Privacy policy

Last updated: 24 October 2026 — version 2026-10-24.1.

1. Controller and contact

The controller of personal data is Idea Makers Sp. z o.o., ul. Marcina 11, 40-854 Katowice, Poland, NIP 6343009854, KRS 0000972285, REGON 52204749200000. For privacy matters, contact us at contact@ideamakers.eu or kontakt@ideamakers.pl.

This notice applies to ideamakers.pl, its English version at /en/ and traffic redirected from our former domains. We receive data from you, your browser and providers operating the services described here.

2. Data we process

We may process data entered in the form: name, company name, email address, telephone number, project information, selected services, description of needs, selected time, contact source and confirmation that the privacy information was read. For a booking, we also process form and booking identifiers, time zone, decision status and notification status.

To deliver and secure the website, we need technical data such as IP address, request time and address, and browser and device information. We process it under our legitimate interest in operating and securing the service (Article 6(1)(f) GDPR).

After consent to the “Analytics” category, Google Analytics 4 and Umbraco Engage may process technical and statistical data: pages and paths visited, approximate location, device and browser type, time and manner of use, link interactions, and technical session and visitor identifiers. We do not use this data to identify a person by name. We do not send values entered or submitted in a form, including the visitor's email address or telephone number, to analytics services. Umbraco Engage may nevertheless record form-interaction metadata such as field names or keys, field focus and validation results, without the entered values, as well as the destination URL of a clicked link, including a mailto: or tel: link.

3. Contact form

The form is handled by Umbraco Forms. We store the submission in the forms system and relay it for handling through Microsoft Graph/Outlook. We use the data to receive and handle your enquiry, reply to you and organise further contact.

The legal basis is Article 6(1)(b) GDPR where the contact concerns steps requested before entering into a contract to which you may be a party. In other cases, including contact on behalf of a company, the legal basis is Article 6(1)(f) GDPR — our legitimate interest in handling correspondence, documenting contact and preventing abuse. Providing data is voluntary, but without fields marked as required we cannot submit or handle the enquiry. We do not use enquiries for newsletters or marketing without a separate legal basis. An acknowledgement email does not promise a reply within a particular time and does not create a contract.

4. Booking a call

Booking is handled through Microsoft 365 / Microsoft Bookings. We process contact details, the selected time and information from the enquiry to record the request, hold the selected time and carry out approval.

The legal bases are the same as for enquiries in section 3 — Article 6(1)(b) or (f) GDPR, depending on the nature of the contact. The request is awaiting approval by a company employee. Until then, the time is held in the website system without creating an Outlook booking. The hold lasts until a decision, at most until the one-day lead-time boundary before the meeting. Rejection or expiry releases the time. After approval, the following are sent to Bookings: name, email, telephone number, time and notes about the project and services. Bookings confirmation is sent after approval; after rejection the visitor receives an email. Bookings confirmation and cancellation messages are in English; our acknowledgement and rejection messages use the form language.

5. Analytics and legacy-domain traffic

We use two analytics mechanisms: Google Analytics 4 and Umbraco Engage. Both are enabled by one voluntary consent to the “Analytics” category. The legal basis is Article 6(1)(a) GDPR and Article 399(1) of the Polish Electronic Communications Law. You can withdraw consent through “Privacy settings” in the footer. Refusal does not limit use of the website.

Traffic redirected from former domains may, after consent, produce an event with the legacy_domain parameter, such as eu or dk. It identifies the source domain, contains no contact details and is used to measure redirects.

GA4 retention is 2 months for event data and 14 months for user data; the user-data period resets when the user is active again. This setting does not automatically remove standard aggregated reports. The website code denies advertising consent and disables personalisation signals. Google Signals and collection of user-provided data are disabled. For GA4 specifically, we send a path without query parameters or fragments, a fixed page title and an empty referrer. We do not send email, telephone number, form content or User-ID to GA4. We do not make decisions producing legal effects solely by automated means or carry out profiling producing such effects.

After consent to the “Analytics” category, Umbraco Engage records page views on the server and its official script measures scrolling, time spent using the website, link interactions and form-interaction metadata. Form metadata may include field names or keys, field focus and validation results, but not values entered or submitted by the visitor. The destination of a clicked link may include a mailto: or tel: URL. The data is associated with a technical visitor identifier and stored in the website's local database in the Umbraco Cloud environment. The IP address is anonymised. Content personalisation and A/B testing remain disabled.

