Privacy and cookie policy

Updated: 19 October 2026.

1. Who is responsible for your data and how to contact us

The controller of your personal data is Marek Zdanowicz, trading under the business name Marksoft Marek Zdanowicz, Polish tax identification number (NIP) 8571508500. In this policy, “MARKSOFT”, “the controller”, “we” and “us” refer to that business.

Business address: ul. Wichrowe Wzgórza 34/2, 72-001 Siadło Dolne, Polska.

For matters concerning personal data, your rights or the website, email Show email, use the contact form or write to the address above. On the website, the email address can be revealed and copied using the contact buttons. This does not require consent to analytics or promotion measurement.

REGON: 811124869

2. What this policy covers

This policy explains how we process data when you visit the Polish or English version of markyz.pl, use the form, correspond with us about our services or manage your privacy choices. It also covers Statistics described below. Promotion and advertising measurement are off.

The website presents MARKSOFT’s services. The form provides a way to contact us; it does not create a customer account or, by itself, conclude a contract for our professional services. If we begin working together and additional purposes, data or contractual obligations arise, we will provide the relevant information before that further processing.

3. What data we receive

When you contact us: the form requires an email address and a message. Your name or company name is optional. The form has no phone field and does not accept attachments. You choose what information is needed to discuss your enquiry. When you email us directly, we also receive information in the message, signature and any attachments, together with technical delivery information.

Please do not send passwords, access keys, identity documents, health information or data about customers and other people that is unnecessary for the enquiry. A general description of your needs is sufficient for initial contact.

When you visit: the server receives your IP address, the request time, the address of the requested resource, the response result and technical information sent by your browser, such as its type and any referring page. This information supports website delivery, troubleshooting and security. We limit its scope; form content is not placed in URLs or application logs.

To protect the form: we briefly process a technical identifier derived from the IP address, the time and number of attempts and the result of protective checks. Such an identifier may still be personal data when it is a hash. We do not use it to build a history of your interests.

For optional measurement: after consent, cleaned page and event data, identifiers and technical information described in section 7 are processed. Form contents, contact details and their hashes are excluded.

For privacy choices and rights requests: we receive your choice of purposes, the time, the information version and the minimum identifier needed to remember and demonstrate the choice. When you make a data rights request, we receive your contact details, the request and information necessary to handle it.

4. Purposes and lawful bases

The lawful bases below refer to Article 6(1) of EU Regulation 2016/679, the General Data Protection Regulation (GDPR).

Purpose	Lawful basis and explanation
Responding to ordinary enquiries, corresponding with company representatives and retaining relevant correspondence	Point (f): our legitimate interest in business communication, responding to enquiries and retaining the necessary context of a matter for a limited period.
Taking steps at your request before entering into a contract	Point (b): only to the extent necessary for those steps, where you are the intended contracting party. Retaining relevant correspondence after discussions end without a contract relies on the legitimate interest described above.
Delivering the website and email service, diagnosing errors and preventing abuse	Point (f): our legitimate interest in availability, security and the proper handling of contact.
Website usage statistics	Point (a): your voluntary consent to “Statistics”, within the scope of the tools listed in section 7.
Remembering privacy choices, demonstrating consent and handling data rights	Point (c): compliance with applicable GDPR obligations, including Articles 5(2), 7(1) and 12–22, to the extent the particular obligation applies.
Necessary records after a matter ends and protection in relation to specific claims	Point (f): our legitimate interest in demonstrating compliance and establishing, exercising or defending legal claims; point (c) applies where a specific legal obligation requires further retention.

We do not require consent to process data necessary to answer you. Reading this policy does not constitute marketing consent. Sending an enquiry, including a request for a proposal, does not subscribe you to a newsletter or authorise unsolicited promotional messages.

5. Whether you must provide data

Contacting us is voluntary. An email address and a message are necessary to submit the form and receive a reply; without them, the form will not be accepted. Leaving the name or company field blank does not prevent submission. You do not have to provide information beyond what is needed for the matter.

Basic connection data is processed to deliver and protect the website. You may reject every optional measurement purpose and still view our services, use the form, reveal the email address and exercise your rights. Consent is separate from contact and any future work together.

