Privacy Policy

1. Data Controller

The data controller responsible for personal data collected through this website is Coraho, located at Małopolska 44, Szczecin, Poland. You can contact us regarding data protection matters at: [email protected] or by telephone at +48 91 431 9100.

We have not appointed a formal Data Protection Officer as we are not required to do so under Article 37 GDPR given the nature and scale of our data processing activities. The contact details above can be used for all data protection enquiries.

2. What Data We Collect

We collect personal data in the following circumstances:

Contact form submissions: When you use the contact form on our website, we collect your name, email address, telephone number (if provided), and the content of your message. This data is transmitted via your email client using the mailto protocol and is received directly into our email inbox.

Automatically collected data: When you visit our website, our hosting infrastructure may automatically collect certain technical information including your IP address, browser type and version, operating system, referring URL, pages visited on our site, and the date and time of your visit. This data is collected through standard server log files.

Cookie data: We use cookies as described in our Cookie Policy. Your cookie preferences are stored in a cookie on your device. Please see our Cookie Policy for full details.

We do not collect sensitive personal data (special categories under Article 9 GDPR) and we do not knowingly collect data from children under the age of 16.

3. Legal Basis for Processing

We rely on the following legal bases under Article 6 GDPR for processing your personal data:

Legitimate interests (Article 6(1)(f)): We process server log data and basic analytics on the basis of our legitimate interest in maintaining the security and proper functioning of our website, and in understanding how our content is used so we can improve it. We have assessed that this interest is not overridden by the rights and interests of data subjects given the limited nature of the data processed.

Performance of a task at the data subject's request (Article 6(1)(b)) / Consent: When you submit a contact form, we process your name, email, and message in order to respond to your enquiry. You have initiated this contact, and the processing is necessary to respond.

Consent (Article 6(1)(a)): Where we use non-essential cookies (such as analytics cookies), we rely on your freely given, specific, informed, and unambiguous consent as recorded through our cookie consent mechanism.

4. How We Use Your Data

Data collected through the contact form is used exclusively to read and respond to your enquiry. We do not add contact form submitters to any mailing list, newsletter, or marketing database. We do not use your contact details for any purpose other than responding to the specific enquiry you sent.

Server log data is used for security monitoring, to identify and address technical errors, and in aggregate (non-identifiable) form to understand website usage patterns. We do not use server log data to build profiles of individual users.

We do not engage in automated decision-making or profiling as defined in Article 22 GDPR.

5. Cookies and Tracking Technologies

Our website uses cookies. A cookie is a small text file stored on your device by your browser. We use strictly necessary cookies to store your cookie consent preferences. We may also use analytics cookies if you consent to them through our cookie consent banner.

You can withdraw consent for non-essential cookies at any time by revisiting the cookie settings on our website. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

Our Cookie Policy provides full details of the cookies we use, their purposes, and how to manage them.

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data to third parties. We share data only in the following limited circumstances:

Hosting providers: Our website is hosted on infrastructure provided by a third-party hosting company. Server log data is processed by this provider as a data processor acting on our instructions under a data processing agreement.

Legal obligations: We may disclose personal data if required to do so by applicable law, regulation, or court order, or to protect the rights, property, or safety of Coraho, our users, or others.

We do not share personal data with advertising networks, data brokers, or analytics companies beyond what is described in our Cookie Policy.

7. International Data Transfers

Where data is transferred outside the European Economic Area (EEA) — for example, by third-party service providers whose infrastructure is located outside the EEA — we ensure that appropriate safeguards are in place in accordance with Chapter V GDPR. These safeguards may include standard contractual clauses approved by the European Commission, adequacy decisions, or other recognised transfer mechanisms.

We take reasonable steps to ensure that any third parties handling data on our behalf provide an adequate level of data protection.

8. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law.

Contact form correspondence is retained in our email inbox for as long as the enquiry remains relevant and for a reasonable period thereafter for reference purposes. We periodically review and delete old correspondence that is no longer needed.

Server log data is retained for a period of up to 12 months, after which it is deleted or anonymised.

Cookie consent records are stored on your device for up to 12 months from the date you provided consent. After this period, we will ask for your preferences again.

9. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights with respect to your personal data held by us:

Right of access (Article 15): You have the right to request a copy of the personal data we hold about you and information about how it is processed.

Right to rectification (Article 16): You have the right to request correction of inaccurate personal data we hold about you.

Right to erasure (Article 17): You have the right to request deletion of your personal data in certain circumstances, including where the data is no longer necessary for the purposes for which it was collected.

Right to restriction of processing (Article 18): You have the right to request that we restrict the processing of your personal data in certain circumstances.

Right to data portability (Article 20): Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.

Right to object (Article 21): You have the right to object to processing based on legitimate interests. We will then cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to withdraw consent: Where processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected]. We will respond within one month of receiving your request, as required by Article 12 GDPR. You also have the right to lodge a complaint with the Polish supervisory authority, the Urząd Ochrony Danych Osobowych (UODO), if you consider that our processing of your personal data infringes GDPR.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, in accordance with Article 32 GDPR. Our website is served over HTTPS. Access to email correspondence is protected by authentication controls.

No method of transmission over the internet or method of electronic storage is entirely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.

11. Children's Privacy

Our website is intended for general audiences and is not directed at children under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child under 16 without appropriate consent, we will take steps to delete that data promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. When we make changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our website after any changes constitutes acceptance of the updated policy.

13. How to Contact Us

If you have any questions about this Privacy Policy or about how we handle your personal data, please contact us:

Coraho
Małopolska 44
Szczecin, Poland
Email: [email protected]
Phone: +48 91 431 9100

For complaints about data protection practices, you may also contact the Polish data protection supervisory authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, www.uodo.gov.pl.