This Privacy Policy explains how BAREL sp. z o.o. sp.k. handles personal data when you visit barelspzoo.online, use its contact form or write to us by email. It meets the information obligations of Articles 13 and 14 of Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR).
1. Who controls your data
The controller of your personal data is:
BAREL SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ SPÓŁKA KOMANDYTOWA
ul. Kalwaryjska 69
30-504 Kraków
Poland
Registered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0000744647. NIP: 6793173074. REGON: 381014432.
In this policy the controller is referred to as Barel, we or us.
2. How to contact us about your data
For any question about your personal data or to exercise your rights, write to [email protected] or send a letter to the address above. We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR; privacy requests are handled by our management directly.
3. What this policy covers
This policy applies to the website barelspzoo.online and to email correspondence started through it. Mobile apps published by Barel are distributed through app stores, and each app provides its own privacy information in its store listing and inside the app.
4. What data we process, why, and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Replying to an enquiry sent through the contact form or by email, including a confirmation copy sent to you | Full name, email address, company (optional), project type, message, the page the form was sent from | Art. 6(1)(b) GDPR, where you ask about a possible contract with you; otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering business enquiries | Until the enquiry is handled and then for up to 12 months after our last contact, unless a contract follows |
| Protecting the contact form against spam and abuse | A one-way cryptographic hash of your IP address, rotated daily, with submission times; the IP address itself is not stored by the form | Art. 6(1)(f) GDPR, our legitimate interest in keeping the service secure | Deleted automatically, no later than 1 hour after the last submission |
| Operating and securing the website | Server logs: IP address, date and time, requested address, response code, browser type | Art. 6(1)(f) GDPR, our legitimate interest in the security and reliability of the website | For a limited period needed for security, not longer than 90 days |
| Preparing and performing a contract, if we work together | Contact details of you or the person representing your organisation, correspondence, contract data | Art. 6(1)(b) GDPR; for representatives of an organisation, Art. 6(1)(f) GDPR | For the duration of the contract |
| Meeting accounting and tax obligations | Data on invoices and accounting records | Art. 6(1)(c) GDPR together with Polish accounting and tax law | For the periods required by law, generally 5 years from the end of the calendar year concerned |
| Establishing, pursuing or defending legal claims | Data from the categories above that relate to the claim | Art. 6(1)(f) GDPR, our legitimate interest in protecting our rights | Until the limitation period for the claim under Polish law has expired |
5. Is providing data required?
Providing data is voluntary. The fields marked as required in the contact form are needed for us to reply; without them we cannot answer your enquiry. There is no legal or contractual obligation to contact us.
6. Who receives your data
We do not sell personal data and do not share it for marketing. Data may be made available to:
- our hosting provider, which runs the server for this website and the contact form;
- our email service provider, which delivers and stores enquiry emails;
- IT service providers who support us in maintaining the website, only to the extent needed for that work;
These providers act as processors under agreements that meet Article 28 GDPR and may use the data only on our instructions. Data may also be disclosed to public authorities when a legal provision requires it.
7. Transfers outside the European Economic Area
We aim to keep personal data within the European Economic Area. If a provider processes data outside it, the transfer relies on a European Commission adequacy decision under Article 45 GDPR or on standard contractual clauses under Article 46(2)(c) GDPR. You can ask us for information about these safeguards and a copy of them.
8. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy of it (Article 15);
- have inaccurate data corrected (Article 16);
- have your data erased (Article 17);
- restrict processing (Article 18);
- receive your data in a portable format, where processing is based on a contract and carried out by automated means (Article 20);
- object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Article 21).
We respond within one month of receiving a request. Where a request is complex, this period may be extended by up to two further months, and we will tell you why within the first month.
9. Right to lodge a complaint
If you believe we process your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl. You may also complain to the supervisory authority in the EU member state where you live or work, or where the alleged infringement took place.
10. Automated decisions
We do not make decisions based solely on automated processing, including profiling, that produce legal effects for you or similarly significantly affect you.
11. How we protect data
The website is served over an encrypted HTTPS connection. The contact form runs on our own server rather than an external form service, stores only a hashed form of IP addresses for spam protection and delivers enquiries to a mailbox on our own domain. Access to enquiries is limited to people who need it to reply.
12. Cookies
How this website uses cookies and similar technologies is described in the Cookie Policy.
13. Children
This website is intended for businesses and adults looking for app development services. We do not knowingly collect personal data from children through it.
14. Changes to this policy
We update this policy when the way we process data or the law changes. The current version is published at this address with its update date.
Last updated: 17 September 2026