Polish version
Call: +48 507 160 901
MENU

Privacy policy

Last updated: 6 November 2026

§ 1. General information and data controller

  1. This Privacy Policy sets out the rules for processing personal data and for using cookies and similar technologies in connection with the use of the website https://iguanastudio.pl/, hereinafter the “Website”.
  2. The controller of personal data is Iguana sp. z o.o., with its registered office in Poznań, ul. Głogowska 261, 60-104 Poznań, Poland, VAT ID: PL7792448150, entered in the register of entrepreneurs of the National Court Register (KRS) under number 0000642441, hereinafter the “Controller”.
  3. In matters relating to the protection of personal data, the Controller can be contacted at: biuro@iguanastudio.pl.
  4. As a rule, using the Website does not require providing personal data. Providing data may, however, be necessary when using the contact form or the quotation form, or when contacting the Controller by e-mail or telephone.
  5. The Controller applies appropriate technical and organisational measures to protect data against unauthorised access, loss, alteration, destruction or unlawful use.

§ 2. Scope and purposes of data processing

  1. In connection with contact made via the Website, the Controller may process in particular:
    • first name and surname,
    • e-mail address,
    • telephone number,
    • company name, if provided,
    • the content of the enquiry or message,
    • website addresses provided in the form,
    • information contained in attachments sent,
    • the answer to the question of how the user heard about the Controller, if given,
    • other data provided voluntarily by the user in the course of contact.
  2. Data provided in connection with an enquiry are processed in order to:
    • respond to the enquiry,
    • prepare a quotation or offer,
    • conduct correspondence concerning a project or cooperation,
    • take steps prior to entering into a contract at the request of the person contacting the Controller,
    • perform the contract, if one is concluded,
    • establish, pursue or defend against possible claims.
  3. Depending on the purpose, the legal basis for processing is:
    • Article 6(1)(b) GDPR – taking steps at the request of the data subject prior to entering into a contract, and performance of a contract,
    • Article 6(1)(f) GDPR – the Controller’s legitimate interest in conducting communication, responding, handling enquiries, ensuring the security of the Website, establishing, pursuing or defending claims, keeping aggregate statistics of the Website and measuring the effectiveness of the Website and advertising,
    • Article 6(1)(c) GDPR – compliance with legal obligations of the Controller, if such obligations arise in connection with a concluded contract or the business conducted,
    • Article 6(1)(a) GDPR – the user’s consent, where processing for a specific purpose requires consent.
  4. Providing data in the form is voluntary; however, failure to provide data marked as required may make it impossible to send the form, prepare an offer or respond.
  5. The Controller may also process technical data related to the use of the Website, in particular the IP address, information about the device, operating system, web browser, time of use of the Website, subpages visited by the user and events related to the use of the Website.
  6. Technical data may be processed in order to ensure security, diagnose technical problems, protect against abuse, administer the Website, keep aggregate visit statistics and measure advertising effectiveness without the use of cookies and, after obtaining the required consent, for analyses using cookies and similar technologies and for marketing activities.
  7. The Controller attaches the following information about the visit to each enquiry sent via the form: the IP address, the type of device (computer, tablet or phone), the subpage from which the form was sent, the status of consent to analytics and advertising cookies at the time the form was sent and – if available – the source of the visit (e.g. a search engine, a Google Ads advertisement, the Google Business Profile or another website), campaign parameters and click identifiers contained in the page address, as well as the landing subpage and the time of entering the Website. Until the form is sent, information about the source of the visit may be stored in a strictly necessary session cookie of the Website. The Controller uses this information solely for its own purposes: handling the enquiry, protecting against abuse and assessing the effectiveness of the Website and advertising; it is not transferred to Google. To determine the sender’s approximate location (e.g. city), the Controller may check the IP address in a publicly available geolocation service. The legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) GDPR).

§ 3. Data retention period

  1. Data relating to a request for quotation or contact are stored for the period necessary to handle the enquiry and conduct correspondence.
  2. If the contact leads to the conclusion of a contract, data may be stored for the duration of the contract, and thereafter for the period required by law and the period necessary to establish, pursue or defend possible claims.
  3. Data processed on the basis of the Controller’s legitimate interest are stored until that interest ceases or until an objection is effectively raised, unless further storage is necessary for other lawful reasons.
  4. Data processed on the basis of consent are processed until consent is withdrawn, unless there is another legal basis for further processing.
  5. The lifetime of individual cookies depends on the type of cookie and its purpose and can be checked in the CookieYes consent management panel available on the Website.

