Privacy Policy

Last updated: 8 November 2026

1. Personal Data Controller

The controller of personal data processed in connection with the use of the website https://forneus.pl and business cooperation is Kamil Kocon, conducting business under the name FORNEUS TECHNIKA KAMIL KOCON, Polish Tax Identification Number (NIP): 8241809032.

• Correspondence address: Jartypory 189, 07-100 Jartypory, Poland
• Email: info@forneus.pl
• Website: https://forneus.pl

For matters relating to personal data protection, including the exercise of rights under the General Data Protection Regulation (GDPR), please contact the controller using the email address above.

2. Categories of Personal Data Processed

Depending on the nature of the enquiry or business relationship, the controller may process the following personal data:

• full name;
• email address and telephone number;
• company name, job title or role of the contact person;
• address, Polish Tax Identification Number (NIP) and other identifying information necessary to conclude or settle a contract;
• information contained in correspondence, quotation requests and business arrangements;
• data contained in contracts, orders, invoices and service-related documentation;
• technical data associated with use of the website, including IP address, browser and device information, and website activity.

Personal data is processed only to the extent necessary for the purposes specified below.

3. Purposes and Legal Bases of Processing

3.1. Handling Enquiries and Correspondence

Data submitted via the contact form, email or other communication channels is used to respond to enquiries, prepare quotations and conduct correspondence.

• Article 6(1)(b) GDPR — taking steps at the request of the data subject prior to entering into a contract;
• Article 6(1)(f) GDPR — the controller’s legitimate interest in conducting business communications and handling enquiries.

3.2. Entering Into and Performing Contracts

Data relating to clients, contractors and their representatives is processed in connection with the provision of services, particularly event technical support, sound engineering, stage production coordination and equipment rental.

• Article 6(1)(b) GDPR — entering into and performing a contract to which an individual is a party;
• Article 6(1)(f) GDPR — the controller’s legitimate interest in managing business relationships, including communication with representatives of business entities.

3.3. Accounting and Legal Obligations

Data contained in accounting and tax documents is processed for bookkeeping, issuing invoices and complying with legal obligations. The legal basis is Article 6(1)(c) GDPR.

3.4. Establishment, Exercise and Defence of Legal Claims

Data may be processed to establish, pursue or defend against claims arising from business activities. The legal basis is Article 6(1)(f) GDPR.

3.5. Website Security

Technical data may be processed to ensure website security, prevent abuse and diagnose technical issues. The legal basis is Article 6(1)(f) GDPR.

3.6. Website Analytics

With the user’s consent, the controller uses Google Analytics 4 to analyse website traffic and improve its functionality. The legal basis is Article 6(1)(a) GDPR.

4. Contact Form

The website uses a contact form powered by the Contact Form 7 plugin for WordPress. Messages submitted through the form are delivered to the controller’s email inbox hosted by OVH and are not additionally stored in the WordPress database.

Providing personal data is voluntary; however, the fields marked as required must be completed to send a message and receive a response. Data submitted through the form is not used to automatically subscribe users to a newsletter or send unsolicited marketing communications.

5. Contact Form Protection and CAPTCHA

The website uses mechanisms designed to protect against spam and automated form submissions, including CAPTCHA 4WP for WordPress and Google reCAPTCHA v2 for the contact form.

Google reCAPTCHA may process technical data, particularly IP addresses, browser and device information, and information about users’ interactions with the website.

The reCAPTCHA mechanism may operate before consent to optional cookies has been given. Its purpose is to protect the website against abuse. The controller’s legal basis for processing personal data for this purpose is Article 6(1)(f) GDPR. The use of cookies or similar technologies is also subject to applicable rules governing the storage of information on, and access to, users’ devices.

Further information: Google Privacy Policy.

6. Google Analytics 4

The website uses Google Analytics 4, an analytics service provided by Google. This tool enables analysis of information such as the number of visits, pages viewed, users’ approximate locations, devices used and interactions with the website.

Google Analytics 4 is activated after the user consents to statistics cookies through the Complianz consent management mechanism. Users may refuse consent, change their preferences or withdraw consent at any time.

Data retention settings in Google Analytics 4:

• event data — 2 months;
• user data — 14 months;
• resetting the user data retention period upon new activity — enabled.

These periods apply to data covered by the Google Analytics 4 retention settings and do not necessarily mean that all aggregated reporting data is automatically deleted. The controller does not currently use Google Ads or Meta Pixel for remarketing campaigns on the website.

