1. General Information
This Privacy Policy sets out the rules for the processing of personal data of users visiting the KOBO WOOD website.
We attach great importance to the protection of privacy and make every effort to ensure that personal data is processed in a secure, transparent manner and in compliance with applicable laws.
Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, GDPR).
Rules regarding the use of cookies and similar technologies are described in a separate Cookie Policy.
2. Data Controller
The controller of the personal data processed through the KOBO WOOD website is Marta Anna Kosińska conducting unregistered business activity under the KOBO WOOD brand.
The Data Controller can be contacted:
- by post at: 92d/30 Syta Str., 02-993 Warsaw, Poland
- by e-mail: kobo.kontakt@gmail.com.
The Data Controller has not appointed a Data Protection Officer.
3. What Personal Data Do We Process?
The scope of processed data depends on the way the KOBO WOOD website is used and the form of contact with KOBO WOOD.
We may process, in particular:
- first and last name, if voluntarily provided by the user,
- e-mail address,
- telephone number,
- the content of correspondence conducted by e-mail or telephone,
- information voluntarily provided in connection with an inquiry, cooperation, or project implementation,
- technical data related to the use of the website, such as IP address, device type, web browser type, or operating system,
- statistical and analytical data collected through Google Analytics 4, operating with the use of Google Consent Mode v2, including information about the device, approximate location, and user interactions with the website, in accordance with the configuration of this service.
Data provided when contacting KOBO WOOD is submitted directly by the user via e-mail or telephone contact.
4. What Data Do We Process and For What Purpose?
| Purpose of Processing | Data Categories | Legal Basis | Retention Period |
| Responding to e-mail inquiries | first and last name (if provided), e-mail address, message content | Article 6(1)(f) GDPR – the Controller’s legitimate interest in handling correspondence and responding to inquiries | for the period necessary to conduct correspondence and thereafter for the period necessary to establish, pursue, or defend against potential legal claims, but no longer than until the applicable limitation period expires |
| Telephone contact | telephone number, information provided during the conversation | Article 6(1)(f) GDPR – the Controller’s legitimate interest in responding to inquiries and handling communication | for the period necessary to achieve the purpose of the contact |
| Preparation of an offer or quotation | contact details and information provided by a prospective client | Article 6(1)(b) GDPR – taking steps at the request of the data subject prior to entering into a contract | for the period necessary to prepare and handle the offer or quotation, and thereafter for the period necessary to establish, pursue, or defend against potential legal claims |
| Performance of a contract and cooperation | data necessary to perform the project, maintain contact, and fulfil the contract | Article 6(1)(b) GDPR – performance of a contract | for the duration of the contract and thereafter for the period required by law or necessary to establish, pursue, or defend against potential legal claims |
| Compliance with legal obligations | data required by applicable laws, in particular accounting and tax regulations | Article 6(1)(c) GDPR – compliance with a legal obligation to which the Controller is subject | for the period required under applicable laws |
| Establishing, pursuing, or defending legal claims | data related to correspondence, cooperation, or a concluded contract | Article 6(1)(f) GDPR – the Controller’s legitimate interest in protecting its legal rights | until the relevant limitation periods for legal claims have expired |
| Website traffic analysis and statistics (Google Analytics 4) | statistical and technical data concerning the use of the website, information about the device, approximate location, and signals related to Google Consent Mode v2, in accordance with the configuration of Google Analytics 4 | Article 6(1)(a) GDPR – the user’s consent | for the retention period configured in Google Analytics 4; consent to the use of Google Analytics 4 may be withdrawn at any time |
5. Voluntary Provision of Data
Providing personal data is voluntary. However, in certain cases it may be necessary to achieve specific purposes.
Providing contact details and information contained in a message is voluntary, but failure to provide such data may make it impossible to respond to an inquiry or continue communication.
Where a quotation, estimate, or contract is to be prepared, the provision of certain data may be necessary in order to take steps prior to entering into a contract or to perform the contract.
