6 years).
  3. Compliance with tax and accounting obligations — basis: Art. 6(1)(c) GDPR. Retention: 5 years from the end of the calendar year in which the tax obligation arose.
  4. Newsletter delivery — basis: Art. 6(1)(a) GDPR (consent). Retention: until consent is withdrawn (an unsubscribe link is included in every message).
  5. Website traffic analytics and statistics (Google Analytics 4) — basis: Art. 6(1)(a) GDPR (consent given via the cookie banner). Retention: until consent is withdrawn; data in Google Analytics is stored for a maximum of 14 months.
  6. Own marketing and running social media profiles — basis: Art. 6(1)(f) GDPR (legitimate interest).

Providing data is voluntary but necessary to fulfil the above purposes (e.g. replying to an enquiry or concluding a contract).

3. Scope of data collected

  1. Data provided voluntarily in forms: full name, e-mail address, phone number, message content and any other data you choose to share with us.
  2. Data collected automatically — only after consent to the relevant cookie categories: IP address, browser and device information, approximate location, visit statistics.

4. Data recipients

Your data may be accessed only by entities supporting the operation of the Website:

    • hosting and e-mail provider — for data storage on servers;
    • Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) — Google Analytics 4 and Google Site Kit; data may be transferred to Google LLC in the USA under the European Commission’s adequacy decision on the EU–U.S. Data Privacy Framework;
    • CookieYes Limited — cookie consent management tool (consent records);
    • newsletter service provider — for handling mailings;
    • accounting office — with regard to accounting documents;
    • public authorities — solely on the basis of applicable law.

5. Transfers outside the EEA

Data may be transferred outside the European Economic Area only to entities ensuring an adequate level of protection, in particular under European Commission adequacy decisions (EU–U.S. Data Privacy Framework) or standard contractual clauses (SCC).

6. Your rights

You have the right to:

  1. access your data and obtain a copy of it (Art. 15 GDPR);
  2. rectify inaccurate or incomplete data (Art. 16 GDPR);
  3. erasure — the “right to be forgotten” (Art. 17 GDPR);
  4. restriction of processing (Art. 18 GDPR);
  5. data portability (Art. 20 GDPR);
  6. object to processing (Art. 21 GDPR);
  7. withdraw consent at any time — without affecting the lawfulness of processing carried out before withdrawal;
  8. lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

To exercise your rights, contact us at: redcachalot@gmail.com. We respond without undue delay, at the latest within one month.

7. Cookies

  1. The Website uses cookies — small text files stored on the user’s device, used for the proper functioning of the site, remembering preferences and (subject to consent) analytics.
  2. Consent management. On your first visit, a consent banner (CookieYes) is displayed, where you can: accept all cookies, reject all except essential ones, or customise your choice by category. You can change or withdraw your consent at any time by clicking the “Manage consent” icon/button available on the site.
  3. Cookie categories used:
    • Essential — required for the site to function (always active; including remembering your consent choice — cky-consent files, valid for 12 months);
    • Functional — remember selected settings (e.g. language version);
    • Analytics / performance — Google Analytics 4 (_ga, ga* files, valid for up to 13 months) — visit statistics; activated only after consent;
    • Advertising — delivering content tailored to interests (currently not actively used).
  4. You can also control cookies in your browser settings (Chrome, Firefox, Edge, Safari, Opera), including blocking or deleting them. Restricting essential cookies may affect the operation of the Website.

8. Google Analytics 4

  1. The Website uses Google Analytics 4 (measurement ID G-DSCKNGG9ZB) provided by Google Ireland Limited.
  2. The tool is activated only after consent to analytics cookies (Consent Mode v2). The data collected is statistical and aggregated; full IP addresses are not stored.
  3. You can additionally block Google Analytics by installing the browser add-on: https://tools.google.com/dlpage/gaoptout.

9. Social media

  1. The Website contains links to our profiles: Facebook, Instagram, YouTube and LinkedIn. Once you visit those platforms, data is processed in accordance with the privacy policies of their operators (Meta Platforms Ireland Ltd., Google Ireland Ltd., LinkedIn Ireland Unlimited Company).
  2. If you are logged in to your account on a given platform while visiting our Website, its operator may link your visit to your account. To avoid this, log out before browsing the Website.

10. Security

We apply technical and organisational measures appropriate to the risk, including encrypted connections (SSL/TLS), restricted access to data and regular software updates.

11. Changes to this Privacy Policy

This Policy may be updated in the event of changes in the law or the tools we use. The current version is always available on the Website together with the date of the last update.

Last updated: 10 June 2026