PRIVACY AND COOKIE POLICY FOR THE WOWPUZZLE.EU WEBSITE

Last updated: 15 October 2026

1. Data Controller

The data controller for the personal data of users of the wowpuzzle.eu website is Salt & Pepper Ewa Bieńkowska, ul. Mikołaja Reja 2/12, 91-745 Łódź, NIP 7262145795, REGON 101378619, hereinafter referred to as the “Data Controller”.

The Controller can be contacted via email at biuro@wowpuzzle.eu or by telephone on 604 200 688.

2. Scope of the policy

This policy explains the rules governing the processing of personal data of individuals using the wowpuzzle.eu website, contacting the Controller, and submitting enquiries and materials via the form. The policy also covers information on cookies and similar technologies.

The website does not offer a newsletter subscription service.

3. What data may be processed

The Controller may process data provided via the form or in correspondence, in particular first name and surname, company name, job title, email address, telephone number, the content of the enquiry, and information and files provided for the purpose of preparing a design or quotation, such as logos, graphic materials, descriptions of the company, products or services, and design guidelines.
The data controller may also process data relating to the use of the website, in particular the IP address, the date and time of the visit, information about the device, operating system and browser, the subpages visited, the source of the visit to the website, and identifiers stored in cookies.

Please do not submit, via the form, any special categories of data referred to in Article 9 of the GDPR, such as data concerning health, political opinions, religious or philosophical beliefs, trade union membership, genetic data or biometric data.

If the materials submitted contain personal data of other individuals, the person submitting the materials must have a legal basis for disclosing such data to the Controller.

4. Purposes, legal bases and processing periods

4.1. Handling enquiries and preparing quotations

Data is processed for the purpose of responding to enquiries, understanding the customer’s needs, preparing a concept, quotation or offer, and conducting negotiations prior to the conclusion of a contract.

If the person making the enquiry is acting on their own behalf, the legal basis is Article 6(1)(b) of the GDPR, i.e. taking steps at the request of that person prior to entering into a contract.
If the person making the enquiry is acting as an employee, contractor or representative of a company or other organisation, the legal basis is Article 6(1)(f) of the GDPR. The Controller’s legitimate interest is to conduct business communications, prepare a quotation and establish or maintain a relationship with the entity represented by that person.

Data relating to the enquiry will be retained for the time necessary to process it and conduct discussions. If no contract is concluded, the data may subsequently be stored until the expiry of the limitation period for any claims or until an objection is effectively lodged, provided that the basis for processing is a legitimate interest and there are no overriding grounds for further processing.

4.2. Conclusion and performance of a contract or order

Data is processed for the purposes of establishing the terms of cooperation, carrying out a project, fulfilling an order, liaising regarding fulfilment, delivering products, settling payments and handling complaints.

In the case of a person who is a party to the contract, the legal basis is Article 6(1)(b) of the GDPR. In the case of persons representing the customer or designated as contact persons, the legal basis is Article 6(1)(f) of the GDPR. The Controller’s legitimate interest is the proper performance of the contract and maintaining contact with the customer.
The data will be stored for the duration of the contract, and subsequently for the period required by law and until the expiry of the limitation period for claims arising from the contract.

4.3. Tax and accounting obligations

Data contained in accounting and tax records is processed for the purpose of fulfilling obligations arising from statutory provisions, pursuant to Article 6(1)(c) of the GDPR.

The data will be retained for the period required by tax and accounting regulations.

4.4. Establishing, pursuing and defending claims

Data may be processed for the purpose of establishing, pursuing or defending claims. The legal basis is Article 6(1)(f) of the GDPR. The Controller’s legitimate interest is to protect its rights and to document the course of the cooperation.

Data will be retained until the expiry of the relevant limitation period for claims or until the final conclusion of any proceedings, if such proceedings have been initiated.