Where the provision of data is required by law, failure to provide such data may prevent the Data Controller from fulfilling legal obligations.
In the case of Google Analytics 4, the legal basis for processing is the user’s consent expressed through the consent management mechanism relating to cookies.
Refusing consent for analytical cookies does not prevent the use of the website or contacting KOBO WOOD.
6. Recipients of Personal Data
Personal data may be disclosed to entities supporting the operation of the website and the activities of the Controller only to the extent necessary to achieve the purposes described in this Privacy Policy.
In particular, recipients of personal data may include:
- Hostinger – the provider of hosting services and technical infrastructure used to maintain the website,
- Google – as the provider of the Gmail e-mail service used to handle correspondence sent to kobo.kontakt@gmail.com,
- Google – as the provider of Google Analytics 4, used to analyze website traffic and the manner in which the website is used,
- entities providing IT, technical, or accounting services to the Controller, where access to personal data is necessary for the provision of such services.
Personal data is not sold or disclosed to third parties for marketing purposes.
7. Transfers of Personal Data Outside the European Economic Area
Due to the use of Google services, in particular Gmail and Google Analytics 4, personal data may be transferred outside the European Economic Area (EEA).
Where personal data is transferred outside the EEA, the Controller applies data transfer mechanisms provided for under the GDPR. In cases where a recipient is covered by a European Commission adequacy decision, personal data may be transferred on the basis of such decision. Google LLC participates in the EU-US Data Privacy Framework.
Further information regarding Google’s data processing practices can be found in Google’s documentation and privacy policies.
8. Automated Decision-Making and Profiling
The Controller does not make decisions concerning users based solely on automated processing that would produce legal effects or similarly significantly affect their situation.
The Controller does not carry out profiling of users within the meaning of the GDPR.
9. What Rights Do You Have?
To the extent and under the conditions set out in the GDPR, you have the right to:
- access your personal data,
- rectify your personal data,
- erase your personal data,
- restrict the processing of your personal data,
- object to the processing of your personal data,
- data portability,
- withdraw your consent to the processing of personal data where processing is based on consent,
- lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).
Where the processing of personal data is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
Where consent has been given for the use of analytical cookies and Google Analytics 4, consent may be withdrawn as easily as it was given, using the consent management mechanism available on the website.
To exercise your rights, you may contact the Controller at:
kobo.kontakt@gmail.com
10. How Long Do We Retain Your Data?
We retain personal data only for as long as necessary to fulfil the purpose for which it was collected and, thereafter, for the period required by law or necessary to protect the Controller’s rights.
In particular:
- data contained in e-mail correspondence is retained for the duration of the correspondence and thereafter for the period necessary to establish, pursue, or defend against potential legal claims,
- data related to the preparation of quotations or estimates is retained for the period necessary to process the inquiry and thereafter for the period necessary to establish, pursue, or defend against potential legal claims,
- data related to the performance of a contract or cooperation is retained for the duration of the contract and thereafter for the period required by law or necessary to establish, pursue, or defend against potential legal claims,
- accounting and tax documentation is retained for the period required under applicable laws,
- data processed for the purpose of establishing, pursuing, or defending against legal claims is retained until the applicable limitation periods for such claims have expired,
- data processed through Google Analytics 4 is retained in accordance with the data retention settings configured within Google Analytics 4. Currently, user data is retained for a period of 14 months.
11. Contact
If you have any questions regarding this Privacy Policy or the processing of your personal data, you may contact the Data Controller:
- by post at: ul. Syta 92D/30, 02-993 Warsaw, Poland,
- by e-mail: kobo.kontakt@gmail.com.
12. Changes to the Privacy Policy
This Privacy Policy may be updated in the event of:
- changes in applicable laws,
- changes to the operation of the website,
- implementation of new services or tools affecting the processing of personal data.
The current version of this Privacy Policy is always available on the KOBO WOOD website.
Effective Date: 18 August 2026