PRIVACY POLICY
PRIVACY & COOKIE POLICY
www.evolpe.com
Last updated: 14 September 2026
This document defines the rules for processing personal data and for the use of cookies and similar technologies on the website www.evolpe.com (hereinafter the “Site”).
The Site is operated by Evolpe Consulting Group Spółka z ograniczoną odpowiedzialnością spółka komandytowa, with its registered office at Aleje Solidarności 46, 61-696 Poznań, Poland, entered in the Register of Entrepreneurs kept by the District Court Poznań – Nowe Miasto i Wilda in Poznań, KRS 0000494749, NIP 7811892697, phone +48 783 372 094, email office@evolpe.com (hereinafter the “Administrator” or “Controller”).
I. General provisions
- Personal data collected through the Site is administered by the Administrator, who acts as the controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter “GDPR”).
- The Administrator processes personal data in accordance with the GDPR, the Polish Act on the Protection of Personal Data of 10 May 2018, and the Act on the Provision of Services by Electronic Means of 18 July 2002.
- Providing personal data is voluntary; however, in individual cases it may be necessary to achieve the purposes related to the use of the Site (for example, to receive a reply to an inquiry).
- The Administrator does not appoint a Data Protection Officer. In all matters concerning personal data, please contact us at office@evolpe.com.
II. Purposes and legal bases of processing
| Purpose of processing | Legal basis (GDPR) | Retention period |
|---|---|---|
| Responding to inquiries submitted through contact forms or by email | Art. 6(1)(b) – steps taken at the request of the data subject prior to entering into a contract; Art. 6(1)(f) – legitimate interest in handling correspondence |
For the duration of the correspondence and up to 12 months thereafter, unless a business relationship is established |
| Performance of a contract and provision of services | Art. 6(1)(b) – performance of a contract | For the term of the contract, then until the limitation period for claims expires |
| Sending commercial information and the newsletter by electronic means | Art. 6(1)(a) – consent, in conjunction with Art. 10 of the Act on the Provision of Services by Electronic Means and Art. 172 of the Telecommunications Law | Until consent is withdrawn |
| Analytics and audience measurement (statistics cookies) | Art. 6(1)(a) – consent expressed via the cookie banner | Until consent is withdrawn or the cookie expires (see Section VI) |
| Marketing, A/B testing and personalisation (marketing cookies) | Art. 6(1)(a) – consent expressed via the cookie banner | Until consent is withdrawn or the cookie expires (see Section VI) |
| Ensuring the security and correct operation of the Site, protection against spam and abuse | Art. 6(1)(f) – legitimate interest of the Administrator | Up to 12 months (server logs) |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) – legitimate interest of the Administrator | Until the limitation period for claims expires |
| Compliance with legal obligations (accounting, tax) | Art. 6(1)(c) – legal obligation | 5 years from the end of the relevant tax year |
III. Your rights
In connection with the processing of your personal data, you have the following rights under the GDPR:
To exercise any of the above rights, please contact us at office@evolpe.com. We will respond without undue delay and in any event within one month of receiving your request.
IV. Security of personal data
Personal data is collected with due diligence and is appropriately protected against access by unauthorised persons, in accordance with Article 32 of the GDPR. The Administrator applies technical and organisational measures proportionate to the risk, including encryption of transmission (TLS), access control, and regular review of authorisations granted.
V. Information provided in forms
- The Administrator collects information provided voluntarily by the user of the Site.
- The Administrator may record information about connection parameters, such as IP address and the time of the request.
- Data provided in forms is processed for the purpose resulting from the function of the particular form (for example, handling a contact request or sending the newsletter).
- Contact and newsletter forms on the Site are operated by the Administrator’s own marketing automation system (Mautic) hosted on the Administrator’s infrastructure within the European Union. Data entered into those forms is not transferred to external marketing platforms.
- Data provided in forms may be disclosed to entities that technically support the provision of our services (in particular hosting providers, IT service providers and email providers), always on the basis of a data processing agreement concluded pursuant to Article 28 of the GDPR, and solely to the extent necessary to perform the requested service.
- The Site uses an anti-spam mechanism (Cap) which performs a computational challenge in the user’s browser. This mechanism does not use cookies and does not profile users.
VI. Cookies and similar technologies
Cookies are small text files stored by the browser on the user’s terminal equipment. Some of them are deleted when the browser session ends (“session cookies”), while others remain stored for a defined period and allow the browser to be recognised on a subsequent visit (“persistent cookies”). Alongside cookies, the Site may use similar technologies such as localStorage and sessionStorage.
Consent categories
Cookies and similar technologies on the Site are divided into four categories. Only the necessary category is used without your consent; the remaining categories are activated only after you give consent in the cookie banner.
- Necessary Required for the Site to function and to record your cookie choices. Used on the basis of Article 173(3) of the Telecommunications Law – no consent required.
- Preferences Allow the Site to remember settings that change its appearance or behaviour, such as the language version.
- Statistics Allow us to measure traffic and understand how the Site is used, so that we can improve it.
- Marketing Used to test and personalise content and to enable embedded third-party content such as maps, videos and social media.
