Last Updated: July 24, 2026
Privacy Policy
Last Updated: July 24, 2026
This Privacy Policy explains how we process your personal data when you visit kotrov.com, contact us, book a call, or subscribe to our newsletter. It is written to meet Regulation (EU) 2016/679 (the GDPR) and the Polish Act of 10 May 2018 on the Protection of Personal Data.
Data Controller
The controller of your personal data is:
KOTROV spółka z ograniczoną odpowiedzialnością Registered office: ul. Szlak 77/222, 31-153 Kraków, Poland KRS: 0001255148 NIP: 6762724188 REGON: 545279454 Email: hello@kotrov.com
We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. For any privacy matter, contact us at hello@kotrov.com.
What Data We Collect
Website visitors
When you browse the site, our hosting and analytics providers process technical data: IP address, browser type and version, operating system, device type, referring URL, pages viewed, and approximate location derived from your IP. Where you consent, we also process cookie and marketing-attribution identifiers (see Cookies and Tracking).
Contact form
When you submit the contact form we collect your full name, work email, message, and — if you provide them — phone number and company name. We also record your consent to this policy, the page you submitted from, and the submission timestamp. The form is protected against automated abuse by Cloudflare Turnstile, which processes limited technical signals to distinguish humans from bots.
Discovery-call booking
When you request a discovery call we collect your name, email, company, funding stage, engineering team size, and the qualification details you choose to share about your project (the metric you want to move, decision-makers, current pain, and how you heard about us).
Newsletter
When you subscribe to our weekly note we collect your email address and the fact and time of your consent.
Clients and prospects
In the course of an engagement we process business-contact and project data exchanged with your team. Client relationships are also governed by the applicable service agreement or Statement of Work.
We do not intentionally collect special categories of data (Article 9 GDPR). Please do not include health, biometric, or other sensitive information in your messages.
Purposes and Legal Bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Respond to enquiries and take steps at your request before entering a contract | Contact and booking form data | Art. 6(1)(b) — pre-contractual steps; Art. 6(1)(f) — our legitimate interest in answering enquiries |
| Provide and administer our services | Client and project data | Art. 6(1)(b) — performance of a contract |
| Send the newsletter | Email address | Art. 6(1)(a) — consent |
| Analytics, marketing attribution, and advertising | Cookie and tracking identifiers | Art. 6(1)(a) — consent (via the cookie banner) |
| Measure and secure the website (bot protection, performance) | Technical and log data | Art. 6(1)(f) — legitimate interest in a secure, functioning site |
| Comply with accounting, tax, and other legal duties | Billing and contract records | Art. 6(1)(c) — legal obligation |
| Establish, exercise, or defend legal claims | Relevant records | Art. 6(1)(f) — legitimate interest |
Where we rely on legitimate interest, we have weighed it against your rights and freedoms. You may object at any time (see Your Rights).
Cookies and Tracking
We use cookies and similar technologies. Cookies that are not strictly necessary — analytics and advertising — are set only after you consent through the cookie banner, and you can withdraw consent at any time by changing your cookie settings or clearing cookies in your browser.
| Provider / cookie | Type | Purpose | Retention |
|---|---|---|---|
tracking (first-party) | Marketing | Stores UTM parameters and ad-click IDs (gclid, fbclid, msclkid, ttclid) to attribute enquiries | 30 days |
Google Tag Manager (GTM-532DP465) | Marketing | Loads and manages the tags below | Session |
Meta Pixel (_fbp, _fbc) | Marketing | Measures ad performance and audience attribution for Meta (Facebook/Instagram) | Up to 90 days |
| Vercel Web Analytics | Analytics | Aggregated, cookieless traffic measurement | No cookie stored |
| Vercel Speed Insights | Analytics | Anonymous page-performance metrics | No cookie stored |
| Cloudflare Turnstile | Necessary | Bot protection on the contact form | Session |
Some third-party tags (Google, Meta) may set additional cookies on their own domains once loaded; those are governed by the respective provider’s policy. Vercel’s analytics products are cookieless and do not track you across sites.
Recipients and Processors
We do not sell, rent, or trade your personal data. We share it only with service providers acting as our processors under written agreements, and only as needed to run the site and our business:
- Vercel Inc. (USA) — website hosting, Web Analytics, and Speed Insights
- Cloudflare, Inc. (USA) — Turnstile bot protection on the contact form
- Google Ireland Ltd. / Google LLC — Google Tag Manager and related advertising tags
- Meta Platforms Ireland Ltd. — Meta Pixel advertising measurement
- our email and productivity provider, used to receive and answer your messages
We may also disclose data to public authorities where required by law, and to professional advisers (for example, legal or accounting) under confidentiality obligations. If we are ever involved in a merger, acquisition, or sale of assets, your data may transfer to the successor entity, subject to this policy.
International Data Transfers
Some processors listed above are established in, or transfer data to, countries outside the European Economic Area — primarily the United States. For those transfers we rely on the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU–U.S. Data Privacy Framework. You may request a copy of the relevant safeguards by emailing hello@kotrov.com.
Retention
We keep personal data only as long as necessary for the purpose it was collected for:
- Enquiry and booking data that does not lead to an engagement — up to 12 months, then deleted.
- Client and contract data — for the duration of the engagement.
- Accounting and tax records (including invoices) — 5 years from the end of the relevant tax year, as required by Polish tax and accounting law.
- Newsletter data — until you unsubscribe or withdraw consent.
- Cookie and tracking data — for the retention periods stated in the table above.
Where data is retained for the defence of legal claims, we keep it until the applicable limitation periods expire.
Your Rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and obtain a copy
- Rectify inaccurate or incomplete data
- Erase your data (“right to be forgotten”) where the conditions are met
- Restrict processing in certain circumstances
- Data portability — receive your data in a structured, machine-readable format
- Object to processing based on legitimate interest, and to direct marketing at any time
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
To exercise any of these rights, email hello@kotrov.com. We will respond within one month, as required by Article 12 GDPR.
You also have the right to lodge a complaint with the Polish supervisory authority:
President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) ul. Stawki 2, 00-193 Warsaw, Poland uodo.gov.pl
Automated Decision-Making
We do not make decisions producing legal or similarly significant effects about you based solely on automated processing, and we do not carry out profiling of that kind.
Data Security
We apply appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or loss — including encryption in transit (HTTPS), access controls, and vetted processors. No transmission over the internet is completely secure, and we cannot guarantee absolute security.
Third-Party Links
Our site may link to third-party websites. We are not responsible for their content or privacy practices; review their policies before providing any data.
Children
Our services and website are directed to businesses and are not intended for anyone under 16. We do not knowingly collect personal data from children.
Changes to This Policy
We may update this policy from time to time. The “Last Updated” date at the top shows when it last changed. Material changes will be reflected here; where required, we will seek fresh consent.
Contact
For any question about this policy or your personal data:
KOTROV sp. z o.o. ul. Szlak 77/222, 31-153 Kraków, Poland Email: hello@kotrov.com