Privacy Policy

Privacy and Cookie Policy of the ghcombat.pl website

Last updated: 23 August 2026

1. General information

This Privacy Policy sets out the rules governing the processing of personal data of users of the website available at ghcombat.pl, hereinafter referred to as the Website, as well as the rules governing the use of cookies and similar technologies.

This Policy has been prepared taking into account Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, hereinafter referred to as the GDPR, the Polish Act of 10 May 2018 on the Protection of Personal Data, and the Polish Electronic Communications Law Act of 12 July 2024.

2. Personal data controller

The controller of the personal data of Website users is:

Geyer & Hosaja Sp. z o.o.

address: Partynia 12, 39-310 Radomyśl Wielki, Poland,
email address: gh_partynia@geyer-hosaja.com.pl.

For all matters concerning the processing of personal data, the exercise of rights under the GDPR, and the use of cookies, the Controller may be contacted by email at gh_partynia@geyer-hosaja.com.pl or by post at the address of the Controller’s registered office.

3. Scope of data processed

Depending on how the Website is used, the Controller may process the following categories of data:

first name and surname,
email address,
telephone number,
the content of the message and other information voluntarily provided in the form,
IP address,
online identifiers and cookie identifiers,
information about the device, browser and operating system,
information about how the Website is used, the pages visited and actions performed,
information about the source of the visit and interactions with advertisements,
information concerning consents granted, refused or withdrawn.

The Controller does not require special categories of personal data referred to in Article 9 of the GDPR to be submitted through the form. Users should not include such data in a message unless it is necessary for handling the enquiry.

4. Contact form

The contact form enables users to provide their first name and surname, email address, telephone number and the content of their message.

Data provided in the form is processed for the purposes of:

receiving and handling the enquiry,
responding and conducting correspondence related to the enquiry,
preparing and presenting an offer,
taking steps at the user’s request prior to entering into a contract,
establishing or carrying out cooperation,
establishing, pursuing or defending legal claims.

The legal basis for processing is Article 6(1)(b) of the GDPR where the enquiry concerns taking steps prior to entering into a contract or the performance of a contract, and Article 6(1)(f) of the GDPR, namely the Controller’s legitimate interest in handling correspondence, responding to enquiries, providing information about the Controller’s activities and protecting itself against legal claims.

Providing data is voluntary, but providing the data marked as required is necessary to submit the form and have the enquiry handled. Failure to provide the required data will make it impossible to submit the form.

Data submitted through the form is not stored in the WordPress database. The message is sent to the appropriate email inbox operated by the Controller. The form does not allow attachments to be sent.

Confirmation that the Privacy Policy has been read does not constitute consent to direct marketing or an independent legal basis for handling the enquiry.

5. Retention period for data submitted through the form

Data submitted through the form is retained for the period necessary to handle the enquiry, prepare an offer and conduct the related correspondence.

If the contact results in the conclusion of a contract or the establishment of cooperation, the data may be retained for the duration of the contract, for the fulfilment of legal obligations incumbent on the Controller, and until the expiry of the limitation period for related claims.

If the enquiry does not result in the conclusion of a contract, the correspondence may be retained until the matter has been closed and subsequently for a period justified by the need to demonstrate the course of the contact and to establish, pursue or defend legal claims.

The data will be deleted earlier if it is no longer required and the Controller has no other legal basis for its continued processing.

6. Confidentiality of information submitted through the form

Commercial, organisational and technical information submitted to the Controller through the form may be confidential.

The Controller undertakes to protect the information received and to use it solely for the purposes of analysing the enquiry, conducting related correspondence, preparing an offer, taking steps prior to entering into a contract, or establishing and carrying out cooperation.

Access to the information may be granted solely to employees, associates, advisers and entities providing services to the Controller for whom such access is necessary to handle the enquiry. These persons and entities should be bound by an obligation of confidentiality arising from a contract, authorisation or provisions of law.

The obligation of confidentiality does not apply to information that:

was publicly available at the time it was disclosed or subsequently became publicly available without a breach of the confidentiality obligation by the Controller,
was lawfully known to the Controller before it was received,
was lawfully obtained from a third party that was not under an obligation to keep it confidential,
was independently developed by the Controller without using information submitted by the user,
must be disclosed pursuant to applicable law, a final court judgment or a binding request from a competent authority.

The Controller applies appropriate organisational and technical measures to protect the information received against unauthorised access, disclosure, loss or use inconsistent with the purpose for which it was submitted.