4.5. Ensuring the operation and security of the website

Technical data and server logs may be processed to ensure the proper functioning of the website, detect errors, prevent misuse and ensure security. The legal basis is Article 6(1)(f) of the GDPR. The Controller’s legitimate interest is to maintain a secure and efficient website.
Data is retained for the period necessary to ensure security, analyse incidents and demonstrate the proper functioning of the website, in accordance with the retention periods applied by infrastructure providers.

4.6. Statistics and measurement of website usage

With the user’s consent, data may be processed using Google Analytics and Tilda’s statistical tools for the purposes of compiling statistics, measuring traffic, understanding how the website is used and improving its content. The legal basis for the processing of personal data is Article 6(1)(a) of the GDPR, and the storage or retrieval of information on the user’s device takes place in accordance with Article 399 of the Electronic Communications Act.

Data is processed until consent is withdrawn, the relevant cookies are deleted, or their expiry date is reached. The retention period for user and event data in Google Analytics depends on the service settings and is either 2 or 14 months. Aggregated statistical reports may be stored for longer if they do not allow for the identification of the user.

4.7. Measuring the effectiveness of adverts and online marketing activities
Data is processed until consent is withdrawn, the relevant cookies are deleted, or their expiry date is reached. Any further data retention periods by Meta are governed by Meta’s terms and service settings.

5. Voluntary provision of data

Providing data in the form is voluntary, but data marked as required is necessary for submitting and processing your enquiry. Failure to provide this data may prevent us from responding, preparing a quote or fulfilling an order.

Consent to analytical and marketing cookies is voluntary. Refusal or withdrawal of consent does not restrict access to the website’s basic functions.

6. Recipients of data

Data may be disclosed to entities supporting the Controller solely to the extent necessary for them to perform their tasks. These may include hosting and IT infrastructure providers, platforms for building and maintaining the website, providers of online forms, email services, analytics and advertising tools, an accountancy firm, entities providing legal, IT or maintenance services, manufacturers, subcontractors, courier and transport companies, and public authorities authorised to receive data by law.
If you consent to the relevant categories of cookies, data may be transferred to Google Ireland Limited in connection with the Google Analytics service and to Meta Platforms Ireland Limited in connection with the Meta Pixel service.

7. Transfer of data outside the European Economic Area

In connection with the use of Tilda, Google Analytics or Meta Pixel, data may be processed outside the European Economic Area, in particular in the United States and the United Arab Emirates.

Data transfers are carried out on the basis of the mechanisms provided for in the GDPR, in particular the European Commission’s decision recognising an adequate level of protection, standard contractual clauses approved by the European Commission, or other legally permissible safeguards. Information on the safeguards applied, or a copy thereof, may be obtained by contacting the Data Controller.

8. Rights of data subjects

A data subject has the right to request access to their data and to receive a copy thereof, to have their data rectified, to have their data erased, to restrict processing, and to data portability, provided that the basis for processing is consent or a contract and the processing is carried out by automated means.
Where data is processed on the basis of the Controller’s legitimate interest, the data subject has the right to object on grounds relating to their particular situation. Where data is processed for direct marketing purposes, an objection may be lodged at any time, without the need to provide a reason.

If the basis for processing is consent, the data subject has the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.

To exercise your rights, please contact the Data Controller at biuro@wowpuzzle.eu. Before complying with a request, the Data Controller may ask for information to verify the identity of the person making the request.

You also have the right to lodge a complaint with the President of the Office for Personal Data Protection, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, if you consider that your data is being processed unlawfully.

9. Automated decision-making and profiling

The Controller does not make decisions regarding users based solely on automated processing which would produce legal effects or similarly significantly affect them.
Once consent has been given for marketing cookies, Meta Pixel may be used to assign users to audience groups and to tailor adverts. Such activities may constitute profiling, but do not result in the Controller making decisions that have legal effects on the user or similarly significant effects.

10. Cookies and similar technologies

Cookies are small text files stored on the user’s device or read from that device whilst using the website. The website may also use similar technologies, such as tracking pixels and browser local storage.

The website uses the following categories of cookies.

