1. Data Controller

The controller of your personal data is Krzysztof Krawczyk, operating under the trade name Grafmen based in Przemyśl, Poland. For any matters concerning personal data protection, you may reach me via email at: info@grafmen.com or by phone: +48 694 179 217.

2. Purposes and Legal Bases for Data Processing

Your personal data is processed solely for specific, legitimate purposes depending on the stage of contact and cooperation:

  • Handling commercial enquiries: email and phone correspondence regarding project scoping, consultations, and quotations (legal basis: Art. 6(1)(f) GDPR – legitimate interest of the controller to communicate with prospective clients).
  • Concluding and executing contracts: project collaboration, contracts for specific work, and copyright transfer agreements (legal basis: Art. 6(1)(b) GDPR – necessity for contract performance).
  • Fulfilling statutory tax and accounting obligations: issuing invoices/bills and maintaining statutory financial records (legal basis: Art. 6(1)(c) GDPR) – applicable exclusively to enquiries resulting in formal contracts and financial transactions.
  • Defence against and pursuit of legal claims: preserving correspondence in case of civil disputes (legal basis: Art. 6(1)(f) GDPR – legitimate interest of the controller).

3. Contact Forms, Briefs and Data Retention

The Grafmen.com website provides online contact forms and interactive project briefs enabling you to submit project requirements and commercial enquiries. Submitting a form sends the provided details (such as your name/contact person, email address, phone number, company name, message, and selected project specifications) directly to the controller.

Technical Form Provider (Data Processor):

For technical ingestion and forwarding of form submissions to email, the website uses the Web3Forms service, operated by Web3Creative. Web3Creative acts as a data processor pursuant to a Data Processing Agreement (DPA). Transmission of data from your browser to the form gateway is secured exclusively via encrypted HTTPS (SSL/TLS) connections.

Data Retention by Web3Forms (Processor):

  • In accordance with Web3Creative's official Privacy Policy and DPA, form submission data may be retained within the service infrastructure for a maximum of up to 3 years from the date of submission (or a shorter period if specified by the account plan or if the controller manually deletes submissions earlier).
  • Server logs are deleted on a regular basis by the provider.

Data Retention by the Controller (Grafmen):

  • Form submissions arrive at the controller's email inbox (info@grafmen.com).
  • Pre-contractual enquiries and correspondence not resulting in an order: retained for the duration necessary to handle the enquiry, prepare project estimates, and conduct consultations, and subsequently for the period appropriate to defend against potential pre-contractual claims (or until an effective objection is lodged). Specific retention schedules and deletion routines are determined by the Controller under internal management procedures.
  • Contractual documentation and completed projects: retained for the duration of the agreement and the statutory limitation period for civil and copyright claims (typically 3 to 6 years under the Polish Civil Code).
  • Tax and accounting records: exclusively in the case of completed contracts involving statutory billing (invoices/receipts) – for a period of 5 years, counted from the end of the calendar year in which the tax payment deadline for the respective obligation expired (pursuant to statutory Polish tax and accounting law: Art. 86 § 1 in conjunction with Art. 70 § 1 of the Tax Ordinance and Art. 74 of the Accounting Act). General, non-billable enquiries do not constitute tax records and are never subject to this statutory retention.

International Transfers and Security Safeguards:

Web3Creative engages trusted cloud infrastructure sub-processors (including Cloudflare and AWS) located in the European Union, the United States, and other third countries. Any international transfer of personal data outside the EEA is carried out on the basis of Standard Contractual Clauses (SCCs) adopted by the European Commission, integrated into the Web3Forms DPA, combined with robust technical encryption during transit (HTTPS/TLS) and at rest.

You may also reach me directly via traditional email (info@grafmen.com) or phone.

4. Cookies and Analytics

Grafmen.com does not use advertising, third-party tracking, or behavioural profiling cookies. No external profiling scripts are loaded on this website.

  • Technical storage and localStorage: The site may store user interface preferences locally in your browser (localStorage), such as remembering the dismissal of the informational privacy banner so it does not reappear. This data is not transmitted to external servers or third parties.
  • Embedded video media: Portfolio videos are embedded strictly upon user interaction from the domain youtube-nocookie.com (YouTube's privacy-enhanced mode), which does not place tracking cookies prior to playback.

Should the website introduce anonymous web analytics (such as Google Analytics) in the future, this policy will be updated accordingly, and visitors will be prompted for consent before any analytics scripts run.

You can adjust or reset your cookie preferences at any time by clicking “Cookie settings” in the website footer or by adjusting your browser settings.

5. Your Statutory Rights

Under the General Data Protection Regulation (GDPR), you have the right to:

  • access your personal data and request a copy,
  • rectify (correct) inaccurate or incomplete data,
  • request erasure of data (“right to be forgotten”),
  • restrict or object to data processing,
  • lodge a complaint with a supervisory authority (in Poland: the President of the Personal Data Protection Office – UODO).

6. Changes to this Privacy Policy

Any revisions to this privacy policy will be published on this page. The current version is effective as of 21 September 2026.