Withdrawing consent to the “Analytics” category stops future processing by GA4 and Umbraco Engage and removes the recognised identifiers of both mechanisms from the browser. It does not affect the lawfulness of processing carried out before withdrawal or immediately erase data collected earlier; that data remains subject to the retention periods described below.

After “Analytics” consent, we also record the technical lifecycle of a form attempt: a random attempt identifier, form type, allowlisted campaign parameters, and server-side times of the first interaction and latest activity. We do not record field names or values, contact details, IP address, or user agent. An active attempt without an accepted submission is treated as incomplete after 30 minutes of inactivity; a later accepted submission corrects that state. These data support aggregate form-effectiveness measurement and are not used to determine a person's identity.

After a meeting request is approved, the server may send GA4 a booking_confirmed event with the technical browser identifier from our first-party _ga cookie, an opaque event identifier, form and lead type, allowlisted campaign parameters, and the actual confirmation time. We do not send an email address, telephone number, form content, or IP address. Advertising-data and personalisation consent remain denied.

LinkedIn campaign measurement is controlled by a separate, voluntary “Marketing” choice. When enabled, the LinkedIn Insight Tag may send LinkedIn the page URL and referrer, IP address, browser and device data, timestamp and — for conversions invoked by our code — an opaque event identifier and conversion type. If Website Actions remains enabled in Campaign Manager, LinkedIn may also automatically record limited interaction metadata such as page name, button text, action type and a session-unique hash. After a meeting request is approved, the server may send the same event through the LinkedIn Conversions API, using only li_fat_id. This matches a technical advertising identifier; we do not send names, email addresses, telephone numbers, their hashes, form-field contents, or IP addresses. Refusal does not affect forms or bookings. Withdrawal blocks new LinkedIn measurement requests, invalidates queued delivery and removes li_fat_id after the change takes effect; granting consent again does not restart an old queue. It does not undo prior processing. The legal basis is Article 6(1)(a) GDPR and Article 399(1) of the Polish Electronic Communications Law.

6. Consent evidence

We retain a technical record of the consent choice under Article 6(1)(c) GDPR, in connection with Articles 5(2) and 7(1) GDPR, to demonstrate compliance with consent obligations. The evidence contains selected purposes, information version, timestamps, an identifier and integrity hashes; it does not contain IP address, user agent, email address or form content. The consent record is retained for 400 days. The technical device setting may remain for 180 days, after which you may be asked to choose again.

7. Cookies and similar technologies

Necessary mechanisms operate without consent when required to provide the requested service (Article 399(3) of the Polish Electronic Communications Law). GA4 and Umbraco Engage start only after consent to the “Analytics” category. LinkedIn Insight Tag starts only after consent to the separate “Marketing” category.

At startup we do not use an optional language cookie or Umbraco Engage personalisation. We do not start Engage analytics or load Google Analytics before consent to the “Analytics” category. Withdrawal stops further measurement in this browser and removes the Engage identifier and recognised GA4 cookies. You can also remove cookies in your browser; blocking necessary mechanisms may make form handling or saving your choice difficult.

8. Recipients, providers and transfers

We use Umbraco A/S and Umbraco Cloud infrastructure, including Microsoft Azure and Cloudflare (hosting, CMS, Umbraco Forms, Umbraco Engage, website delivery and security); Microsoft 365, Exchange Online, Outlook, Graph and Bookings (email and bookings); and Google Analytics 4 (measurement after consent to the “Analytics” category). Engage analytics is stored in the website's local database in the Umbraco Cloud environment. Relevant Microsoft and Google group entities, including their Irish entities, and service subcontractors may be involved. Access is limited to people authorised to operate the website and handle enquiries and bookings. Advisers and public authorities may receive data where there is an appropriate legal basis. We do not sell data.