6. How the form and email work

The form sends your data over an encrypted connection to the server serving markyz.pl. After checking the data and protective controls, the server passes the message to the email system at Show email. MyDevil handles the contact mailbox and the destination mailbox used for forwarding. We do not create a separate database of form submissions; data is nevertheless processed during sending, in email systems and in their copies.

MyDevil states that delivery retries continue for no more than 48 hours. This is not the retention period for messages in mailboxes or backups. According to the operator, message contents, including headers, are not stored separately. This does not mean that messages are absent from mailboxes, the delivery queue or backups.

A form acceptance confirmation means that the sending mechanism has accepted the message. It does not confirm final delivery or that the message has been read. We do not automatically send a copy of the form to the address you enter.

If an error occurs, your input may remain in the open page so that you can correct it or deliberately retry. The website does not save a form draft in persistent browser storage. Browser features such as autofill and session restoration depend on the browser’s own settings.

7. Cookies, browser storage and Google Analytics 4

The only optional purpose is Statistics, provided by Google Analytics 4 after consent. Promotion measurement, Google Ads, remarketing, advertising personalisation, Google Signals and user-provided data collection are off. There is no separate advertising category.

Analytics measures page views and enquiries confirmed as accepted by the sending mechanism. Acceptance does not confirm delivery, reading or acquisition of a customer. Errors, unconfirmed attempts and demonstration-mode submissions do not trigger accepted-enquiry measurement.

We send a fixed page identifier, a cleaned URL without query or fragment, a fixed title and language. The measurement referrer field is empty. We do not send a name, company, email address, message or hashes of those data. Google also receives connection information, including IP, cookie and session identifiers, and technical device, browser and consent-state data. This is not described as anonymous merely because contact information is excluded. The tool may create automatic session, first-visit and engagement information. Enhanced measurement, including form interactions, is off.

The provider is Google Ireland Limited. For entrusted Analytics data, Google acts as a processor under the processing terms incorporated into its service terms: Analytics terms, processing terms, data from partner websites.

Before consent and after rejection, we do not load the tag or send optional cookieless measurement requests. We do not collect pre-consent history for later transmission. Contact works independently of the choice.

After valid browser consent, loading and configuring the Google tool and obtaining an identifier may precede durable acceptance of the decision by our server. We send our own application events only after that acceptance. Failure to accept blocks those events but does not establish that no connection to Google occurred earlier.

Record	Purpose and creation	Validity and cleanup
marksoft.privacy.v1 — localStorage (schema v2 record)	Version, decision and time, including rejection; shared PL/EN	Choice valid for 180 days without passive renewal. The expired record may remain until a new decision or cleanup.
_ga, _ga_V136K61KV7	Browser identifier and GA4 measurement state, only after consent	Google documents a default lifetime of up to 2 years with renewal on activity. A browser may limit this period or remove the record earlier. Withdrawal removes controlled cookies; renewal does not extend consent.
marksoft.privacy.rights.capsule.<epoch> — localStorage	Copy of an available CID/signed decision capsule, limited to withdrawal handling without restarting Google	Usable for up to 187 days; removed earlier after durable acceptance and receipt storage. Physical cleanup requires website execution.
marksoft.privacy.rights.pending.<epoch> — localStorage	Minimal outbox: epoch, time/expiry and attempts; no copy of CID or form contents	7 days and no more than 12 attempts; removed earlier after ACK. Exhausting attempts is not acceptance or erasure.
marksoft.privacy.rights.receipt.<epoch> — localStorage	Case number, decision epoch, confidential status credential, last state and expiry; no CID or form contents	7 days from first durable acceptance, without renewal by reads or duplicates. PHP refuses expired access. The record may physically remain until return and cleanup.

<epoch> denotes the part of the key for a specific decision, not another visit identifier. The technical marksoft.privacy.check tests storage availability without personal data and is normally written and removed immediately. If storage fails between those operations, it may remain until a successful check or manual cleanup; it does not grant consent.

The GA4 user/event retention setting is 2 months, with reset on new activity off. This is distinct from cookie lifetime and consent validity; it does not cover every aggregate report or guarantee deletion of every item exactly 2 months later. Deletion follows the service cycle. A report does not become anonymous solely by presenting aggregate figures.