Services used on the Site
The table below lists all external services and technologies that may be loaded on the Site, together with the consent category to which they are assigned.
| Service | Provider | Purpose | Category | Cookies / storage | Transfer outside the EEA |
|---|---|---|---|---|---|
| Complianz | Administrator (self-hosted) | Consent management – recording and storing your cookie choices | Necessary | cmplz_policy_id, cmplz_banner-status, cmplz_functional, cmplz_preferences, cmplz_statistics, cmplz_marketing, cmplz_consented_services – 365 days |
No |
| Cap | Administrator (self-hosted, cap.evolpe.cloud) |
Protection of forms against spam and automated abuse | Necessary | None | No |
| Mautic | Administrator (self-hosted, mautic.evolpe.it) |
Operation of contact and newsletter forms, marketing automation | Necessary Marketing | Form scripts: none. Contact tracking (mtc_id, mtc_sid) only after consent to marketing |
No |
| jsDelivr | Volentio JSD Ltd / Prospect One | Content delivery network serving JavaScript libraries required by the Site | Necessary | None (IP address is disclosed to the CDN) | Possible (global CDN) |
| Google Tag Manager | Google Ireland Ltd., Dublin | Management of measurement tags and transmission of your consent status (Google Consent Mode) | Necessary | None of its own | Yes – USA, on the basis of the EU–US Data Privacy Framework |
| Plausible Analytics | Administrator (self-hosted, plausible.evolpe.it) |
Aggregate, cookieless traffic statistics | Statistics | None – no cookies, no cross-site identifiers | No |
| Google Analytics 4 | Google Ireland Ltd., Dublin | Analysis of traffic and user behaviour on the Site (property G-QP213F5DPP) |
Statistics | _ga, _ga_QP213F5DPP – up to 13 months |
Yes – USA, on the basis of the EU–US Data Privacy Framework |
| Visual Website Optimizer (VWO) | Wingify Software Pvt. Ltd. | A/B testing and personalisation of Site content | Marketing | _vwo_uuid, _vwo_uuid_v2, _vwo_ds, _vwo_sn, _vis_opt_s, _vis_opt_test_cookie, _vis_opt_exp_*; localStorage: vwoSn – up to 12 months |
Yes – India / USA, on the basis of standard contractual clauses |
| Google Maps | Google Ireland Ltd., Dublin | Display of embedded maps (also via the ACF Custom Maps module) | Marketing | Google cookies, incl. NID; loaded only after consent |
Yes – USA, on the basis of the EU–US Data Privacy Framework |
| YouTube | Google Ireland Ltd., Dublin | Playback of embedded video material | Marketing | VISITOR_INFO1_LIVE, YSC and others; loaded only after consent |
Yes – USA, on the basis of the EU–US Data Privacy Framework |
| LinkedIn Ireland Unlimited Company | Embedded content and links to our company profile | Marketing | LinkedIn cookies, incl. bcookie, li_sugr; loaded only after consent |
Yes – USA, on the basis of the EU–US Data Privacy Framework | |
| X (Twitter) | Twitter International Unlimited Company | Embedded content and links to our profile | Marketing | Cookies of the provider, incl. guest_id; loaded only after consent |
Yes – USA, on the basis of standard contractual clauses |
| Meta Platforms Ireland Ltd. | Embedded content and links to our fan page | Marketing | Meta cookies, incl. _fbp, fr; loaded only after consent |
Yes – USA, on the basis of the EU–US Data Privacy Framework |
Services assigned to the Preferences, Statistics and Marketing categories are loaded only after the corresponding consent has been given. Withdrawing consent stops further collection of data and results in the removal of the cookies of the relevant category.
Managing your consent
You may change or withdraw your consent at any time using the “Manage consent” button available in the corner of every page of the Site, or below:
Independently of the above, you can manage cookies through your browser settings, including blocking them or deleting those already stored. Restricting the use of cookies may affect some of the functionalities available on the Site.
VII. Recipients of data and transfers outside the EEA
- Recipients of personal data may be entities providing hosting, IT, accounting and legal services to the Administrator, as well as the providers of the services listed in Section VI, always within the scope indicated in the table.
- Some of the providers indicated in Section VI process data outside the European Economic Area, in particular in the United States. Such transfers take place on the basis of an adequacy decision of the European Commission (EU–US Data Privacy Framework) or on the basis of standard contractual clauses approved by the European Commission pursuant to Article 46(2)(c) of the GDPR.
- You may obtain a copy of the safeguards applied to transfers by contacting office@evolpe.com.
VIII. Profiling and automated decision-making
If you consent to marketing cookies, the content of the Site may be adapted to you as part of A/B tests and personalisation (Visual Website Optimizer). This constitutes profiling within the meaning of Article 4(4) of the GDPR, but it does not lead to automated decisions producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22(1) of the GDPR.
IX. Changes to this Policy
The Administrator reserves the right to amend this Policy, in particular where the technologies used on the Site or the applicable law change. The current version is always published on this page, together with the date of the last update.
Contact in matters relating to personal data
Evolpe Consulting Group Sp. z o.o. sp.k.
Aleje Solidarności 46, 61-696 Poznań, Poland
Email: office@evolpe.com | Phone: +48 783 372 094