For LinkedIn measurement we use LinkedIn Marketing Solutions. For people in the EU, EEA and Switzerland, the controller of data processed by LinkedIn is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; outside that area the applicable controller may be LinkedIn Corporation, 1000 W Maude Avenue, Sunnyvale, California 94085, USA. LinkedIn’s terms identify LinkedIn as an independent controller for the Insight Tag, retargeting and conversion measurement. Insight Tag data is stored on LinkedIn servers in the United States.

Providers may process data outside the EEA. Where this occurs, the transfer relies on an appropriate GDPR mechanism, including an adequacy decision or standard contractual clauses, together with required safeguards. LinkedIn identifies the EU–U.S. Data Privacy Framework and, for applicable transfers, Standard Contractual Clauses. You can request information about, or a copy of, the relevant safeguard using the contact addresses above.

9. Retention

We retain enquiries and booking data for the time needed to handle the matter and further contact, then for the period necessary to establish, exercise or defend claims or required by law. After the purpose ends, data is reviewed and deleted or anonymised when no basis for further retention exists. When cooperation begins, necessary data becomes part of client documentation. Logs and backups are retained in provider cycles for the time needed for security, continuity and service recovery. GA4 retention is 2 months for event data and 14 months for user data. In Umbraco Engage, raw data is deleted after 2 days, session data is anonymised after 90 days, and visitor and page-view data is deleted after 180 days. The Engage identifier cookie may remain for up to 180 days, no longer than the consent lifetime. Consent evidence is retained for 400 days and the technical consent setting for 180 days.

LinkedIn states that direct identifiers in Insight Tag data are removed within seven days to make the data pseudonymous and that the remaining pseudonymised data is deleted within 180 days. Section 7 describes browser-cookie and device-identifier periods.

Identifiers required for server delivery of a booking confirmation are stored in our database only in encrypted form. They remain valid for delivery for no more than 48 hours; after that they are not used and are erased by the automatic cleanup cycle, or earlier after delivery, permanent failure, an uncertain outcome, or consent withdrawal. Technical form attempts and the technical event-delivery record are retained for no more than 400 days.

10. Your rights

Subject to the GDPR, you may request access to your data, rectification, erasure, restriction of processing or portability, and object to processing based on Article 6(1)(f) GDPR. You may withdraw consent at any time; this does not affect the lawfulness of processing before withdrawal. Send a request to contact@ideamakers.eu or kontakt@ideamakers.pl.

11. Complaints and updates

You may lodge a complaint with the President of the Personal Data Protection Office (uodo.gov.pl). We generally respond to rights requests within one month, in accordance with the GDPR. This notice may be updated when the form, booking flow, providers, cookies or analytics change. The current version and date are available on this page. A material change to the scope of consent causes the choice to be shown again before the relevant processing starts.

12. Protecting forms against spam

We use Cloudflare Turnstile to protect our forms against automated abuse, spam and disruption. Idea Makers relies on Article 6(1)(f) GDPR: our legitimate interest in keeping the website and enquiry handling secure.

Verification involves technical connection and browser data, including the IP address and signals used to distinguish people from automated traffic. According to Cloudflare, Turnstile does not collect the contents of form fields. Our server sends Cloudflare a verification token and, when available, the IP address, and receives the verification result and information about the site and action. The token is single-use, expires after five minutes and is not stored in the application's enquiry database or application logs.

The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare processes data on our behalf to provide protection and also acts as a separate controller when improving bot detection. See the Turnstile privacy notice.

Data may be processed outside the European Economic Area, including in the United States. Depending on the recipient and transfer, appropriate safeguards apply, particularly an applicable adequacy decision, including the EU–US Data Privacy Framework, or standard contractual clauses. Cloudflare describes safeguards and retention in its Data Processing Addendum and Privacy Policy. Retention depends on the purpose and necessity of processing; we do not specify a separate fixed retention period for all Turnstile data.

Form protection is separate from analytics and marketing. We use it as a security measure necessary to safely provide the requested form service. We do not enable pre-clearance, which could set the cf_clearance cookie.

Submissions automatically classified as spam enter an access-restricted quarantine. Automatic deletion takes place after 30 days from classification; submissions restored by an administrator follow the retention rules for ordinary enquiries. Minimal technical deletion information and counters remain after deletion, without the enquiry content or contact details. For security handling, we record the classification outcome, reason and time. The remaining retention rules and rights described in this policy continue to apply.