Privacy Policy

The data we collect

You provide your email address through the form. We also record your chosen language, submission date and time, and evidence of consent: its date and time, language and the version of the policy and associated consent wording. We trim whitespace and lowercase email addresses to avoid duplicate requests.

If you email us directly or reply to our email, we also process information you include in that correspondence. Please avoid sending information that is unnecessary for your enquiry.

Why we use your data and the legal basis

We process form submissions with your consent (Article 6(1)(a) GDPR) to contact you by email about Cohesto and answer questions about our services. This consent covers that follow-up, not newsletter subscriptions or advertising campaigns unrelated to your enquiry.

Providing your data and consent is voluntary. We cannot accept a request through the form without an email address and consent. Browsing the website does not require consent to email contact.

If you contact us directly, we respond on the basis of our legitimate interest in handling enquiries (Article 6(1)(f) GDPR). Handling requests about your data rights is based on our legal obligations (Article 6(1)(c) GDPR).

How long we keep your data

We retain your enquiry and consent record until the necessary follow-up ends, for no longer than 12 calendar months from your first submission. We delete them sooner if no longer needed or if you withdraw consent. Resubmitting the same address does not extend this period. The same maximum applies to direct email enquiries, measured from the first message.

This period also applies to copies used to handle the enquiry, including exports and backups. If we begin working together, data needed for a contract will be covered by separate privacy information; this does not automatically extend retention of the contact-form submission.

Who can access your data

The controller and authorised people can access the data only as needed to handle your enquiry. We use Vercel to host the website and process the form, MongoDB Atlas to store submissions in a document database in Frankfurt, and Google Workspace for email correspondence. There is no public address list or automated email delivery from the form.

Infrastructure providers may also process technical connection data such as IP address, request time and browser information. The contact database contains only the fields described above. We do not sell your data. We may provide data to competent authorities if required by law.

Processing outside the EEA

Our providers operate internationally. Website hosting, support and email may involve processing outside the European Economic Area, including in the USA; choosing Frankfurt for the database does not mean every provider operation stays in the EEA. Contact the controller for information about the transfer mechanisms applicable to a service and a copy of the safeguards used. Provider documentation describes mechanisms including standard contractual clauses and, where applicable, adequacy decisions.

Your consent and your rights

You can withdraw consent at any time by emailing hello@cohesto.com. No account or explanation is required. Withdrawal does not affect the lawfulness of processing before you withdrew consent.

You can request access, correction, erasure and restriction of processing. You also have a right to data portability where the GDPR provides for it. Where processing relies on our legitimate interests, you can object on grounds relating to your particular situation.

Email the address above to exercise your rights. We may request information necessary to verify your identity. We respond without undue delay, normally within one month. If an extension is permitted under the GDPR and necessary, we will tell you within that month and explain why.

Email us about your data

You may complain to the President of Poland’s Personal Data Protection Office (UODO) or another competent EU supervisory authority, particularly in the country of your habitual residence or workplace. Polish Personal Data Protection Office.

Cookies and automated decisions

The website does not use analytics or advertising cookies. The form does not save consent in cookies or browser storage. We do not profile people who leave their email address or make solely automated decisions about them that have legal or similarly significant effects.

Changes to this policy

The effective date and version identify the current policy. When you submit the form, we record the version presented when you gave consent. A material change in the purpose of processing requires an appropriate legal basis and fresh consent where required.