Privacy policy

1. Data controller

The controller of personal data processed through gotopl.com is PLAN GROUP sp. z o.o., Al. Grunwaldzka 413, 80-309 Gdańsk, Poland, KRS 0000971382, NIP 5842817738, REGON 522004318. For privacy matters you may contact us at hello@plangroup.pl.

2. What data we process

Depending on how you use the website, we may process your first and last name, business email address, company name, company website, the content of your enquiry, technical information necessary for website and form security, server logs, cookie preference information and — only where optional tools are enabled and consented to — analytics or marketing identifiers.

3. Contact forms and correspondence

Data submitted through the contact form is processed to respond to your enquiry and, where the enquiry concerns potential cooperation, to take steps at your request before entering into a contract. The legal basis is Article 6(1)(b) GDPR. Where the correspondence is not directly aimed at concluding a contract, we may process it on the basis of our legitimate interest in conducting business correspondence, developing commercial relationships, ensuring continuity of communication and establishing, exercising or defending legal claims (Article 6(1)(f) GDPR).

4. Security and technical logs

We may process IP addresses and technical logs where necessary to secure the website, prevent abuse and diagnose errors. The basis is our legitimate interest in maintaining the security, availability and integrity of the website (Article 6(1)(f) GDPR).

5. Cookies and optional technologies

The website uses a necessary cookie to remember your privacy preferences for 180 days. Optional analytics and marketing technologies are not loaded before consent. At the date of this policy, the configuration fields for Google Analytics and Meta Pixel in the website package are empty, so these tools are not active unless they are deliberately configured. You may change or withdraw your choices at any time through “Cookie settings” in the footer. Details are set out in the Cookie policy.

6. Locally hosted font

Montserrat is served locally from the GoToPL website. Displaying the font does not require a connection to Google Fonts or another external font provider.

7. Anti-spam protection

The contact form includes built-in anti-spam mechanisms, rate limiting, CSRF protection and a honeypot field. Cloudflare Turnstile can optionally be enabled in the website configuration. If enabled, it is used for security and abuse prevention and may involve processing by Cloudflare according to its terms and privacy documentation. It is not active when its configuration keys are empty.

8. Recipients of data

Personal data may be made available to providers supporting hosting, email, IT administration, cybersecurity and other services necessary to operate the website, under appropriate contractual and confidentiality arrangements. Optional analytics or advertising providers receive data only if the corresponding tool is configured and, where required, the user has consented.

9. International data transfers

If a service provider processes personal data outside the European Economic Area, the transfer is made only where a lawful transfer mechanism applies, such as an adequacy decision, the EU–U.S. Data Privacy Framework for a certified provider, or Standard Contractual Clauses supplemented where necessary by additional safeguards. The exact mechanism depends on the provider used in production.

10. Retention

Enquiries are retained for the time necessary to respond and manage the potential business relationship. Where no cooperation follows, correspondence may be retained for up to 24 months for continuity of business communication, unless a shorter period is appropriate. Data connected with an agreement, accounting or claims may be kept for the periods required by applicable law or until relevant claims expire. Security logs are kept only for the period reasonably necessary for security and troubleshooting. Cookie preference information is stored for 180 days.

11. Your rights

Depending on the legal basis and circumstances, you may request access to your data, rectification, erasure, restriction of processing, data portability and you may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

12. Complaint to the supervisory authority

You have the right to lodge a complaint with the supervisory authority competent for data protection. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

13. Profiling and automated decisions

GoToPL does not use the website to make decisions producing legal effects or similarly significant effects solely by automated means. If optional advertising technologies are enabled in the future, they may support audience or campaign measurement; they will not be activated before the required consent and this policy should be updated to reflect their actual configuration.

14. Changes to this policy

We may update this policy when website functions, service providers or legal requirements change. The current version is published on this page together with the date of the latest update.