🔒 Privacy Policy

1. Data controller

Q ASSET Sp. z o.o.
ul. Gdańska 138, 90-536 Łódź, Poland
VAT ID (NIP): 7262714483
E-mail: qasset@qasset.pl
Phone: +48 726 853 513

Q ASSET Sp. z o.o. is the "organization" responsible for personal information under PIPEDA and the "data controller" under GDPR.

2. What data we collect

Depending on how you contact us and use our website, we may process the following data:

2.1. Data you provide voluntarily

• Contact details: full name, e-mail address, phone number, company name
• Address details: province/territory, postal code, country (used for shipping quotes)
• Project details: description of your inquiry, logo files, artwork, budget range, quantity
• Communication preferences: preferred contact method (e-mail, WhatsApp, phone)

2.2. Data collected automatically

• Technical data: IP address, browser type, operating system, device type
• Usage data: pages visited, time spent, referral source
• Cookies: small text files stored on your device (see section 6)

3. Purposes of processing

We process your data for the following purposes:

Purpose	Data used	Retention
Responding to your inquiry	Name, e-mail, project details	Until inquiry resolved + 6 months
Preparing quotes and order processing	All contact & project data	Until order completed + 5 years (tax law)
Shipping & customs documentation	Name, address, phone	5 years (customs & tax)
Marketing (only with consent)	E-mail	Until consent withdrawn
Analytics & website improvement	Technical & usage data	Up to 14 months
Legal obligations (tax, accounting)	Name, address, invoice data	5 years (Polish law)

4. Legal basis (GDPR) / Consent (PIPEDA)

Under the GDPR, we process data on the following legal bases:

• Art. 6(1)(a) — your consent (e.g. marketing communications, non-essential cookies)
• Art. 6(1)(b) — necessity to perform a contract or take pre-contractual steps (e.g. quotes, orders)
• Art. 6(1)(c) — compliance with a legal obligation (tax, customs)
• Art. 6(1)(f) — legitimate interest (responding to inquiries, fraud prevention, network security)

Under PIPEDA, we collect, use and disclose personal information only with your knowledge and consent, except where the law permits otherwise. You may withdraw consent at any time, subject to legal and contractual restrictions, by contacting us at qasset@qasset.pl.

5. International data transfers

Q ASSET Sp. z o.o. is based in Poland (European Union). If you contact us from Canada, your data will be transferred to and processed in the EU.

• GDPR: transfers from the EU to Canada are covered by the European Commission's adequacy decision for Canada (PIPEDA-compliant organizations), or by Standard Contractual Clauses where applicable.
• PIPEDA: by submitting personal information to us, you consent to its transfer to and processing in Poland. We apply the same high standards of protection in Poland as we would in Canada. You may request information about our service providers' locations at any time.

6. Cookies

6.1. What are cookies?

Cookies are small text files stored on your device when you visit our website. They help us provide a better experience and remember your preferences.

6.2. What cookies we use

• Essential cookies: required for the site to function (e.g. remembering cookie consent, session management, CSRF tokens). These do not require consent.
• Functional cookies: remember your preferences (e.g. language, localStorage).
• Analytics cookies (if enabled): help us understand how visitors use the site. Only set with your consent.

6.3. How to manage cookies

You can manage or disable cookies in your browser settings. Disabling some cookies may affect website functionality.

• Google Chrome: Settings → Privacy and security → Cookies and other site data
• Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
• Microsoft Edge: Settings → Cookies and site permissions
• Safari: Preferences → Privacy → Manage Website Data

7. Your rights

Under GDPR and PIPEDA, you have the following rights:

• Right of access — you may request a copy of the personal data we hold about you
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten") — request deletion, subject to legal retention obligations
• Right to restrict processing — limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest
• Right to withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal
• Right to lodge a complaint with a supervisory authority (see below)

To exercise any of these rights, contact us at qasset@qasset.pl. We respond within 30 days (PIPEDA) or 1 month (GDPR).

7.1. Where to complain

• Canada (PIPEDA): Office of the Privacy Commissioner of Canada (OPC)
  30 Victoria Street, Gatineau, Quebec K1A 1H3
  www.priv.gc.ca · 1-800-282-1376
• EU (GDPR): President of the Personal Data Protection Office (UODO)
  ul. Stawki 2, 00-193 Warsaw, Poland
  uodo.gov.pl

8. Retention period

We keep personal data only as long as necessary for the purpose it was collected, or as required by law:

• Inquiries — up to 6 months after resolution
• Orders and invoices — 5 years (Polish accounting & tax law)
• Customs documentation — 5 years
• Marketing consents — until withdrawn
• Analytics — up to 14 months

9. Data sharing

We never sell your personal data. We share it only with trusted service providers who help us operate:

• IT & hosting providers — website hosting, e-mail delivery, form processing (EU-based, with GDPR-compliant data processing agreements)
• Courier & shipping companies (DHL, FedEx) — name, address, phone for delivery
• Customs brokers (if applicable) — for export documentation
• Accounting office — invoice data, as required by Polish law
• Government authorities — only when legally required

All service providers are bound by confidentiality and data protection agreements.

10. Security

We apply appropriate technical and organizational measures to protect your data against loss, theft, or unauthorized access, including:

• Encrypted connection (SSL/TLS / HTTPS)
• CSRF tokens in all forms
• Access to personal data limited to authorized staff only
• Regular backups and security updates
• Secure data processing agreements with all third parties

11. Children's privacy

Our services are intended for businesses and adults. We do not knowingly collect personal information from children under 13 (COPPA) or under 16 (GDPR). If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates when the policy was last revised. Material changes will be announced on this page or by e-mail where appropriate.

13. Contact & complaints

For any questions about this Privacy Policy, to exercise your rights, or to file a complaint:

Q ASSET Sp. z o.o.
ul. Gdańska 138, 90-536 Łódź, Poland
VAT ID (NIP): 7262714483
E-mail: qasset@qasset.pl
Phone: +48 726 853 513
WhatsApp: +48 726 853 513

We aim to respond to all privacy inquiries within 30 days.