Privacy policy

1. Controller

The controller of your personal data is Piotr Kukuć, a Polish sole proprietor (jednoosobowa działalność gospodarcza) registered in the Central Register and Information on Economic Activity (CEIDG), with place of business at ul. Ludowa 52, 68-200 Żary, Poland, tax ID NIP 9282118288, statistical number REGON 543303562. Operating under the trade name Tmsped.

For data-protection matters write to contact@tmsped.com. Polish e-Delivery address: AE:PL-84407-34139-WJIJB-20.

No Data Protection Officer (DPO) has been appointed — please write directly to the address above for any data-protection enquiry.

2. Data we collect

Through the contact form we collect:

• your email address,
• the message you write in the “Short note” field.

For technical and security reasons our server logs also record your IP address and your browser’s User-Agent at the moment of submission.

3. Purposes and legal basis

• Replying to your enquiry and pre-sales conversations — Art. 6(1)(f) GDPR (the controller’s legitimate interest in handling enquiries from people interested in our services).
• Conclusion and performance of a contract, if the conversation leads to engagement — Art. 6(1)(b) GDPR.
• Compliance with legal obligations (accounting, tax) — Art. 6(1)(c) GDPR.
• Site security and abuse prevention (server logs) — Art. 6(1)(f) GDPR.

4. Retention

• Form messages and email correspondence — for the duration of the conversation and up to 24 months after, unless we engage in a project together.
• Server logs — up to 90 days.
• Data resulting from concluded contracts — for the contract term and the limitation period for claims, plus retention required by law (e.g. 5 years for accounting data).

5. Recipients

Only authorised members of our team have access to your data. We rely on the following data processors:

• Railway Corp. (USA) — hosting and database infrastructure. The site and the API serving the contact form run on Railway.
• Google LLC (USA) — Gmail, used to correspond with people who reach us through the form.
• Accounting firm based in Warsaw, Poland — for invoice and contract data (engagement begins only when we sign you up as a client).
• Legal counsel — where needed to defend or pursue claims (incidental).

Each of these is (or will be, before any data is shared with them) bound by a data-processing agreement compliant with Art. 28 GDPR.

6. International transfers

Two of our providers process data outside the European Economic Area:

• Railway Corp. — the default server region is the USA (Oregon, us-west2); a European region (Amsterdam, eu-west1) is available per project.
• Google LLC (Gmail) — global processing, including in the USA.

Transfers to the USA are based on the European Commission’s Standard Contractual Clauses, Implementing Decision (EU) 2021/914 of 4 June 2021. Google LLC is additionally certified under the EU-U.S. Data Privacy Framework (Commission Decision 2023/1795), which provides an alternative legal basis for the transfer.

Until we sign engagement agreements with an accounting firm or legal counsel, your data is not shared with them.

7. Your rights

You have the right to:

• access your data and obtain a copy,
• rectification,
• erasure (“right to be forgotten”),
• restriction of processing,
• data portability,
• object to processing based on legitimate interest,
• withdraw consent at any time, where processing is based on consent — without affecting the lawfulness of processing prior to withdrawal.

To exercise these rights, write to contact@tmsped.com. We respond within 30 days.

You also have the right to lodge a complaint with the supervisory authority — the President of the Polish Personal Data Protection Office (UODO, uodo.gov.pl).

8. Is providing data mandatory?

Providing your email is voluntary but necessary for us to reply. Without it we cannot answer your enquiry.

9. Profiling and automated decisions

We do not subject you to automated decision-making producing legal effects, and we do not use profiling within the meaning of Art. 22 GDPR.

10. Cookies and logs

For details about cookies see our Cookies policy.

11. Changes

We reserve the right to update this policy. We will announce material changes on the site. The current version is always available at tmsped.com/en/privacy.

Last updated: 10 May 2026