8. Choice, withdrawal and data already sent

You can select “Accept all”, “Reject optional” or “Customise”. Statistics is the only optional category and is initially off. Making no choice, scrolling, closing the notice or using the website does not constitute consent.

Your choice remains valid for 180 days from the date of your decision. It is shared by PL/EN in this browser and is not renewed by visits alone. Change or withdraw it using Privacy settings in the footer. A different browser or device may require a separate choice. A material change of purposes or providers may require new consent sooner. An expired record may remain, but does not authorise measurement. A new decision replaces it and clearing website data removes it.

Withdrawal immediately stops new measurement and removes controlled statistics cookies. Unsent text remains in the open page; no persistent form draft is created. Withdrawal cannot recall a transmission already started or erase previously sent Google data by itself.

We automatically initiate handling of the erasure of data processed solely on that consent unless a separate purpose and lawful basis justify further retention. No additional request is required. We use an available minimal identifier without restarting Google. The case enters a private queue; Marek carries out the GA4 panel operation. Case acceptance is not an instruction to Google or proof of completed erasure.

If no identifier is available or data cannot be linked, we explain the limitation; you may voluntarily supply helpful information. We do not collect extra data solely to establish identity or routinely request an identity document. Suspicious or inconsistent cases require proportionate clarification. Open cases are reviewed at least every 7 days. A missing panel row does not establish that every copy has been erased.

When connectivity or decision acceptance fails, we do not send our own application events; this does not exclude earlier loading of the tool following consent, as explained in section 7. Delivery of the decision or case is retried within limits. Permanent disconnection, expiry of delivery or removal of storage before durable acceptance may prevent delivery; that is not reported as accepted or completed. A local receipt permits status access for 7 days after first acceptance. Expiry does not delete the case, end its handling obligation or erase Google data. Automatic restoration of a historical case panel after reload is not promised.

Withdrawal does not affect the lawfulness of prior processing or automatically delete correspondence kept for a separate purpose or minimal compliance evidence. Section 1 contact remains available. Removing browser cookies does not deliver withdrawal to us or establish erasure outside the device.

9. Who receives data

Data is available to the controller and authorised persons only to the extent necessary. We use hosting and email services from MyDevil, operated by ADMIN.NET.PL Tomasz Rzepka Arkadiusz Nowara S.C., ul. Bitwy pod Monte Cassino 5/198, 33-100 Tarnów, Poland, NIP 8733250257. This includes operating the website, form transmission and mailboxes, together with the relevant technical and security activities.

The operator has provided us with a data processing agreement template; the agreement has not yet been concluded. The supplied template names Atman sp. z o.o., eTOP Sp. z o.o. and Sprint S.A. as subprocessors. This is information from the template, not confirmation of a signed agreement, the actual involvement of each entity in servicing our account or a complete, current processing chain.

Recipients may also include providers actually engaged to maintain the website or provide technical support, within the necessary access scope and on an appropriate basis. The measurement providers, their roles and the data they receive following your choice are listed in section 7.

Where a specific matter requires it, necessary data may be received by legal advisers or authorised public bodies and courts. This does not mean that we routinely share all correspondence with these categories. A provider’s role depends on what it actually does; not every recipient is a processor.

10. Transfers outside the European Economic Area

The European Economic Area (EEA) comprises the EU countries, Iceland, Liechtenstein and Norway. A transfer outside the EEA may also result from technical access from another country, rather than only the server’s location.

Google permits subprocessors outside the EEA, including the US, and describes reliance on DPF and SCC safeguards depending on the transfer. Google transfer information and safeguards. This does not mean that all data stays in the EU. Google publishes its subprocessors and locations, including entities outside the EEA. This service-level list does not establish that every listed entity handles our particular operation.

MyDevil’s response did not conclusively confirm the actual locations of data and backups or access from outside the EEA for our account. We therefore do not claim that all operations and copies remain in Poland or the EEA. The Polish addresses of the companies named in the agreement template do not resolve this question. We will update this information when we receive the relevant confirmation.

You can obtain information about the relevant safeguards and a copy by contacting the controller. Disclosure will take account of the necessary protection of confidential information and other people’s rights.

11. How long we keep data

Retention depends on the particular purpose. Once that purpose ends, we delete the data or make it truly anonymous, subject to the limited exceptions described below.