§ 4. Recipients of data

  1. Data may be transferred to entities supporting the Controller in running the Website and its business, solely to the extent necessary for those entities to provide their services.
  2. Recipients of data may include in particular:
    • providers of hosting services and server infrastructure,
    • providers of e-mail and communication services,
    • providers of IT, maintenance and security services,
    • providers of cloud services,
    • providers of analytics and advertising tools,
    • providers of cookie consent management tools,
    • entities providing accounting, legal or advisory services, where necessary,
    • providers of analytics tools or tools using artificial intelligence, if they are used by the Controller to perform a specific function and only to the extent necessary to perform it.
  3. Entities processing data on behalf of the Controller are obliged to secure the data appropriately and to process it in accordance with applicable law and the contracts concluded.

§ 5. Transfer of data outside the European Economic Area

  1. Because the Controller uses the services of global technology providers, in particular Google, Microsoft and Ahrefs, certain data may be processed outside the European Economic Area, including in the United States and Singapore.
  2. Where data are transferred to a third country, the Controller applies appropriate mechanisms provided for by the GDPR, in particular a European Commission decision finding an adequate level of data protection, standard contractual clauses or other legally permitted safeguards.
  3. Google LLC and Microsoft Corporation are certified under the EU-U.S. Data Privacy Framework. By Implementing Decision (EU) 2023/1795 of 10 July 2023, the European Commission found an adequate level of protection for data transferred to organisations certified under that framework.

§ 6. Cookies and similar technologies

  1. The Website uses cookies and similar technologies to store or read information on the user’s device.
  2. The Website may use the following categories of cookies:
    • Necessary – required for the proper and secure functioning of the Website.
    • Functional – enable the use of additional features of the Website, where available.
    • Analytics – help understand how users use the Website and enable analysis of its effectiveness.
    • Advertising – used to measure the effectiveness of Google Ads campaigns, e.g. to check whether a form submission or a click on the telephone number followed a click on an advertisement, and to create audience lists to which Google Ads advertisements may later be shown (remarketing).
  3. The Controller uses the CookieYes platform to manage consent to cookies and similar technologies.
  4. Cookies other than necessary cookies are activated after obtaining the user’s appropriate consent, where consent is required by applicable law.
  5. The user may change or withdraw their consent at any time via the CookieYes consent management panel available on the Website. Withdrawal of consent does not affect the lawfulness of actions taken before its withdrawal.
  6. Necessary cookies may be used without the user’s consent if their use is necessary for the transmission of an electronic communication or for providing a service requested by the user.
  7. Depending on the user’s settings and the consents given, the Website may use in particular the following tools:
    • Google Analytics 4,
    • Google Ads,
    • Google Tag Manager,
    • Google Maps, if a map or other elements of this service are embedded on the Website,
    • Microsoft Clarity,
    • Ahrefs Web Analytics (a statistics tool that does not use cookies and also works without consent).
  8. Google tools may collect information about how the Website is used, the device, approximate location, the source of the visit and actions performed, in accordance with the user’s consent settings and Google’s policies. More information can be found in the Google Privacy Policy.
  9. The Website uses Google Consent Mode v2. Until the user gives consent, the Google Analytics 4 and Google Ads tags do not store or read cookies. They may, however, send Google basic technical information without identifiers stored in cookies, e.g. the time of the visit, the address of the subpage visited, browser information and consent status; in doing so, Google receives the IP address. Google uses this information in aggregate form to model statistics and conversions. The legal basis for processing is the Controller’s legitimate interest in measuring the effectiveness of the Website and advertising (Article 6(1)(f) GDPR).
  10. If the user has consented to advertising cookies and submits a form, the e-mail address and telephone number entered in the form are sent to Google as a cryptographic hash (SHA-256), created in the browser before sending, as part of the Google Ads enhanced conversions feature. Google uses them to match the form submission with the Google accounts the user was signed in to when interacting with an advertisement, and for aggregate conversion reporting; Google does not provide the Controller with data that would identify the user. The legal basis for processing is the user’s consent (Article 6(1)(a) GDPR), which can be changed or withdrawn at any time in the CookieYes consent management panel available on the Website.
  11. Microsoft Clarity is an analytics tool provided by Microsoft Corporation (USA) that is activated only after consent to analytics cookies has been given. It records how the Website is used, in particular clicks, cursor movements and scrolling. On this basis, statistics, heatmaps (e.g. of clicks and scrolling) and session recordings – i.e. replays of the course of a visit – are created. The Controller uses these data to improve the Website and its offer, for security purposes and to assess the effectiveness of marketing activities. Clarity uses first-party and third-party cookies (including _clck, _clsk, MUID). Microsoft may also use the collected data for its own purposes, including advertising (Microsoft Advertising), and to that extent acts as a separate controller. The legal basis for processing is the user’s consent (Article 6(1)(a) GDPR), which can be changed or withdrawn at any time in the CookieYes panel. Session recordings are stored for 30 days, and click data, heatmaps and sessions marked by the Controller for 9 months. More information can be found in the Microsoft Privacy Statement.
  12. Ahrefs Web Analytics (provider: Ahrefs Pte. Ltd., Singapore) is used to keep aggregate statistics of visits to the Website, such as the number of page views, traffic sources, country and device type. The tool does not store cookies on the user’s device. The provider receives technical connection data (including the IP address and browser information) which, according to its declaration, it does not use to identify users. The legal basis for processing is the Controller’s legitimate interest in keeping statistics of the Website (Article 6(1)(f) GDPR). More information can be found in the Ahrefs Privacy Policy.
  13. If the user consents to advertising cookies, Google may process information about their activity on the Website (via Google Analytics 4 and Google Ads) in order to measure the effectiveness of Google Ads advertisements and to add the user to audience lists that may be used in Google Ads remarketing campaigns.
  14. The Controller does not make decisions about users based solely on automated processing that would produce legal effects concerning them or similarly significantly affect them.