These provisions constitute the Controller’s confidentiality undertaking. They do not replace a separate non-disclosure agreement (NDA) if, due to the nature of the planned cooperation, the parties agree detailed terms for the protection of information.

7. Technical data and Website security

When the Website is used, technical data may be processed automatically, including the IP address, date and time of connection, address of the requested resource, information about the device, browser and operating system, and error information.

This data is processed to ensure the proper and secure operation of the Website, diagnose errors, detect misuse and perform essential technical administration.

The legal basis for processing is Article 6(1)(f) of the GDPR, namely the Controller’s legitimate interest in ensuring the operation and security of the Website and protecting it against misuse.

Technical data is retained for the period resulting from the server configuration and justified by the need to ensure security, and for longer only where necessary to investigate an incident or pursue legal claims.

8. Google Tag Manager and Google Analytics 4

The Website uses Google Tag Manager, a tool provided by Google Ireland Limited for the technical management of Google Analytics 4 and Google Ads tags.

Google Tag Manager does not constitute a separate purpose of data processing. The scope of processing depends on the tags activated through it. Optional analytics and advertising tags are activated only after the appropriate consent has been obtained from the user.

Once analytics consent has been granted, the Website uses Google Analytics 4, a service that enables the analysis of:

the number of users and visits to the Website,
the pages visited and the duration and manner of using the Website,
the source of access to the Website,
the type of device, browser and operating system,
the user’s approximate location,
actions performed on the Website,
the effectiveness of the Website and promotional activities conducted.

The legal basis for using Google Analytics 4 and the associated optional technologies is the user’s consent, pursuant to Article 6(1)(a) of the GDPR and the provisions of the Polish Electronic Communications Law.

The retention period for user-level and event-level data in Google Analytics 4 has been set to 14 months. This setting may not apply to standard aggregated reports in which data is not presented at the level of a specific user.

Google Analytics 4 is linked to a Google Ads account. The Controller does not use the User-ID feature on the Website.

9. Google Signals and audiences

Google Signals is enabled within Google Analytics 4. If a user is signed in to a Google account and has enabled the relevant personalisation settings, Google may combine information about the user’s activity across different devices and services.

This feature may enable the creation of aggregated reports concerning, among other things, users’ cross-device activity, interests and demographic data. In this regard, the Controller primarily receives aggregated information.

Audiences may be created in Google Analytics 4 based on the pages visited, actions performed and manner of using the Website. Google Analytics 4 is linked to Google Ads; however, the Controller does not use audiences for remarketing.

Google Signals and audience-related features are activated after the appropriate consent has been obtained from the user. The legal basis for processing is Article 6(1)(a) of the GDPR.

10. Google Ads and enhanced conversions

The Website uses Google Ads to run advertising campaigns in Google Search and measure their effectiveness. The Controller does not use Google Ads for remarketing.

Once advertising consent has been granted, Google Ads tools may record whether the user performed a specified action after clicking an advertisement, for example submitting the contact form.

The Website also uses the Google Ads enhanced conversions feature. Once the appropriate consent has been granted, the email address and telephone number entered in the form may be collected from its fields by a properly configured Google Tag Manager tag.

The data is normalised and transformed using a one-way hashing algorithm before being sent to Google. It may then be compared with appropriately secured data relating to Google Account users in order to attribute conversions to an advertising campaign more accurately.

The email address and telephone number are transmitted as part of enhanced conversions. The user’s first name, surname and message content are not transmitted by the Controller as part of this feature.

The legal basis for processing data for conversion measurement and enhanced conversions is the user’s consent, pursuant to Article 6(1)(a) of the GDPR and the provisions of the Polish Electronic Communications Law.

Refusing or withdrawing advertising consent does not affect the ability to submit the form and receive a response. In such a case, the data provided in the form is used solely to handle the enquiry in accordance with the rules described in this Policy.

Hashing is a technical safeguard, but it does not mean that data used for enhanced conversions ceases to be subject to personal data protection laws.

11. Google Search Console

The Controller uses Google Search Console to monitor the Website’s visibility in Google search results, check indexing, diagnose technical errors and analyse queries leading to the Website.

Google Search Console primarily provides the Controller with aggregated information concerning the Website’s performance in Google Search. The Controller’s use of this tool does not itself cause additional Google Search Console cookies to be placed in the user’s browser.

The legal basis for using this information is Article 6(1)(f) of the GDPR, namely the Controller’s legitimate interest in monitoring the visibility, availability and technical operation of the Website.

