Privacy Policy
Last updated: 3 August 2026 · Version 2.0
Who we are
CBproject is run by CBPROJEKT spółka z ograniczoną odpowiedzialnością (CBPROJEKT sp. z o.o.), a company registered in Poland.
We are the controller of the personal data described in this policy. That means we decide why and how it is used.
— Registered office: Wschodnia 6/15, 20-015 Lublin, Poland
— KRS (National Court Register): 0001221768
— NIP (tax ID): 9462763671
— REGON (statistical ID): 543893138
— Email: contact@cbproject.org
This policy explains what happens to personal data when you visit cbproject.org or write to us through this site. It is written to meet Articles 13 and 14 of the GDPR (Regulation (EU) 2016/679) and applicable Polish law.
Data protection contact
We have not appointed a Data Protection Officer (in Polish: inspektor ochrony danych, IOD). We are not required to — we are not a public body, we do not monitor people on a large scale as a core activity, and we do not process special categories of data on a large scale (Article 37 GDPR).
For anything to do with your personal data, write to contact@cbproject.org and put “Privacy” in the subject line. A real person reads it.
What we collect, and where it comes from
We keep this deliberately small.
— Contact form. Your name, your email address, and whatever you write in the message. You give us this directly.
— Partner form. Your email address only, plus your consent. You give us this directly.
— Technical data about form submissions. Our forms provider records the IP address a submission came from and the time it was sent, and uses it to filter spam.
— Server logs. Our hosting provider automatically records requests to the site — IP address, time, page requested, browser and operating system type, referring page. We do not use these logs to build a picture of you; they exist so the site works and stays secure.
— Email. If you email us directly, we hold whatever your message contains.
We do not collect analytics data, advertising identifiers, location data, payment data, or any special category data such as health, beliefs or biometrics. We do not buy data, and we do not receive data about you from data brokers or social networks.
Why we use your data, and our legal basis
— To answer your message from the contact form. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in replying to people who contact us. If your message is about a possible contract with us, the basis is Article 6(1)(b) GDPR — steps taken at your request before entering into a contract.
— To keep you on our partner list and send you occasional updates about CBproject. Legal basis: Article 6(1)(a) GDPR — your consent, given when you tick the box on the partner form. You can withdraw it at any time (see “Your rights”). Sending the messages themselves is also covered by your consent under the Polish Electronic Communications Law (Prawo komunikacji elektronicznej).
— To run and secure the site, and to filter spam. Legal basis: Article 6(1)(f) — our legitimate interest in a site that works and is not flooded with junk.
— To keep accounting and tax records, if we end up doing business together. Legal basis: Article 6(1)(c) — our legal obligation under Polish accounting and tax law.
— To establish, exercise or defend legal claims. Legal basis: Article 6(1)(f).
Transfers outside the European Economic Area
Netlify and Automattic are based in the United States, so form submissions reach the US.
Those transfers are covered by the European Commission's adequacy decision of 10 July 2023 on the EU–U.S. Data Privacy Framework, which is in force at the date of this policy and in which Netlify participates. Where a recipient is not certified, or if that decision ceases to apply, we rely on the European Commission's Standard Contractual Clauses together with additional safeguards.
We should be straight with you: US law gives US authorities broader access to data than EU law does, and the adequacy decision is currently under appeal before the Court of Justice of the European Union. You can ask us for a copy of the safeguards we rely on at contact@cbproject.org.
How long we keep it
We keep things for as long as there is a reason to, and no longer.
— Contact form messages and email correspondence — up to 12 months from our last exchange, then deleted.
— Email addresses on the partner list — until you withdraw your consent or ask to be removed. After that we keep a minimal record of the withdrawal itself, so that we don't accidentally contact you again.
— Accounting and tax records — 5 years from the end of the calendar year in which the tax became due, because Polish law requires it.
— Data needed for legal claims — until the relevant limitation period expires.
— Server logs — for the period applied by our hosting provider, which is short and outside our direct control.
An earlier version of this policy said that all personal data is deleted after 90 days. That was not an accurate description of how we actually work, and we have corrected it.
Your rights
Under the GDPR you can ask us to:
— give you access to your data and a copy of it (Article 15);
— correct anything wrong or incomplete (Article 16);
— delete it (Article 17);
— restrict what we do with it (Article 18);
— hand it over to you or another provider in a machine-readable format, where the processing is based on consent or a contract and is automated (Article 20);
— stop processing based on legitimate interest, by objecting on grounds relating to your situation (Article 21). If you object to direct marketing, we stop, full stop.
Where we rely on consent, you can withdraw it at any time — that doesn't affect anything we did lawfully before you withdrew it.
To use any of these rights, email contact@cbproject.org. We reply within one month; if a request is unusually complex we may extend that by two further months and will tell you if so. It's free unless a request is clearly excessive or repetitive.
Complaints
If you think we're handling your data wrongly, please tell us first — we'd rather fix it.
You also have the right to complain to the Polish supervisory authority:
Prezes Urzędu Ochrony Danych Osobowych
ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland
Phone: +48 22 531 03 00 · uodo.gov.pl
If you live in another EU country, you can complain to your local data protection authority instead.
Do you have to give us your data?
No. Nothing on this site requires you to identify yourself. You can read every page without giving us anything.
If you want us to reply to you, giving a name and email address in the contact form is a practical necessity — without them we have nothing to answer. If you want to be on the partner list, giving an email address is a practical necessity for the same reason. Neither is a statutory or contractual requirement, and there is no consequence to not providing them other than that we can't get back to you.
No automated decision-making
We do not make decisions about you by automated means, and we do not profile you, within the meaning of Article 22 GDPR. Nothing on this site scores you, ranks you, or decides anything about you without a human involved.
Young people
Plenty of the people who write to us are young, and we're glad about that. We want to handle their data properly.
In Poland, the age at which a person can consent on their own to an online service processing their data is 16 (Article 8 GDPR, as applied in Poland). If you are under 16, please ask a parent or guardian before sending us your email address through the partner form, and ask them to send it on your behalf.
We do not knowingly collect data from children under 16 on the basis of their own consent. If you're a parent or guardian and think we hold data about your child that we shouldn't, email contact@cbproject.org and we will delete it.
Cookies and similar technologies
This site sets no cookies, and stores nothing on your device. No advertising cookies, no analytics cookies, no tracking pixels, no local storage. We use no analytics tool at all — not Google Analytics, not Google Tag Manager, not anything else. We run no advertising here.
It also makes no third-party requests. Fonts, scripts and every other asset are served from cbproject.org itself, so no outside company learns your IP address, browser or operating system just because you opened a page.
Under Article 399 of the Polish Electronic Communications Law (ustawa z dnia 12 lipca 2024 r. — Prawo komunikacji elektronicznej), which replaced Article 173 of the old Telecommunications Law, consent is required to store information on your device or read information already stored there. We do neither, which is why you see no cookie banner on this site: there is nothing here that would need one.
Changes to this policy, and which language counts
We'll update this policy when what we do changes, or when the law does. The version and date at the top tell you which one you're reading, and we keep the previous version available on request.
This policy is published in English, German, French, Spanish, Polish, Russian and Chinese. Because CBPROJEKT sp. z o.o. is established in Poland and supervised by the Polish data protection authority, the Polish-language version is the legally authoritative one. The other versions are provided for convenience. If there's a discrepancy, the Polish version prevails — but that never limits any right you have under the GDPR or under the mandatory law of your own country of residence.
See also our Terms of Service.
Questions: contact@cbproject.org