Skip to content
IBWRna jutro

Privacy policy

Version 1.4 z 21.10.2026

This is an English translation provided for convenience. The binding version is the Polish version.

1. Who is the data controller

The controller of your personal data is Maciej Grzeszczak, resident in Wrocław, an entrepreneur trading as ApexLink Maciej Grzeszczak, address for service: ul. Księcia Witolda 49 lok. 15, 50-202 Wrocław, Poland, tax ID (NIP) 8952304898, REGON 544941744. Contact on data matters: kontakt@ibwrnajutro.pl.

2. What data, why and on what legal basis

Waiting list

We collect: your email address, company name (if you give it), type of works, number of IBWR per year and when you need your next IBWR (if you give them), the chosen plan, interest in the partner programme, your question or comment, the source and campaign tags from the address of the page where the form was sent (for example "Google Ads"), the sign-up date, the version of the consent text, the language of the form and whether you confirmed your sign-up. The source and campaign are read by our server from the page address that your browser attaches to the submitted form (the Referer header).

  • Sending the email asking you to confirm your sign-up, the launch announcement and the launch offer - based on your consent (Article 6(1)(a) GDPR). Consent to commercial information sent by email is also required by Article 398 of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej).
  • An aggregate assessment of interest in the service (how many sign-ups, from which sources, for which works, how urgent) - our legitimate interest, namely deciding whether to open sales (Article 6(1)(f) GDPR).
  • Proving that you gave consent (date and version of the consent text) - our legitimate interest (Article 6(1)(f) GDPR).

Survey after you confirm your sign-up

If you choose to answer, we store your answers (who prepares your IBWR, how long it takes and what it costs, whether the general contractor requires its own template, which contractors you work with and what comments they make) with your waiting list sign-up. Purpose: adapting the document and the offer to companies' needs - our legitimate interest (Article 6(1)(f) GDPR). The answers are optional.

Correspondence

When you write to us, we process the data in your message to reply and handle the matter - our legitimate interest (Article 6(1)(f) GDPR). Copies of messages sent to addresses in the ibwrnajutro.pl domain are also automatically forwarded to the controller's Gmail mailbox (details in point 3).

Protection against abuse

To limit the number of sign-ups, panel logins from one internet address, we store a hash of the IP address calculated with a secret key and the date. We do not store the IP address itself; without the key it cannot be read from the hash, and hashes from different days do not match each other. We delete the hashes after 3 days at the latest. Legal basis: our legitimate interest, namely the security of the site (Article 6(1)(f) GDPR). The hosting servers also process IP addresses technically in order to deliver the site and protect it against attacks.

Visit counter

When you open a page, our server (Netlify hosting) counts the visit: it stores the date and time, the name of the page and a general source of the visit (for example "Google Ads", "Google search", "direct"). It determines the source from the address of the page you open and the address of the page you came from (the Referer header), which your browser sends anyway to fetch the page. When you move between our own pages, the counter stores only the pair "from which page - to which page" (for example "home page - pricing"), so that we know which parts of the site are read. We do not store your IP address, browser details, cookies or any device identifier, and the counter does not run anything in your browser. Such a counter cannot tell who you are or link visits by the same person. If your browser sends a "do not track" signal (Global Privacy Control or Do Not Track), we do not count the visit.

3. Where the data is and who has access to it

We store the data from the forms in a data centre in Frankfurt (European Union). Only the controller has access to it, through a password-protected panel. The data is processed on our behalf by service providers with whom we have data processing agreements, or whose terms contain such provisions:

  • Netlify, Inc. (USA) - website hosting, form handling, the visit counter and data storage in a store in Frankfurt (European Union). Traffic handling and some site functions may take place on servers in the USA.
  • OVH Sp. z o.o., Wrocław, Poland (OVHcloud, Zimbra mail) - email in the ibwrnajutro.pl domain: sending and receiving messages.
  • Resend, Inc. (USA) - automatic emails sent by the site: the sign-up confirmation link, the launch information. The provider keeps the content and log of sent messages for 30 days on servers in the USA. We do not track opens or clicks in emails.

Email copies in Gmail. We automatically forward copies of messages sent to addresses in the ibwrnajutro.pl domain (for example kontakt@ibwrnajutro.pl) to the controller's Gmail mailbox, so that we can reply faster. The service is provided by Google Ireland Limited (Ireland) on its own terms, and data may also be processed by Google LLC in the USA. Legal basis: our legitimate interest, namely handling correspondence efficiently (Article 6(1)(f) GDPR). You can object (point 5) - we will then delete copies of your messages from Gmail and stop forwarding them there. The originals remain in the mailbox of our email provider. The forms on this site do not send any data to Gmail.

Netlify, Inc., Resend, Inc. (USA) and Google LLC participate in the EU-U.S. Data Privacy Framework (as of 21 October 2026), so transfers of data to the USA are based on European Commission adequacy decision (EU) 2023/1795 (Article 45 GDPR). The processing of data on our behalf by Netlify and by the email delivery provider is governed by those providers' data processing agreements (DPA). If a US provider does not participate in this framework, we use standard contractual clauses approved by the Commission (Article 46(2)(c) GDPR). We do not sell data or pass it to other companies for their own marketing.

4. How long we keep data

  • Waiting list and survey answers: until you withdraw consent or unsubscribe, and no later than 6 months after sales open. We delete an unconfirmed sign-up after 30 days. If sales do not open, we will delete the data by 31 March 2027 at the latest.
  • Correspondence: up to 12 months after the matter is closed, including the copies in Gmail.
  • Content and log of automatically sent emails at the email delivery provider: 30 days.
  • IP address hashes for limits: 3 days at the latest.
  • Backup copies of form data (a file on the controller's computer): up to 5 weeks, then we delete them.
  • The visit counter does not contain personal data.

5. Your rights

You have the right to access your data, to have it rectified or erased, to restrict its processing and to data portability. You can withdraw your consent at any time: using the "unsubscribe" link in a message or by email to kontakt@ibwrnajutro.pl. Withdrawing consent does not affect the lawfulness of processing before the withdrawal. You can also lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland).

Right to object. At any time you can object to the processing of your data based on our legitimate interest (Article 21 GDPR) - for example to the use of your survey answers or to copies of your messages in Gmail. An email to kontakt@ibwrnajutro.pl is enough.

6. Do you have to provide data

Providing data is voluntary. To sign up for the list we need: your email address, the type of works, the choice of plan (which can be "Not sure yet") and your consent to messages - without them we cannot accept your sign-up or send you the launch information. You can leave the other fields empty.

7. Automated decisions

We do not make decisions about you based solely on automated processing that produce legal effects, and we do not profile you.

8. Cookies, browser storage and scripts

This site does not store cookies or any other data (such as localStorage) in your browser and does not embed scripts from Google, Facebook or other companies. Our own script only handles the sign-up form: it checks the fields and sends them without reloading the page (the form also works without JavaScript). The script does not read where you came from and sends nothing on its own. The visit counter runs on the server (point 2). Cookies are set only by the admin panel, solely on the site owner's device after logging in: a technical session cookie and a cookie that stops the owner's own visits from being counted.

9. Security

The site works only over an encrypted connection (HTTPS). The admin panel requires a password and limits failed login attempts. We never ask for passwords in messages, and we do not ask for payment before sales open.

10. Changes to this policy

When we change the policy, we will publish the new version on this page with a new number and date.