§ 7. Iguana Studio Profile Manager and Google Business Profile

  1. The Controller uses an internal application, Iguana Studio Profile Manager, to monitor, analyse and manage the Iguana Studio profile on Google Business Profile.
  2. The application accesses Google data using the Google OAuth 2.0 mechanism, which requires authorisation by a user holding the appropriate permissions for the business profile.
  3. Iguana Studio Profile Manager may access in particular:
    • data and settings of the Iguana Studio profile on Google Business Profile,
    • information about the location and services,
    • statistics of views of and interactions with the profile,
    • search queries leading to the profile,
    • reviews and replies to reviews,
    • posts and other content related to the profile,
    • other information made available to the application via the Google Business Profile API within the scope of access granted.
  4. Data obtained from Google are used solely to:
    • manage the Iguana Studio profile,
    • monitor the visibility and performance of the profile,
    • analyse the effectiveness of activities,
    • monitor reviews and posts,
    • prepare internal analyses and recommendations,
    • perform other functions of Iguana Studio Profile Manager presented to the user.
  5. To the extent that data obtained from Google constitute personal data, the legal basis for processing them may be Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in managing its own business profile, handling reviews, monitoring its effectiveness and conducting business analyses.
  6. Data obtained via the Google API are not sold, shared with data brokers or used to create advertising profiles unrelated to the functioning of the application.
  7. Data may be processed by providers of cloud services, analytics services or tools using artificial intelligence solely to the extent necessary for Iguana Studio Profile Manager to operate and to prepare analyses or recommendations for Iguana Studio.
  8. Data received via the Google API are not used by the Controller to create, train or improve general artificial intelligence models.
  9. Authentication data and OAuth tokens enabling access to Google Business Profile are stored in secured Google Cloud infrastructure, including with the use of Google Cloud Secret Manager.
  10. Access to the data is limited to authorised persons and systems for which access is necessary to perform the application’s functions.
  11. The user may revoke the application’s access to their Google account at any time in the Google account settings. The Controller may also delete the stored authentication data and terminate the integration.
  12. The Controller uses information received from Google APIs in accordance with the Google API Services User Data Policy, including the Limited Use requirements.
  13. More information about how the application works is available on the Iguana Studio Profile Manager page (in Polish) and in the Iguana Studio Profile Manager Terms of Use (in Polish).

§ 8. Rights of data subjects

  1. In the cases provided for by the GDPR, the data subject has:
    • the right of access to data,
    • the right to obtain a copy of data,
    • the right to rectification of data,
    • the right to erasure of data,
    • the right to restriction of processing,
    • the right to data portability,
    • the right to object to the processing of data,
    • the right to withdraw consent at any time, where processing is based on consent.
  2. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
  3. To exercise these rights, the Controller can be contacted at biuro@iguanastudio.pl.
  4. The data subject also has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) if they consider that the processing of their personal data infringes applicable law. Information about the supervisory authority is available at https://uodo.gov.pl/.

§ 9. Data security

  1. The Controller implements technical and organisational measures appropriate to the nature of the data and the risk associated with their processing.
  2. The safeguards applied may include in particular encryption of transmission, access control, restriction of permissions, authentication mechanisms, backups and protection of the IT infrastructure.
  3. Access to personal data is limited to persons or systems for which it is necessary to perform the tasks entrusted to them.

§ 10. Links to external websites

  1. The Website may contain links to websites operated by other entities.
  2. After moving to an external website, the privacy rules set by its operator apply. The Controller recommends reading the privacy policy of the given website.