10.1. Essential cookies

These are required for the website to function correctly and securely, to process forms, to remember privacy settings and to protect against misuse. They do not require consent if they are necessary to provide the service requested by the user. They may include technical and security cookies from Tilda, as well as a cookie that remembers the user’s consent to cookies.

10.2. Analytical cookies
These are used to compile statistics and analyse how the website is used. They include Google Analytics and Tilda statistics. They may include the files _ga, _ga_3DXS71263G, tildasid, tildauid and TILDAUTM. The _ga and _ga_3DXS71263G files have a default expiry period of up to 2 years. The other files remain active for the period specified in the platform’s settings or until they are deleted. Analytical cookies may only be activated once consent has been given.

10.3. Marketing cookies

These are used to measure the effectiveness of adverts, create audience groups and personalise adverts. On this website, they are used by Meta Pixel. They may include the _fbp file and other identifiers set by Meta. Marketing cookies may only be activated once consent has been given.

10.4. Third-party cookies

Once the relevant consent has been given, cookies may be set or read by Google and Meta.. Detailed information about third-party cookies, including current names and expiry dates, can be found in their privacy and cookie policies.

11. Managing consent to cookies

On your first visit, the website displays a cookie management panel. You may accept all optional cookies, reject them, or select specific categories. The ‘reject’ button should be just as easy to access as the ‘accept’ button.
Analytical and marketing cookies must not be activated before consent has been obtained. A user’s inaction, scrolling down the page or closing the notification does not constitute consent. Consent must not be inferred from pre-ticked boxes.

The user may change or withdraw their consent at any time via the ‘Cookie settings’ link available in the website footer. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal.

You may also delete or block cookies in your browser settings. Restricting essential cookies may cause certain website functions to malfunction.

12. Data security

The Data Controller implements appropriate technical and organisational measures to protect data against loss, unauthorised access, alteration or disclosure. The connection to the website is encrypted using the HTTPS protocol. Access to data is granted only to those persons and entities for whom it is necessary.

13. External links and services

The website may contain links to websites and profiles operated by other entities. Once you have navigated to an external website, your data is processed in accordance with the rules set out by that website’s operator. The Data Controller recommends that you familiarise yourself with the privacy policy of the relevant website.

14. Changes to the policy

This policy may be updated in the event of changes to the website’s operation, the tools used, or legal provisions. The current version is published on the website along with the date of the last update.
INFORMATION CLAUSE BELOW THE FORM

The data controller for your personal data is Salt & Pepper Ewa Bieńkowska, ul. Mikołaja Reja 2/12, 91-745 Łódź. We process the data provided in the form in order to handle your enquiry and prepare a quotation, pursuant to Article 6(1)(b) of the GDPR, and where you are acting on behalf of a company or organisation, pursuant to Article 6(1)(f) of the GDPR. Providing your data is voluntary, but the data marked as required is necessary for us to respond. You can find detailed information about data processing and your rights in our Privacy and Cookies Policy: https://wowpuzzle.eu/polityka-prywatnosci

If the form requires a tick box, the following text must be used. The box must not be ticked by default.

I confirm that I have read the Privacy and Cookies Policy: https://wowpuzzle.eu/polityka-prywatnosci

This box confirms that you have read the information. It does not constitute consent to data processing, as the basis for handling the enquiry is the taking of steps prior to entering into a contract or the Controller’s legitimate interest.
COOKIES BANNER TEXT

We use essential cookies to ensure the website and the form function correctly. With your consent, we also use Google Analytics and Tilda analytics cookies, as well as Meta Pixel marketing cookies. You can accept all of them, reject the optional ones, or customise your settings. You may withdraw your consent at any time. For more information, please see our Privacy and Cookies Policy: https://wowpuzzle.eu/polityka-prywatnosci

Banner buttons:

Accept all

Reject optional cookies

Cookie settings

Categories in settings:

Essential, always active

Analytical, disabled by default

Marketing, disabled by default