Data	Period or criterion
Ordinary enquiries and correspondence where no work together follows	Up to 12 months after the last substantive message about the matter. Automated notifications do not restart the period. After discussions end, the necessary correspondence is retained on the basis of legitimate interest.
Data needed for work we undertake	We separate data necessary for the contract and apply retention appropriate to that purpose and applicable legal obligations. Information about the further scope is provided when that processing starts. We do not automatically retain all earlier correspondence.
Technical web access logs	MyDevil documents availability of web access logs for up to 90 days. This period does not automatically cover other security, PHP or mail logs. We are confirming the remaining operator information as explained below.
Mail logs and service login logs	MyDevil stated a retention period of at least one year. No upper limit was provided. This does not mean that those data are deleted after one year.
Application journals maintained by us	The form and privacy modules do not maintain a separate journal of form contents, raw IP addresses or exceptions. This describes application code, not operator access, security, PHP or mail logs.
Abuse-prevention counters and identifiers	The form uses a 10-minute window. Expired entries are removed during the next relevant operation and by cleanup scheduled every 5 minutes. An execution failure may delay removal; expiry of the window does not mean immediate physical erasure. Protection counters for privacy handling are also removed after expiry through its cleanup process.
Browser privacy choice	Choice valid for 180 days from decision. Storage behaviour and other records are described in sections 7–8.
Minimal consent evidence	Throughout related processing, then 12 calendar months from its documented end; no raw CID or further measurement.
Minimal case trace	12 calendar months from explicit closure. Remove raw CID earlier when no longer needed; do not abandon an open case by automatic TTL.
Statistics data	Separate periods in section 7 and cessation/erasure rules in section 8; no active promotion measurement.
Evidence necessary for a specific claim or data breach matter	Until final resolution of the matter and expiry of the applicable period required by law or the relevant limitation period. We limit the material to necessary data and review the need for continued retention. This does not extend retention for the entire queue of cases.

Deleting correspondence covers mailboxes and copies under our control, including forwarded and sent messages, trash and local archives actually used. Backups are excluded from ordinary use. If data is restored, we reapply prior deletions.

Operator email systems and backups: according to MyDevil’s response, remote backups cover 14 backup runs, while the local server backup usually covers 15 runs. These are counts of backup runs, not guaranteed retention periods of 14 or 15 days. They also do not establish that all copies are completely deleted after that period. The maximum retention of mail and service login logs, detailed periods for PHP/web error and anti-spam logs, and the exact schedule for deleting all copies after data deletion or service termination and the handling of restored copies remain unconfirmed. The maximum 48-hour delivery retry period does not resolve those retention periods. We will update this policy when further information is available. You may also request information using the contact details in section 1.

12. Your rights

Subject to the conditions in the GDPR, you may exercise the following rights:

• Access and a copy: obtain confirmation of processing, information about it and a copy of your data.
• Rectification: correct inaccurate data and complete incomplete data.
• Erasure: request deletion where a GDPR ground applies, for example when the purpose ends or consent is withdrawn and no other lawful basis remains. Exceptions include an applicable legal obligation and data necessary to defend legal claims.
• Restriction: request restricted processing in the circumstances provided by law, for example while disputed accuracy is checked.
• Portability: receive data you provided in a structured, commonly used format and transmit it to another controller where processing is automated and based on consent or contract. Direct transmission is available where technically feasible.
• Objection: object on grounds relating to your particular situation to processing based on legitimate interest. We will then stop processing for that purpose unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or grounds for establishing, exercising or defending legal claims. If data is processed for direct marketing, an objection to that purpose requires no such justification and ends that processing, including related profiling.
• Withdrawal of consent: withdraw at any time without affecting the lawfulness of earlier processing. Use “Privacy settings” for measurement choices.

Submit a request using the contact details in section 1. We respond without undue delay, normally within one month of receiving the request. The period may be extended by up to two further months where necessary because of complexity or the number of requests; we will explain the extension and its reason within the first month. If we refuse, we will explain why and inform you about your right to complain and seek a judicial remedy.

We do not routinely require an identity document copy. Where there are reasonable doubts, we may ask for proportionate information necessary to confirm identity. We do not collect additional data merely to identify ordinary visitors. If we cannot link a request to data we hold, we will explain this and consider any additional information you choose to provide in accordance with Article 11 GDPR.

