Legal information
Privacy policy
Last updated: 22 October 2026
Below we explain what personal data we process in connection with filarstudio.pl and the client panel, for what purpose, for how long, and what rights you have.
1. Data controller
The controller of your data is Mateusz Gmerek, 99-300 Kutno, Poland, a natural person running unregistered business activity (działalność nierejestrowana) under the Filar Studio brand (“we”).
For any matter concerning personal data, write to kontakt@filarstudio.pl.
2. What data we process and why
2.1. Contact form and e-mail correspondence
| Data | First name, e-mail address and message (required fields) and, if you provide them, company name and current website address. The message also includes the date on which you confirmed reading this information. |
|---|---|
| Purpose | Replying to your enquiry and, where relevant, preparing an offer. |
| Legal basis | Art. 6(1)(b) GDPR — steps taken at your request before entering into a contract; for other enquiries Art. 6(1)(f) GDPR — our legitimate interest in conducting correspondence. |
Messages sent through the form are not stored in the website's database — they are delivered by e-mail to our mailbox. Ticking the box in the form confirms that you have read this information; it is not consent and is not the legal basis for processing.
2.2. Client panel and our cooperation
| Data | Account data (login, full name, e-mail address, password hash, notification settings, date of last sign-in), client company data (name, contact person, e-mail, phone, tax ID, website address — if provided), project information, messages in the panel, uploaded files and materials, domain and hosting arrangements, project activity history. |
|---|---|
| Purpose | Running the account, performing the contract for building or maintaining a website, project communication, sending e-mail notifications about the project, payments and service renewals. |
| Legal basis | Art. 6(1)(b) GDPR (performance of a contract) where you are a party to the contract; Art. 6(1)(f) GDPR where you represent or work for the client company (legitimate interest: contact regarding our cooperation), and to establish and pursue claims. |
Panel accounts are created by the administrator. If your data was provided by the company you represent, it comes from that company and covers identification and contact data. Passwords are stored only as a cryptographic hash (bcrypt).
2.3. Payments and settlements
| Data | Amounts, titles and due dates of charges, payment status, settlement documents (e.g. invoices, contracts, acceptance reports), transaction identifiers assigned by Stripe. |
|---|---|
| Purpose | Handling payments, settling services, meeting tax obligations. |
| Legal basis | Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(c) GDPR (obligations under tax law), Art. 6(1)(f) GDPR (establishing and pursuing claims). |
Online payments take place on the Stripe payment page, to which the panel redirects you. You enter your card or other payment details directly with Stripe — we do not receive or store them. We pass to Stripe the company name (or the contact person's name), e-mail address, amounts and titles of charges, and our internal client and project numbers. More about Stripe's role in section 5.
2.4. Security and technical data
With every connection the server receives your IP address and basic technical information (e.g. request time, page address, browser data). We use it to run the website, diagnose errors and prevent abuse, e.g. to limit the number of sign-in attempts and form submissions. When you request a password reset, we record the IP address the request came from. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: website security).
3. Do you have to provide data?
Providing data is voluntary, but without the data marked as required we cannot reply to an enquiry, create an account or perform a contract. Data needed for settlements is required by tax law.
4. How long we keep data
- Correspondence and enquiries — until the matter is closed and, if no cooperation follows, until the correspondence is no longer needed to reply to the enquiry or present an offer.
- Account and project data — for the duration of our cooperation, then until the limitation periods for contractual claims expire.
- Settlement documents — for the period required by tax law (as a rule 5 years from the end of the year in which the tax payment deadline passed).
- Sign-in session — until you sign out or the session expires (section 6).
- IP address of a password reset request — until the next reset request or until the account is deleted.
- Server logs — for the period set by the hosting provider.
Once these periods end, we delete the data.
5. Who receives the data
We do not sell personal data. Recipients may include:
- Hosting provider — runs the server, database, files and e-mail; processes data on our behalf.
- Stripe (in the EEA: Stripe Payments Europe, Limited, Ireland) — handles online payments. When processing payments it acts on our behalf, and for some of its own purposes, e.g. fraud prevention and legal compliance (including anti-money laundering), as a separate controller. Details: stripe.com/privacy.
- Google (Google Ireland Limited) — the website loads fonts from the Google Fonts service, so your browser connects to Google's servers, which receive your IP address and technical information about your browser.
- Domain registrars and service providers — if you ask us to order a domain or hosting, to the extent needed to place the order.
- Public authorities — where required by law.
6. Cookies and browser storage
We do not use analytics or advertising cookies. The website has no analytics tools or advertising pixels. We only use mechanisms needed for the services you request — they do not require consent (Art. 399(3) of the Polish Electronic Communications Law):
| Name | Purpose | Duration |
|---|---|---|
filar.sid |
Session cookie of a signed-in panel user. Set after you sign in; sign-in does not work without it. | 12 hours from last activity |
lang |
Remembers the chosen language of the website and panel. Set when you choose the English version (or switch back from it to Polish). | 12 months |
filar.previewFit |
Browser session storage (sessionStorage): how the project preview in the panel is fitted to the screen. | Until the tab is closed |
Stripe's own rules and cookies apply on the Stripe payment page. You can delete
or block cookies in your browser settings; blocking filar.sid will
prevent you from signing in to the panel.
7. Transfers outside the EEA
Stripe and Google may transfer data to companies in their groups in the United States. The basis is the European Commission's adequacy decision (EU–US Data Privacy Framework), supplemented by standard contractual clauses.
8. Your rights
Under the conditions set out in the GDPR, you have the right to:
- access your data and receive a copy of it,
- rectify your data,
- have your data erased,
- restrict processing,
- data portability for data processed under a contract,
- object to processing based on our legitimate interest,
- lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, Poland).
To exercise these rights, write to kontakt@filarstudio.pl. We reply without undue delay, as a rule within one month.
9. Data on clients' websites
If materials provided by a client contain other people's data, or if we maintain a client's website, we process that data on behalf of the client, who is its controller. The rules are set out in our contract with the client, and the client provides information about the processing.
10. Automated decisions
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
11. Security
We use measures appropriate to the type of data, including an encrypted connection, storing passwords only as hashes, limiting sign-in attempts and restricting project data to authorised accounts. No system offers complete protection against every threat.
12. Changes to this policy
When the way we process data changes, we will update this document and the date at its top. The current version is always available at filarstudio.pl/en/polityka-prywatnosci.