This English version is provided for convenience. In the event of any discrepancy, the Polish version prevails.
The controller of personal data processed in connection with the lykta.pl website is Paweł Porowski, running a business under the name Lykta Paweł Porowski, ul. Władysława Pytlasińskiego 16/13, 00-777 Warsaw, Poland, tax ID (NIP) 9661363371, REGON 541716521 (the “Controller”).
Contact for data protection matters: biuro@lyktaofficial.eu, phone +48 502 366 305, or by post to the Controller’s address.
The Controller has not appointed a data protection officer because it is not required to do so (Article 37 GDPR).
This policy sets out how we process personal data under Regulation (EU) 2016/679 (GDPR) and how we use cookies under Article 399 of the Polish Electronic Communications Law of 12 July 2024 (PKE).
We process only the data needed for a given purpose.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering enquiries sent via the contact form, by email or by phone | name, company or institution, email, phone number, message | Article 6(1)(f) GDPR – legitimate interest in answering the enquiry and corresponding with you | until the correspondence ends, no longer than 12 months after the last message, unless a contract is concluded |
| Preparing an offer at your request, concluding and performing a contract | contact and identification data | Article 6(1)(b) GDPR; where you act on behalf of a company or institution – Article 6(1)(f) GDPR (contact regarding a contract with the entity you represent) | for the term of the contract and then until claims become time-barred |
| Invoicing, tax and accounting obligations | data on invoices and accounting records | Article 6(1)(c) GDPR in conjunction with tax and accounting laws | 5 years from the end of the calendar year in which the tax payment deadline expired |
| Establishing, exercising or defending legal claims | data needed to prove a claim | Article 6(1)(f) GDPR – legitimate interest in protecting the Controller’s rights | until claims become time-barred or proceedings are finally concluded |
| Website security (server logs) and spam protection of the form | IP address, date and time, requested URL, browser data | Article 6(1)(f) GDPR – legitimate interest in keeping the website secure | server logs: according to the hosting provider’s settings, as a rule no longer than 90 days |
| Visitor statistics (Google Analytics 4) | cookie identifiers, device data and pages visited | Article 6(1)(a) GDPR in conjunction with Article 399 PKE – consent | until consent is withdrawn; data kept in Google Analytics for 14 months |
Data in the form comes from you. If we contact you as an employee or representative of a company or institution, we may have received your data (name, position, business contact details) from that entity or from public sources, such as public information bulletins (BIP).
We do not send newsletters or marketing messages electronically without your separate consent (Article 398 PKE).
We do not sell your data or share it for marketing purposes. We entrust data only to providers who help us run the website, under data processing agreements:
Public authorities may also receive data where required by law.
Using Google Analytics and Google Workspace email may involve transferring data to Google LLC in the USA. The transfer is based on the European Commission decision of 10 July 2023 on the adequate level of protection under the EU-US Data Privacy Framework (Article 45 GDPR), under which Google LLC is certified. Otherwise, we do not transfer data outside the European Economic Area.
Under the GDPR you have the right to:
Send requests to biuro@lyktaofficial.eu. We will reply without undue delay and in any event within one month.
Providing data is voluntary. Without contact details we cannot answer your enquiry, and without data required by law we cannot conclude a contract or issue an invoice.
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
The website uses only a mechanism necessary to remember your choice and – after you consent – Google Analytics 4 cookies. We do not use advertising cookies, do not run online advertising and do not share data with data brokers.
Under Article 399 PKE, analytics scripts run only after you consent in the banner. You can accept or reject analytics with one click, and refusing does not limit access to the website.
| Category | Name | Provider | Purpose | Retention | Basis |
|---|---|---|---|---|---|
| Necessary | browser local storage entry (localStorage) | Controller | remembering your analytics choice; this information is not sent to the server | until browser data is cleared or the choice is changed | no consent required (Article 399(3) PKE) |
| Analytics | _ga | Google Ireland Limited | distinguishing browsers to count unique visitors | 2 years | consent |
| Analytics | _ga_<ID> | Google Ireland Limited | keeping session state for statistics | 2 years | consent |
We use Google Analytics 4 only to see which pages are visited and how long visits last. GA4 does not store IP addresses. We do not combine analytics data with form data and do not identify individual people. Provider’s privacy policy: https://policies.google.com/privacy.
You can withdraw consent at any time by clicking “Cookie settings” in the website footer. Google Analytics cookies will then be deleted. You can also delete or block cookies in your browser settings.
We apply technical and organisational measures appropriate to the risk, including encrypted connections (SSL/TLS), access control over correspondence and limiting the data we collect to the necessary minimum.
We update this policy when the law or the tools used on the website change. The current version is always available at lykta.pl/en/privacy-policy.html.
Last updated: 6 October 2026.