Who is responsible for your data
The website www.smartfactorydesign.com is operated by Smart Process Design sp. z o.o., Pl. Władysława Andersa 3, piętro 11, 61-894 Poznań, Poland, NIP 7831839370, KRS 0000911446. Below we call it the controller, or simply we.
The controller decides how the personal data described here is processed, within the meaning of Regulation (EU) 2016/679 (the GDPR). For anything to do with your data, including every request listed further down, write to smartfactorydesign.contact@gmail.com.
What we collect
From the contact form: your first name, last name, email address, company name (optional) and the content of your message. There is no visitor database behind this site. The form composes one email and sends it to our inbox, and that is the end of it.
From the connection itself: our hosting provider keeps standard server logs, which record the IP address, the address requested, the date and time, and the browser and operating system. Your IP address also feeds a short lived counter that caps how many form submissions can arrive from one address, which is what stops the form being flooded.
From cookies: two of them, both necessary, both listed in the cookies section below.
That is the entire list. We run no analytics, no advertising pixels, no profiling and no automated decision making. We do not buy or enrich data about you. We do not embed third party players or maps that could watch you either: the podcast pages link out to YouTube instead of embedding it.
Why we process it, and on what legal basis
To answer your enquiry and carry on the conversation that follows. Basis: art. 6(1)(b) GDPR where the exchange heads towards a contract, and art. 6(1)(f), our legitimate interest in replying to people who write to us, where it does not.
To keep the site available and shield the form from bots and abuse. Basis: art. 6(1)(f), our legitimate interest in the security of our own service.
To record your cookie decision. Basis: art. 6(1)(c), our obligation to be able to show what you agreed to.
For any optional cookie category, if one is ever switched on. Basis: art. 6(1)(a), your consent, which you can withdraw at any time. None is in use today.
Giving us your data is voluntary. Without an email address, though, we have no way to answer you.
How long we keep it
Enquiry emails: while the enquiry is being handled, then up to 24 months from our last contact so we can pick the thread back up. Longer only where a contract, an accounting duty or a legal claim requires it.
The rate-limit counter: 10 minutes at most, in the server's memory. It is never written to disk and never leaves the process.
Server logs: for the retention period our hosting provider applies under its own policy.
Your cookie decision: 6 months, after which we ask again.
Who else processes it
Our hosting provider. It serves the site, holds the server logs, and runs the bot protection in front of the contact form, which reads signals from your browser at the moment you submit in order to tell a person from a script.
Our email delivery provider, which carries the message from the form to our inbox. It is configured to process in the European Union.
Our mailbox provider, because the inbox your enquiry arrives in is a hosted one.
All three are processors: they act on our instructions and may not use your data for their own ends. Some are based in the United States or process data there, which is a transfer outside the European Economic Area. Those transfers rest on the European Commission's standard contractual clauses and, where the provider is certified, on the EU-US Data Privacy Framework.
Beyond that, nobody. We do not sell your data and we do not share it for advertising. Ask us and we will name any of these providers.
Your rights
You can ask for access to your data and a copy of it, for its rectification or erasure, for processing to be restricted, for the data to be ported elsewhere, and you can object to processing we base on our legitimate interest.
Where processing rests on consent, you can withdraw it at any time, and doing so leaves what happened before the withdrawal lawful. Cookie consent is changed from the Cookie settings link in the footer of every page.
You can also lodge a complaint with the supervisory authority. In Poland that is the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw.
One message to smartfactorydesign.contact@gmail.com is enough to exercise any of this. We answer within a month.
How your data is protected
Every connection to the site runs over TLS, so what you type into the form is encrypted in transit.
Our application logs record field names only, never the values you typed, so the content of your message never lands in a log file.
There is no database of visitors or enquiries here to be breached. The form's only output is a single email.
Submissions are rate limited per address and screened by bot protection before they are accepted at all.
If you write to us from outside the European Economic Area
This policy is written to the GDPR standard and we apply it to everyone, wherever you write to us from.
United States. We do not sell your personal information and we do not share it for cross-context behavioural advertising, so there is no opt-out to give you. Residents of California and of other states with comparable laws exercise the rights listed above at the same address.
Mainland China. If you submit the form from mainland China, your data leaves the country: it is handled by the processors described above, in the United States and the European Union, for the sole purpose of answering you. Under the Personal Information Protection Law we tell you this before you send it, and submitting the form is your consent to that transfer. You may withdraw it at any time, and you have the right to access, copy, correct and delete your data and to ask how we handle it, at the same address. We do not rely on legitimate interest towards you, because Chinese law does not provide for it: we rely on your consent and on what is strictly necessary to reply.
Cookies
A cookie is a small text file a site stores on your device. It normally holds the name of the site it came from, how long it should be kept, and a unique value.
This site sets two, both strictly necessary, and neither of them follows you anywhere:
| Cookie | What it does | Kept for | Category |
|---|---|---|---|
lang | Remembers the language you picked so every page renders in it. | 12 months | Strictly necessary |
sfd-consent | Stores your cookie choice so we do not ask again on every visit. | 6 months | Strictly necessary |
We sort cookies into three categories. Strictly necessary ones are what make the site work at all, so the law does not require consent for them and we cannot switch them off. Analytics ones would tell us how the site is used. Marketing ones would measure campaigns or personalise advertising.
The analytics and marketing categories are empty and switched off, because nothing on this site uses them. The switches exist so that if such a tool is ever added it stays blocked until you allow it, rather than appearing quietly one day.
Change your decision whenever you like:
You can also block or delete cookies in your browser settings. Blocking the necessary ones is your call, but then the site forgets your language on every page load and asks about cookies on every visit.
Changes to this policy
If this site starts doing something new with data, gains a tool or changes a processor, we update this page and move the date and version at the top. A material change to the cookie categories also resets your consent, so you will be asked again.
Earlier versions are not published. The date at the top always tells you which one you are reading.