Last updated: 31 July 2026
1. Data controller
The controller of personal data collected through the website https://papajabrandagency.com is:
Papaja sp. z o.o. ul. Cieszyńska 13, 30-015 Kraków NIP: 677-253-39-69 KRS: 0001208069 REGON: 543353927
Contact for matters relating to the protection of personal data: studio@papajastudio.pl
2. Legal bases and purposes of data processing
We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) for the following purposes:
- Handling enquiries and correspondence – data provided through the contact form, by e-mail or by phone is processed in order to reply and to conduct correspondence (Art. 6(1)(f) GDPR – the legitimate interest of the controller).
- Conclusion and performance of a contract – if an enquiry leads to cooperation, data is processed in order to prepare an offer and to conclude and perform a contract (Art. 6(1)(b) GDPR).
- Compliance with legal obligations – in particular tax and accounting obligations (Art. 6(1)(c) GDPR).
- Marketing and analytics – carrying out marketing activities, measuring the effectiveness of advertising and analysing website traffic using the tools described in section 5 (Art. 6(1)(a) GDPR – consent given through the cookie settings, and Art. 6(1)(f) GDPR – the legitimate interest of the controller).
- Establishing, pursuing or defending claims (Art. 6(1)(f) GDPR).
Providing data is voluntary but necessary in order to achieve the purposes above – for example, without an e-mail address we will not be able to reply to an enquiry.
3. Scope of the data processed
We process only the data you provide to us voluntarily (e.g. first name, surname, e-mail address, telephone number, company name, message content) and data collected automatically while you use the website (IP address, device and browser data, data on activity on the website – details in sections 5 and 6).
4. Data recipients
Personal data may be transferred to entities that process it on our behalf, only to the extent necessary to achieve the purposes described above:
- hosting and e-mail service providers,
- providers of analytical and marketing tools (in particular Google – section 5),
- entities providing accounting, legal and IT services,
- public authorities, where required by law.
We do not sell personal data to third parties.
5. Analytical and marketing tools
On the website we use the following tools provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland):
Google Analytics – a tool for analysing website traffic. It collects information about how the website is used (including the pages visited, the time of the visit, the referral source, the approximate location and device data). The data is statistical in nature and is not used to identify users directly.
Google Ads – an advertising tool used to run advertising campaigns and to measure their effectiveness, including remarketing (displaying ads to people who have visited our website). Cookies and advertising identifiers are used for this purpose.
Google Tag Manager – a tool for managing scripts on the website. It does not collect personal data itself, but it makes it possible to run the tools listed above.
These tools work only after consent has been given in the cookie banner (with the exception of technically necessary functions). Consent can be withdrawn or changed at any time in the cookie settings available on the website.
In connection with the use of Google services, data may be transferred to the United States. Google LLC participates in the EU-U.S. Data Privacy Framework, approved by a decision of the European Commission, which ensures an adequate level of data protection in accordance with Art. 45 GDPR.
More information about data processing by Google: https://policies.google.com/privacy You can also block Google Analytics by installing a browser add-on: https://tools.google.com/dlpage/gaoptout
6. Cookies
The website uses cookies – small text files stored on the user’s device. We use:
- necessary cookies – required for the website to work correctly (they do not require consent),
- analytical and marketing cookies – related to the tools described in section 5 (they require consent).
Detailed information about the cookies used, their providers and their storage periods, as well as the option to manage consents, can be found in the cookie settings panel available on the website.
Cookies can also be deleted or blocked in the browser settings, although blocking necessary cookies may affect how the website works.
7. Data retention period
- data related to correspondence and enquiries – for the duration of the correspondence and then until any claims become time-barred,
- data related to the performance of contracts – for the period required by law (in particular tax and accounting law – as a rule 5 years from the end of the year in which the tax obligation arose),
- data processed on the basis of consent – until that consent is withdrawn,
- analytical and marketing data – in accordance with the retention periods set in the individual tools.
8. Rights of data subjects
Every person whose data we process has the right to:
- access their data and receive a copy of it,
- rectify (correct) their data,
- erase their data,
- restrict processing,
- data portability,
- object to processing based on a legitimate interest,
- withdraw consent at any time (without affecting the lawfulness of processing carried out before its withdrawal),
- lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, www.uodo.gov.pl).
To exercise your rights, contact us: studio@papajastudio.pl
9. Automated decision-making and profiling
We do not take decisions about users based solely on automated processing that would produce legal effects. The marketing tools (section 5) may use profiling in order to tailor advertising – solely on the basis of the consent given.
10. Data security
We apply technical and organisational measures to protect the data we process, including connection encryption (SSL/TLS), restricted access to data and working only with trusted service providers.
11. Changes to the privacy policy
The policy may be updated if the law or the range of tools used changes. The current version is always available on this page.