§ 11. Changes to the Privacy Policy

  1. The Privacy Policy may be updated in particular in the event of changes to legislation, to the way the Website operates, to the technologies used, to external services or to Iguana Studio Profile Manager.
  2. The current version of the Privacy Policy is always available on this page.
  3. In the event of a material change in the way data obtained via the Google API are used, users authorised to use Iguana Studio Profile Manager will be informed accordingly and, where required, the application will ask again for the appropriate consent.

§ 12. Contact

If you have any questions about this Privacy Policy or about how personal data are processed, please contact us:

Iguana sp. z o.o.
ul. Głogowska 261
60-104 Poznań, Poland
e-mail: biuro@iguanastudio.pl
website: https://iguanastudio.pl/

Fill in a short form - you’ll get a free pricing

Quick valuation / Estimate project
Step 1 of 2
What can we help you with?
3D product configurator
Web application (Laravel & Vue.js)
B2B or customer portal
White-label development for agencies
Startup MVP or UX/UI design
Company or multilingual website
Online shop
Other
Next
Step 2 of 2
Contact details
3D product configurator
Add another example
E.g. specification, guidelines, description.
Up to 5 files: jpg, jpeg, png, gif, pdf, doc, docx, ppt, pptx, xls, xlsx, odt, zip or rar, max 5 MB each.
Web application (Laravel & Vue.js)
Add another example
E.g. specification, guidelines, description.
Up to 5 files: jpg, jpeg, png, gif, pdf, doc, docx, ppt, pptx, xls, xlsx, odt, zip or rar, max 5 MB each.
B2B or customer portal
Add another example
E.g. specification, guidelines, description.
Up to 5 files: jpg, jpeg, png, gif, pdf, doc, docx, ppt, pptx, xls, xlsx, odt, zip or rar, max 5 MB each.
White-label development for agencies
Add another example
E.g. specification, guidelines, description.
Up to 5 files: jpg, jpeg, png, gif, pdf, doc, docx, ppt, pptx, xls, xlsx, odt, zip or rar, max 5 MB each.
Startup MVP or UX/UI design
Add another example
E.g. specification, guidelines, description.
Up to 5 files: jpg, jpeg, png, gif, pdf, doc, docx, ppt, pptx, xls, xlsx, odt, zip or rar, max 5 MB each.
Company or multilingual website
Add another example
E.g. specification, guidelines, description.
Up to 5 files: jpg, jpeg, png, gif, pdf, doc, docx, ppt, pptx, xls, xlsx, odt, zip or rar, max 5 MB each.
Online shop
Add another example
E.g. specification, guidelines, description.
Up to 5 files: jpg, jpeg, png, gif, pdf, doc, docx, ppt, pptx, xls, xlsx, odt, zip or rar, max 5 MB each.
Other
Add another example
E.g. specification, guidelines, description.
Up to 5 files: jpg, jpeg, png, gif, pdf, doc, docx, ppt, pptx, xls, xlsx, odt, zip or rar, max 5 MB each.
Back
Send form
Thank you for your inquiry

We will contact you as soon as possible.

Close
The administrator of your personal data that are collected during the correspondence using the contact form is Iguana Sp. z o.o. with its registered office in Poznań, ul. Głogowskiej 261, 60-104, entered in the register of entrepreneurs of the National Court Register under number 0000642441, e-mail: natalia@iguanastudio.pl, tel. +48 507 160 901. Personal data can be processed for the purposes of: performing activities before the conclusion of a contract or contract performance, presentation of a commercial offer, answering your questions – depending on the content of your message. The basis for the processing of personal data is Article 6 para. 1 letter b of the Regulation of the European Parliament and the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free flow of such data (GDPR), i.e. the performance of a contract or taking action before the conclusion of a contract, Article 6, para. 1 letter a GDPR, i.e. your consent, article 6 para. 1 letter f, i.e. the legitimate interest of the administrator - willingness to answer your questions and doubts. Personal data will be processed for the period that is necessary to achieve the purpose of processing, i.e. to conclude a contract, present a commercial offer, answer your questions or concerns, and may be stored until the end of the contract period and the limitation of claims under the contract. The person whose personal data are processed has the right to access, rectify, delete, limit processing, object to the processing and the right to transfer personal data, provided that the right to transfer personal data only applies to data processed in an automated manner. A person whose personal data are processed on the basis of consent has the right to revoke it at any time, without prejudice to the processing of personal data prior to the withdrawal of consent. The person whose personal data are processed has the right to file a complaint to the competent supervisory authority. Providing personal data is voluntary, but failure to provide them will result in the inability to perform a contract, take action before entering into a contract, present a commercial offer, answer questions or concerns.