Privacy Policy

1. Data Controller

The controller responsible for your personal data is:

For any questions regarding this Privacy Policy or the processing of your personal data, please contact us using the details above.

2. Scope of This Policy

This Policy applies to personal data processed when you:

• Visit or browse our website at corecraft-sp.com;
• Contact us via email, phone, or contact forms;
• Request a consultation or quotation for renovation services;
• Enter into or perform a contract for interior renovation works;
• Subscribe to communications or interact with our online content.

3. Personal Data We Collect

Depending on your interaction with us, we may process the following categories of personal data:

• Identity and contact data — name, email address, telephone number, postal address;
• Project and enquiry data — property details, renovation requirements, budget indications, messages you send us;
• Contract and billing data — information necessary to prepare offers, conclude agreements, and issue invoices;
• Technical and usage data — IP address, browser type, device information, pages visited, referral source, cookie identifiers;
• Communication data — records of correspondence, consultation notes, and customer support interactions;
• Marketing preferences — where you have opted in to receive updates from us.

Where required by law, we will inform you whether providing certain data is mandatory and explain the consequences of not supplying it.

4. Purposes and Legal Bases for Processing

We process your personal data only where a valid legal basis under Article 6 GDPR applies:

Contract performance (Art. 6(1)(b) GDPR)

To respond to enquiries, prepare quotations, plan and deliver renovation services, and manage our contractual relationship with you.

Legitimate interests (Art. 6(1)(f) GDPR)

To operate and improve our website, ensure network and information security, prevent fraud, manage business operations, and pursue limited direct marketing to existing clients where permitted. We balance our interests against your rights and expectations.

Legal obligation (Art. 6(1)(c) GDPR)

To comply with tax, accounting, employment, and other legal requirements applicable in Poland and the European Union.

Consent (Art. 6(1)(a) GDPR)

For non-essential cookies, certain analytics tools, and marketing communications where consent is required. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

5. Cookies and Similar Technologies

Our website uses cookies and similar technologies to ensure proper functionality, remember your preferences, and — where you have given consent — analyse how visitors use our site.

• Strictly necessary cookies — required for core website functions and security; processed on the basis of legitimate interests or legal obligation;
• Functional cookies — enhance usability, such as remembering choices you make;
• Analytics cookies — help us understand traffic and improve our services, only where you select “Accept All” in our cookie banner or otherwise provide consent.

You can manage cookie preferences through our cookie banner or your browser settings. For more information, see our cookie notice displayed when you first visit the site.

6. Recipients and Data Sharing

We do not sell your personal data. We may share data with trusted recipients only where necessary:

• IT hosting, website, and email service providers;
• Professional advisers (lawyers, accountants) bound by confidentiality;
• Subcontractors and trades involved in delivering your renovation project, under appropriate data processing arrangements;
• Public authorities where required by applicable law.

All processors act on our documented instructions and implement appropriate technical and organisational security measures pursuant to Article 28 GDPR.

7. International Transfers

We primarily process data within the European Economic Area (EEA). If any service provider transfers personal data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission or an adequacy decision, in accordance with Chapter V GDPR.

8. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy:

• Enquiry and marketing records — typically up to 24 months after last contact, unless a longer period is justified;
• Contract and project documentation — for the duration of the contract and thereafter as required by Polish commercial and tax law (generally up to 5 years, and up to 6 years where tax statutes prescribe);
• Website logs and security data — for a limited period aligned with security needs, usually not exceeding 12 months;
• Cookie-related data — according to the lifespan of each cookie or until you withdraw consent.

When data is no longer required, we securely delete or anonymise it.

9. Your Rights Under the GDPR

As a data subject, you have the following rights, subject to conditions under EU and Polish law:

• Right of access — to obtain confirmation and a copy of your personal data;
• Right to rectification — to correct inaccurate or incomplete data;
• Right to erasure — to request deletion where processing is no longer lawful or necessary;
• Right to restriction — to limit processing in certain circumstances;
• Right to data portability — to receive data you provided in a structured, commonly used format where processing is based on consent or contract and carried out by automated means;
• Right to object — to object to processing based on legitimate interests or for direct marketing;
• Right to withdraw consent — at any time, where processing relies on consent;
• Right to lodge a complaint — with a supervisory authority, in particular in your country of habitual residence, place of work, or place of the alleged infringement.

To exercise your rights, contact us at corecraft@onet.eu. We will respond within one month, as required by Article 12 GDPR, which may be extended by a further two months where necessary due to complexity.

10. Security of Personal Data

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss, or destruction. These measures include access controls, secure communication where applicable, and contractual safeguards with service providers. No method of transmission over the internet is completely secure; we encourage you to use strong passwords and protect your own devices.

11. Children’s Data

Our website and services are not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have received such data, please contact us and we will take steps to delete it promptly.

12. Automated Decision-Making

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.

13. Supervisory Authority

If you consider that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Polish supervisory authority:

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in law, technology, or our business practices. The current version will always be available on this page. Where changes are material, we will take appropriate steps to inform you, such as a notice on our website.

15. Contact

For any requests relating to this Privacy Policy or your personal data, please contact:

See also our Terms of Service.