Privacy Policy

Who is responsible for your data?

The data controller is Marcin Bęben, at the business address listed above. For questions about personal information or to exercise your data-protection rights, contact contact@marcinbeben.pl.

Enquiries, callback and consultation requests

When enabled, the form collects your name, email, optional telephone number, topic, preferred website language and message. It stores the enquiry in Supabase for authorised staff, together with its reference, receipt time and privacy-notice version. Staff may update the lead status and add notes. The form acknowledges a confirmed database save; an interrupted request may require a retry. A successful enquiry is not a confirmed appointment. Published consultation slots are held after a saved request, pending personal confirmation. Google Calendar synchronisation is available only after an administrator connects an account. Automatic email delivery and an AI chatbot are not active.

Provide only information needed to discuss your request. Use the dedicated document fields only for the documents listed by Marcin. Do not send payment-card details. It does not register you for marketing.

The inline consultation-request form additionally records the conversation topic, consultation language, online/phone format and either a preferred Warsaw date and time (also recorded in UTC) or a flexible-time choice. Phone is required for a phone conversation. An optional calculator summary is stored with the enquiry only when explicitly selected. The consultation draft stays in this tab’s application memory during in-site navigation; a full reload clears it. It is not written to persistent browser storage.

Purposes and lawful bases

Enquiry data is intended to answer your question, discuss your requested consultation or callback, and organise follow-up. Technical request data supports delivery and security of the website. The controller must confirm the applicable GDPR lawful basis for each purpose before enabling collection. Acknowledging that you have read a notice is not consent to marketing and does not itself establish a lawful basis.

Calculator data

Calculations run in your browser. Financial figures and planning details are kept in this tab’s session storage to retain your progress during navigation and refresh. They are not placed in URLs or included in analytics. By default they are not sent to the application server. In the consultation form, you may explicitly choose to share the displayed loan, deposit, repayment, term and rate summary; that summary is then stored with your enquiry. Income, expenses and borrower details are not attached. Use the calculator’s clear/reset control to remove saved inputs. If storage is unavailable, progress remains in memory only. The calculator does not make an automated lending decision or check your credit history.

Technical services and recipients

The application is configured for Cloudflare hosting. Cloudflare Turnstile protects enabled contact forms and receives technical connection information for verification. Supabase provides the database, admin authentication and uploaded-image storage when configured. Enquiries are accessible to authorised staff under role-based permissions. Fonts and background video are hosted with the website; uploaded photographs may be delivered from Supabase Storage. External profile links open the linked provider’s website only when selected.

Provider account regions, processing agreements, subprocessors and any international-transfer safeguards have not been confirmed. No claim that all data stays in Poland or the EEA is made. These arrangements must be verified by the controller before launch.

If Marcin connects Google Calendar, the server reads busy start/end times from his primary calendar and stores them to avoid overlapping requests. It does not copy external event titles or guest lists. Only requests accepted by an administrator create private confirmed events containing the request reference and time including the buffer; names, email addresses, messages and calculator results are not copied to Google. Refresh credentials are encrypted with a server-held key and are unavailable to public or signed-in database clients. Disconnecting removes the locally stored credential; previously created Google events remain.

Retention and security

The enquiry database currently has no automatic deletion schedule. The controller must determine and publish the retention period or meaningful criteria for enquiries, staff notes and backups. It must also confirm hosting/authentication log retention.

The application uses a keyed hash of the connection IP to limit enquiries; it does not save the raw IP in the CRM. Rate-limit rows older than two hours are cleaned during later accepted submission attempts, rather than by a guaranteed scheduled deletion. The host may independently process connection IPs and request metadata. Administrative access requires authentication; session cookies are HTTP-only. Browser-storage durations are listed in the Cookie Policy.

Your rights and questions

Depending on the lawful basis and circumstances, GDPR rights include access, correction, erasure, restriction, objection and data portability. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. You may complain to the President of the Polish Personal Data Protection Office (UODO). To ask about your information or exercise these rights, contact contact@marcinbeben.pl or write to the business address listed above.

Contract details and private document uploads

The enquiry form records your preferred consultation language. Only the form opened from Self-employed / B2B includes a contract type and document uploads. You choose the files; they are sent only when you submit the form and give both approvals. PDFs are validated on the server and stored privately in Supabase, linked to your enquiry. Only an authorised administrator can download or delete them. The contract checklist, consent wording, language and acceptance time are recorded. Unfinished uploads are removed by scheduled cleanup after 24 hours. To withdraw document-processing consent or request deletion of submitted documents, contact Marcin using the contact details on this website. Documents are not sent to analytics or automatically submitted to a lender.

AI assistant

Simple greetings and thanks are answered in your browser without contacting the AI service. The processing described below applies to questions that need an AI response.

The optional AI assistant sends your question, up to four recent questions and current published website content to Cloudflare Workers AI only when you send a message. Do not enter identity numbers, bank details, health information or documents. The site keeps the conversation in browser memory, clears it on reload or when you select Clear conversation, and does not store chat transcripts in the enquiry database or application logs. Responses may be incorrect. If you choose to contact Marcin, only the question and contact details you review and submit are saved as an enquiry. An admin email notification links to the enquiry. Cloudflare Turnstile and rate limits help prevent misuse. Cloudflare processes requests under its service data-processing terms.

Optional website analytics

Optional Google Analytics via Google Tag Manager, Microsoft Clarity (masked session recordings and heatmaps), and Cloudflare Web Analytics where configured. Form contents and calculator financial inputs are excluded from tracking. Nothing loads until you accept analytics. Your choice lasts 180 days. Uncheck and save, or forget your choice, to withdraw consent; the page reloads to stop collection.

Preference record: mb-web-analytics-consent-v2 (180 days). Google Analytics uses _ga cookies; Microsoft Clarity uses _clck and _clsk cookies. GTM manages the analytics tags. Analytics consent does not grant advertising consent. Admin and authentication pages are excluded. Change or withdraw your choice through Cookie Settings in the footer. Provider information: https://policies.google.com/privacy and https://privacy.microsoft.com/privacystatement.

Calculator PDF downloads

A PDF is generated in your browser after you request a download and complete Cloudflare Turnstile verification. Verification uses a token and technical connection information; it does not send mortgage inputs or calculator results. The file contains the results from when you requested the download and is saved on your device.