12. CookieYes, Consent Mode v2 and cookies

The Website uses the CookieYes platform to manage consent to the use of cookies and similar technologies.

During the first visit, the user may accept all optional cookies, reject them or customise the selection according to the available categories. Optional technologies are activated only after the appropriate consent has been obtained.

The Website also uses Google Consent Mode v2, which communicates to Google services information about the user’s decisions concerning:

analytics_storage, meaning the storage of information used for analytics purposes,
ad_storage, meaning the storage of information used for advertising purposes,
ad_user_data, meaning the transmission of user data to Google for advertising purposes,
ad_personalization, meaning ad personalisation.

The Website may use the following categories of cookies:

necessary – required to ensure the basic operation and security of the Website and to remember consent preferences,
analytics – used to measure traffic and analyse how the Website is used through Google Analytics 4,
advertising – used to measure the effectiveness of Google Ads campaigns and record conversions,
personalisation – related to Google Signals features and Google service settings.

Necessary cookies may be used without separate consent where they are required to provide a service requested by the user, ensure security or remember consent settings.

Optional analytics, advertising and personalisation cookies are used on the basis of the user’s consent.

CookieYes may store a necessary cookie containing the user’s preferences so that the user’s decision is respected during subsequent visits.

The user may reopen the cookie settings and change or withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

An up-to-date list of cookies, their providers, purposes and duration is available in the detailed CookieYes settings displayed on the Website.

13. Recipients of data

Personal data may be disclosed to entities supporting the Controller in conducting its business and operating the Website, in particular:

hosting and server infrastructure providers,
email service providers,
entities providing technical maintenance, administration and security of the Website,
IT service providers,
Google Ireland Limited in connection with the use of Google Analytics 4, Google Signals, Google Tag Manager, Google Ads and Google Search Console,
the provider of the CookieYes consent management platform,
entities supporting the Controller’s analytics and advertising activities,
legal, tax and business advisers and insurers, where access to the data is necessary to provide services or protect against legal claims,
public authorities, courts and other authorised entities where the obligation to disclose data arises from law.

Entities processing data on behalf of the Controller should act under appropriate agreements, in accordance with the Controller’s instructions and using the required safeguards.

14. Transfers of data outside the European Economic Area

The use of services provided by Google and other technology providers may involve access to data from, or the transfer of data to, countries outside the European Economic Area, in particular the United States.

Data is transferred using mechanisms provided for under the GDPR, depending on the provider and the circumstances of the transfer, in particular on the basis of a European Commission adequacy decision or standard contractual clauses approved by the European Commission, together with supplementary safeguards where required.

Information about the transfer mechanisms and data protection rules applied may be obtained by contacting the Controller.

15. Rights of data subjects

Subject to the conditions laid down in the GDPR, a data subject may have the right to:

access their data and receive a copy of it,
rectify inaccurate data or complete incomplete data,
have their data erased,
restrict processing,
data portability where processing is based on consent or a contract and is carried out by automated means,
object to processing based on the Controller’s legitimate interest,
withdraw consent at any time where processing is based on consent,
lodge a complaint with the President of the Polish Personal Data Protection Office.

Where data is processed on the basis of the Controller’s legitimate interest, the data subject may object on grounds relating to their particular situation. The Controller will cease processing unless it demonstrates compelling legitimate grounds for continued processing or grounds for the establishment, pursuit or defence of legal claims.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Requests concerning the exercise of rights may be sent by email to gh_partynia@geyer-hosaja.com.pl or by post to the address of the Controller’s registered office.

16. Complaint to the supervisory authority

If a user believes that their personal data is being processed contrary to applicable law, they have the right to lodge a complaint with:

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych)

ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland.

17. Profiling and automated decision-making

In connection with the use of Google Analytics 4, Google Signals, audiences and Google Ads, data may be used to analyse user activity, assign users to specific groups and measure advertising effectiveness.

These activities may constitute profiling within the meaning of the GDPR. However, the Controller does not make decisions concerning users based solely on automated processing that produce legal effects concerning them or similarly significantly affect them.

18. Data security

The Controller applies appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, alteration, damage or disclosure.

Access to the data is limited to authorised persons and entities whose access is necessary to perform specified tasks or services.

19. Changes to the Privacy Policy

The Privacy Policy may be updated in the event of changes to the law, the operation of the Website, the tools used, the scope of data processing or service providers.

The current version of the Privacy Policy is published on the Website together with the date of its latest update.