Last updated: 10 October 2026
1. Who is responsible for your data?
The operator of Expand2Poland (the “Website”, “we”, “us” or “our”) is responsible for the processing of personal data described in this Privacy Notice. For all privacy-related questions, requests or complaints, contact us at martin@expand2poland.com.
2. What this notice covers
This notice explains how we process personal data when you visit https://expand2poland.com/ or contact us through the Website. The Website provides information about business expansion and market-entry support in Poland and includes a contact form; it does not offer customer accounts or online payments.
3. Data we collect
When you use the contact form, we collect the information you choose to provide: your name, email address, company, selected enquiry topic, and the information you include about your plans or request. You may also provide your company website and role. Enquiries are stored privately in WordPress, with a submission reference, submission time, language and page, the IP address observed by our server, and browser information. We also process limited technical information generated when you visit the Website, such as IP address, browser/device information, pages visited, and security or server-log data.
4. Why we use your data and our legal bases
We use contact-form information to respond to your enquiry, assess a possible business relationship, and communicate with you. This is processed because it is necessary to take steps at your request before entering into a contract and, where applicable, for our legitimate interests in responding to business enquiries and protecting our operations.
We use technical and security data to operate, secure, and troubleshoot the Website, prevent spam, and assess the authenticity of enquiries. This is processed for our legitimate interests in maintaining a safe and reliable service.
We use Google Analytics only for optional website-usage measurement. Where consent is required, analytics cookies must be activated only after you have opted in; the legal basis is your consent. You can withdraw consent at any time through the Website’s cookie settings where available, or by clearing or blocking cookies in your browser. Withdrawing consent does not affect processing that took place before withdrawal.
5. Cookies and Google Analytics
Cookies are small files stored on your device. Strictly necessary cookies may be used for essential Website functionality and security. Google Analytics may use cookies or similar technologies to help us understand how visitors use the Website, including pages viewed, approximate location derived from IP address, device/browser information, and interactions with the Website. With your analytics consent, we may also associate your enquiry with its landing page, referring website, campaign parameters, pages visited during the browser session, and Google Analytics client and session identifiers. This helps us understand which sources lead to enquiries. Names, email addresses, telephone numbers and enquiry text are not sent to Google Analytics through this enquiry-tracking feature. You can submit an enquiry without consenting to analytics. We use aggregated analytics reports to improve the Website and our services; we do not use it to make decisions producing legal or similarly significant effects about you.
Google Analytics is provided by Google. Google’s privacy information is available at https://policies.google.com/privacy. You can also manage cookies in your browser settings.
6. Cloudflare Turnstile
We use Cloudflare Turnstile on our contact form to distinguish human visitors from automated traffic and protect the Website against spam and abuse. When Turnstile operates, Cloudflare may process limited technical signals, including your IP address, TLS fingerprint, user-agent header, the Turnstile site key, and the associated website origin. Turnstile does not access, store, or transmit the information you enter into the contact form for this purpose. We rely on our legitimate interests in securing the Website and preventing abuse.
Cloudflare, Inc. provides Turnstile and may process these signals as our service provider and for its own legitimate interests in improving bot-detection capabilities. Further information is available in Cloudflare’s Turnstile Privacy Addendum.
7. Who receives your data
We share personal data only where necessary with service providers that help us host and operate the Website, deliver email, provide website security and support, and provide analytics. Cloudflare acts as a website-security service provider when Turnstile is used, and Google acts as an analytics service provider when Google Analytics is used. We may also disclose data where required by law or to establish, exercise, or defend legal claims.
8. International transfers
Some service providers, including Cloudflare and Google, may process data outside the European Economic Area. Where this occurs, we use appropriate safeguards required by applicable data-protection law, such as the European Commission’s adequacy decisions or standard contractual clauses, as applicable.
9. How long we keep data
We keep contact-form enquiries for no longer than necessary to respond, manage any resulting business relationship, and protect or establish legal claims. As a general rule, enquiries that do not lead to an ongoing relationship are retained for up to 24 months after the last meaningful contact. Additional technical and attribution metadata attached to new enquiries in WordPress is scheduled for removal after 30 days, through a daily WordPress maintenance task, with a fallback check when WordPress handles a request (at most once every six hours). Cleanup runs at the next maintenance check after expiry; an inactive site may retain this metadata longer until a check runs. The enquiry message, business contact details, reference and submission time remain subject to the enquiry retention period above. Hosting and security logs, backups, and Google Analytics data have separate retention settings. Technical logs and analytics data are retained according to the relevant service configuration and only for as long as needed for the purposes above, unless a longer period is required by law.
10. Your rights
Subject to applicable law, you may request access to your personal data, correction, erasure, restriction of processing, or portability. You may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time. To exercise these rights, email martin@expand2poland.com.
You also have the right to lodge a complaint with the supervisory authority in your country of residence, work, or the place of the alleged infringement. In Poland, the supervisory authority is the President of the Personal Data Protection Office (UODO).
11. Security
We use reasonable technical and organisational measures to protect personal data. No method of transmission or storage is completely secure, so please do not send confidential, special-category, or highly sensitive information through the contact form unless necessary.
12. Changes to this notice
We may update this Privacy Notice when our processing activities, services, or legal requirements change. We will post the updated version on this page and revise the “Last updated” date.