Handling requests is generally free. For manifestly unfounded or excessive requests, the GDPR permits a reasonable fee or refusal; we are responsible for substantiating that decision.

13. Complaining to a supervisory authority

If you consider that processing infringes the GDPR, you may complain to a competent supervisory authority, particularly in the country of your habitual residence, workplace or the alleged infringement.

In Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland. Current information and complaint channels are available at uodo.gov.pl. You do not have to exhaust contact with MARKSOFT before exercising this right.

14. Data received from another person

We may receive professional contact details of someone representing a customer or prospective customer from their company, colleague or another person involved in the matter. These may include a name, professional role, work email address and the context of the matter.

In that situation, we use the necessary data for business communication on the legitimate interest described above. We will also provide the person with the actual source and categories of their data and the remaining information required by Article 14 GDPR: within one month at the latest, or earlier at the first communication with them or the first disclosure to another recipient, as applicable. Statutory exceptions are used only where their conditions actually apply and can be justified.

15. Security and automated decisions

We apply technical and organisational measures appropriate to the risk, including an encrypted website connection, access restrictions, form validation, abuse prevention and deletion rules. Please report security issues using the contact in section 1 without sending secrets or unnecessary data about other people.

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR. Automated abuse checks may temporarily limit form submissions; email contact remains available if you encounter a problem. Any analytics activities or profiling by tools are described in section 7 and should not automatically be equated with a decision covered by Article 22.

16. Changes to this policy

We update this policy when actual processing practices or relevant requirements change. The current text and update date are available on this page. Before starting a new purpose, we provide the required information and obtain appropriate new consent where necessary. Continuing to use the website does not, by itself, constitute such consent.

The Polish and English versions describe the same processing scope and rights.

Contact form terms

1. Provider and scope

The service provider is Marek Zdanowicz, trading under the business name Marksoft Marek Zdanowicz, Polish tax identification number (NIP) 8571508500, address: ul. Wichrowe Wzgórza 34/2, 72-001 Siadło Dolne, Polska. Contact: Show email, which can be revealed and copied in the website’s contact section.

The markyz.pl form is a free electronic service for sending an enquiry to MARKSOFT. No account is required. Using the form does not order a paid service or conclude a contract for professional work. Any terms for working together are agreed separately.

2. Technical requirements and security

You need an internet-connected device, an up-to-date browser supporting HTTPS and an email address to submit the form. Interactive features, such as on-page validation, copying the address, form status handling, use JavaScript. Optional measurement and consent to it are not required to use the form.

Internet communication risks include sender impersonation and access to messages through a compromised or shared device. Check the markyz.pl domain and use current software. Do not send passwords, access credentials, identity documents or unnecessary confidential material.

3. Sending and ending use

You provide an email address and a message; your name or company is optional. The limits are 254, 5,000 and 150 characters respectively. The form does not support attachments.

The agreement for free access to the form function begins when you start using it. Before sending, you can stop at any time, leave the page or remove your input. Sending initiates an attempt to pass the message for delivery. The individual submission service ends when that attempt is handled and its result is made available; subsequent correspondence addresses your enquiry. Leaving the page after sending does not recall a message already accepted by the server.

An acceptance message confirms acceptance by the sending mechanism, without guaranteeing final delivery or that the message has been read. If no confirmation is received, the result may be uncertain, and manually retrying may send a second message. We do not automatically send a copy to the address entered in the form. If the form is unavailable or an abuse prevention limit blocks the attempt, you can use the email address revealed on the website.

4. Permitted use

You must not submit unlawful content, infringe other people’s rights, send spam or disrupt the website. Include only information needed for contact and provide other people’s data only where you have a basis to do so. Protective controls may temporarily limit repeated or suspicious submission attempts. They do not remove your right to contact us or report a problem.

5. Complaints about the form

Report a problem to Show email or the provider’s address above. Describe what happened, the approximate time, the browser used and how we can reply. Do not send a password or unnecessary data from your message. Missing technical details do not prevent us from considering the complaint.

6. Availability of the terms

These terms are available free of charge before using the form and can be saved or printed. Changes apply to use after publication and do not retrospectively change how an already submitted message is handled.