Privacy Policy

Last updated: 20 October 2026

Who processes your data

The data controller is FrameFlow - Przemysław Kudaka, Szczecin, Poland. For anything to do with your personal data, write to hello@fflow.pl.

What data I collect

Contact form and brief. I store what you enter: your name, email address, company name, budget, message and answers to the brief questions. I also store your IP address and approximate country to filter out spam.

Visit source. When a form is sent, I also store where the visit came from: the referring page and the campaign parameters in the address (UTM). This works without cookies.

Site statistics (Google Analytics). It runs only after you consent to analytics cookies. Google then collects information about the pages viewed, visit length, device, browser and approximate location.

Call booking. If you book a call through the calendar link, you provide your first and last name, email address and, if you choose, your phone number and answers to the questions in the booking form. I use your phone number only for that call, if you prefer to talk by phone. Bookings are handled by Google Calendar, and you receive a Google Meet link for the call.

Meta Pixel. It runs only after you consent to marketing cookies. Meta then receives information about the visit together with your IP address, browser data and an identifier stored in a cookie. This shows me whether Facebook and Instagram ads bring people to the site, and lets me show ads to people who have already visited it. The Pixel does not read what you type into forms.

Filling in the form is voluntary, but without an email address I can't reply.

Purposes and legal bases

• Replying to your enquiry, holding a call booked through the calendar and preparing a quote: Article 6(1)(b) GDPR (steps taken before entering into a contract).
• IP address from the form and visit source: Article 6(1)(f) GDPR, my legitimate interest in protecting the site from spam and knowing where enquiries come from.
• Google Analytics and Meta Pixel: Article 6(1)(a) GDPR, your consent given in the cookie banner.
• Invoicing a signed contract: Article 6(1)(c) GDPR (tax law obligations).

For the Meta Pixel, I am a joint controller with Meta Platforms Ireland Limited, but only for collecting data on this site and transmitting it to Meta. The terms are set out in Meta's Controller Addendum. Meta is responsible for any further processing under its own privacy policy.

How long I keep data

• Closed form enquiries are anonymised after 24 months.
• If we sign a contract, the data needed to invoice it is kept for 5 years from the end of the year in which the tax payment was due.
• Google Analytics data is deleted after 14 months.
• The Meta Pixel cookie expires after 90 days. Meta's own retention is set out in Meta's privacy policy.

Who receives the data

• MyDevil, my hosting and email provider, whose server runs the site and the enquiry database;
• Make.com and Notion, which pass enquiries to my task list;
• Google Ireland Limited, if you book a call through the calendar or consent to analytics cookies;
• Meta Platforms Ireland Limited, if you consent to marketing cookies.

Make.com, Notion, Google and Meta may process data outside the European Economic Area, mainly in the USA. In that case they rely on GDPR transfer mechanisms: the EU-US Data Privacy Framework or standard contractual clauses.

I do not make any decisions based solely on automated processing that would have legal effects on you.

Cookies

Without your consent, the site uses only strictly necessary cookies: csrftoken, which protects the forms, and a cookie that remembers your choice in the banner. Google Analytics starts after you consent to analytics cookies, and the Meta Pixel after you consent to marketing cookies. The full list of tools and cookies is in the table below. You can change or withdraw your consent at any time with the "Cookie settings" link in the footer.

Your rights

You have the right to access your data, have it corrected or deleted, restrict its processing and receive it in a portable format. You can also object to processing based on my legitimate interest. You can withdraw consent to analytics and marketing cookies at any time; this does not affect the lawfulness of processing carried out before the withdrawal.

Just write to hello@fflow.pl. If you believe I process your data unlawfully, you can lodge a complaint with the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych).

Changes to this policy

If I change how I process data, I will update this page and the date at the top.