Privacy and cookie policy

1. Controller and contact

The controller of your data is Michał Sulawiak, doing business as House of Clouds Michał Sulawiak, ul. Zygmunta Słomińskiego 19 lok. 145, 00-195 Warsaw, Poland, tax ID (NIP) 8513157946, REGON 367221691 (“we”).

For data protection matters, write to [email protected] or by post to the address above. For anything else: [email protected].

2. What data and why

We may also use data from any of these situations where needed to establish, pursue or defend legal claims.

3. Legal bases

• Our legitimate interest (Article 6(1)(f) GDPR): replying to enquiries and correspondence, handling requests sent through the “Free call” form (section 9), recording calls you agree to at the start of the call (section 9), contacting you about an offer, website security and server logs, cookieless visitor statistics, strictly necessary cookies, establishing, pursuing and defending legal claims.
• Steps taken at your request before entering into a contract (Article 6(1)(b) GDPR): preparing an offer.

Providing data is voluntary, but without it we cannot reply to your enquiry. We do not make automated decisions about you.

4. Recipients

We entrust data to companies that run the website and email for us. They act on our instructions under a data processing agreement. They are:

• website operation — Nicetronic Andrzej Sulawiak (Pilchowo, Poland), the owner of the servers and of the server room that host our servers: the one running the website and the CRM system in which we handle form requests, and the one storing call recordings and their transcripts (section 9). Nicetronic also provides the network and backups in Poland;
• traffic delivery and protection — Cloudflare, Inc. (USA): traffic to the website passes through its network; it handles the domain, encrypts the connection and protects the website against attacks. Tailscale Inc. (Canada): encrypted connection between Nicetronic's servers. Traffic usually flows directly between them, but it may pass through a Tailscale relay server. It is then end-to-end encrypted, so Tailscale cannot see its content;
• email — Microsoft Ireland Operations Ltd. (Ireland), Microsoft 365;
• AI tools — providers of AI tools we use to handle correspondence and requests, acting on our instructions.

Visitor statistics are collected by Umami, a tool installed on our server next to the website. Statistics data is not shared with the tool's vendor or any other company.

We transcribe and process call recordings (section 9) with transcription and AI tools running only on our servers. Recordings and transcripts are not shared with the vendors of these tools or any other company.

We will give you the current list of companies on request (section 1). We also disclose data to public authorities where the law requires it.

5. Transfers outside the EEA

Cloudflare, Microsoft and Tailscale may also process data outside the European Economic Area, including in the USA. This is based on a European Commission adequacy decision (for the USA: the EU-US Data Privacy Framework) or on standard contractual clauses approved by the Commission. AI tool providers may also process data outside the EEA, based on a European Commission adequacy decision or standard contractual clauses. You can get a copy of these safeguards by writing to us (section 1).

6. How long we keep data

• Enquiries and correspondence: until the matter is closed, then for no more than 12 months. If we enter into a contract, we keep them until legal claims become time-barred.
• “Free call” form requests: 12 months from our last contact with you about the request. If we enter into a contract, we keep them until legal claims become time-barred.
• Call recordings: until the written diagnosis is ready, and no longer than 30 days after the call. We keep transcripts as long as form requests.
• Server logs: up to 6 months, unless needed to investigate a security incident.
• Visitor statistics: 24 months.
• Backups: the servers the website runs on and the servers storing call recordings have backups kept for up to 10 years. They may contain server logs, statistics, form requests, call recordings and their transcripts. We use backups only to restore a system after a failure, and after restoring we delete from it any data whose retention period has passed.
• Cookies: for the period given in the table in section 8.
• Data needed for legal claims: until the claims become time-barred.

7. Your rights and complaints

You have the right to:

• access your data and get a copy of it;
• have your data corrected;
• have your data erased;
• restrict processing;
• data portability, for data we process as steps taken before entering into a contract;
• object to processing based on our legitimate interest.

Write to us (section 1) and we will reply within one month.

If you believe we process your data unlawfully, you can lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the supervisory authority in your EU country.

8. Cookies

Cookies are small files stored in your browser. Other technologies, such as pixels and the browser's local storage, work in a similar way. This section covers all of them.

The website does not use analytics or marketing cookies or advertising pixels.

Strictly necessary cookies keep the website secure. We use them without consent (Article 399(3) of the Polish Electronic Communications Law). You can delete or block cookies in your browser settings. Blocking strictly necessary cookies may, however, make the website harder to use.

Visitor statistics (Umami)

Visitor statistics are collected by Umami, a tool installed on our server. It records pages visited and their titles, the referring page, browser, operating system and device type, language, screen resolution, approximate location (country, region, city), clicks on links to recommendations on LinkedIn and form submissions (without their content).

Umami uses no cookies and does not store your IP address. It links visits using an identifier computed one-way from the IP address and browser data, from which the IP address cannot be recovered. It does not track you on other websites, and statistics data is not shared with the tool's vendor or any other company.

The legal basis is our legitimate interest (Article 6(1)(f) GDPR): knowing which content on the website is read. You can object and turn off statistics in this browser:

The button saves the entry umami.disabled in your browser's local storage. As long as the entry exists, no statistics are sent. To do it manually, open the browser console on this page and type localStorage.setItem('umami.disabled', '1'). The entry disappears when you clear the site data in your browser. Statistics also do not work when JavaScript is disabled or the browser blocks stats-data.msulawiak.pl.

9. “Free call” form

On our pages you can ask for a free call. We first give you a short call, and if it makes sense, we book a 30-minute diagnostic call, after which we prepare a written diagnosis. Your request comes to us (section 1).

• Data: name, company, job title, company size, business email, phone number, the area you want to improve and your preferred call time. We also record the date of the request, the page it was sent from and the campaign tag in the link (UTM parameters), if the link has one.
• Why: we send you a confirmation email, call you at the time you chose (if you don't answer, we will try again), hold the diagnostic call, prepare a written diagnosis and, if you wish, an offer for your company.
• Legal basis: our legitimate interest in replying to your request and contacting you about an offer (Article 6(1)(f) GDPR). Where you yourself are to be the party to the contract, for example as a sole trader, the basis is also steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). Calls and emails about your request are contact you ask for by giving your number and address in the form (Article 398 of the Polish Electronic Communications Law). We do not send you any other marketing without your separate consent.
• Call recording: we may record the phone call about your request and the diagnostic call, solely to transcribe the call and prepare the written diagnosis from it. At the start of the call we ask whether you agree. If you don't, we don't record. The recording and transcript stay on our servers. Only the person who led the call on our side uses them, with the help of transcription and AI tools running on those servers. We do not publish them or share them with anyone. The legal basis is our legitimate interest in an accurate diagnosis based on what was said in the call (Article 6(1)(f) GDPR). We delete the recording once the diagnosis is ready, and no later than 30 days after the call. We keep the transcript as long as the request (section 6).
• Recipients: Nicetronic, the owner of the servers that host our CRM system in which we handle requests and store call recordings, and Microsoft 365, through which we send the confirmation email and receive the notification of your request (section 4).
• How long: as in section 6.
• Voluntary: providing data is voluntary, but without the required fields we cannot accept your request or call you back.

You can object or ask us to delete your request at any time (sections 1 and 7).

10. Changes to this policy

We update this policy when the tools on the website or the law change. We publish the new version on this page with a new date.

Version 1.2, effective from 24 October 2026.