7. Cookies and Consent Management

The website uses cookies and similar technologies. Some are necessary for the website to function properly, while others — particularly analytics cookies — are used only after the appropriate consent has been obtained.

Consent is managed using the Complianz plugin. Users can accept optional cookies, reject them, customise their preferences, or change and withdraw previously given consent.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. Detailed information about cookies is provided in a separate Cookie Policy (EU), available on the website.

8. Hosting, Email and Infrastructure

The website runs on WordPress and uses hosting services provided by OVH. Email services for the forneus.pl domain are also provided by OVH.

In connection with these services, technical data and correspondence may be processed, including information contained in messages submitted through the contact form. The infrastructure provider may process data to the extent necessary to provide hosting and email services and ensure their security.

9. Invoicing, Accounting Services and KSeF

The controller uses the services of Ototax accounting office, which provides bookkeeping and tax services and an online invoicing system.

In connection with these services, Ototax may process personal data relating to clients and contractors, particularly identification and address details, contact information and data contained in accounting records and invoices.

Invoices are submitted to the Polish National e-Invoicing System (KSeF), operated by the Polish tax administration. The controller’s legal basis for processing personal data to fulfil accounting and tax obligations is Article 6(1)(c) GDPR.

Accounting and tax records are retained for the periods required by applicable law. Structured invoices are stored in KSeF for 10 years, calculated from the end of the year in which they were issued.

10. Recipients of Personal Data

Personal data may be disclosed to entities whose services are necessary for business operations, in particular:

• OVH — hosting and email service provider;
• Google — in connection with Google Analytics 4 and Google reCAPTCHA;
• Ototax — accounting and tax service provider and provider of an online invoicing system;
• the Polish tax administration — in connection with tax obligations and the use of KSeF;
• technical or IT service providers, where they have access to personal data;
• public authorities entitled to receive data under applicable law.

Depending on the nature of the relationship, recipients may act as processors on behalf of the controller or as independent controllers. The controller does not sell personal data to third parties.

11. Cooperation With International Clients and Contractors

Forneus Technika also works with clients and contractors based outside Poland. Personal data relating to contact persons and representatives, as well as data necessary for performing contracts, may be processed when preparing quotations, providing services, renting equipment and handling payments.

Data may be shared with international clients and contractors to the extent necessary for a specific business relationship. Operating internationally does not, in itself, mean that all website users’ personal data is transferred outside the European Economic Area.

12. Transfers of Personal Data Outside the European Economic Area

The use of Google services, as well as certain forms of international business cooperation, may involve transfers of personal data outside the European Economic Area (EEA).

Where such transfers occur, the controller relies on appropriate legal grounds and safeguards provided for in Chapter V GDPR, depending on the recipient and the circumstances. These may include European Commission adequacy decisions or standard contractual clauses, together with additional safeguards where required.

Information about safeguards applicable to a specific transfer can be obtained by contacting the controller.

13. Personal Data Retention Periods

13.1. Correspondence and Quotation Requests

Data is retained for as long as necessary to handle the matter and, where justified, for a period allowing the establishment, exercise or defence of potential legal claims, taking into account applicable limitation periods.

13.2. Client, Contractor and Contractual Data

Data is retained for the duration of the business relationship and subsequently for the period required by legal obligations or justified by the need to establish, exercise or defend legal claims.

13.3. Accounting and Tax Records

Data is retained for the period required by law, taking into account the specific rules applicable to KSeF.

13.4. Analytics Data

Retention periods for data covered by the Google Analytics 4 retention settings are specified in Section 6.

13.5. Technical Data and Cookies

Retention periods depend on the type of data and technologies used. Details concerning cookies are provided in the separate Cookie Policy.

Personal data is not retained longer than necessary for the relevant purpose, unless further retention is required by law or justified by another applicable legal basis.

14. Rights of Data Subjects

Individuals whose personal data is processed have rights under the GDPR, subject to the conditions and limitations set out in applicable law, including:

• the right of access to personal data;
• the right to rectification;
• the right to erasure;
• the right to restriction of processing;
• the right to data portability, where applicable;
• the right to object to processing based on legitimate interests;
• the right to withdraw consent at any time.

To exercise these rights, please contact the controller at info@forneus.pl. Data subjects also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO): https://uodo.gov.pl.

15. Voluntary Provision of Data and Sources of Data

Providing data through the contact form is voluntary, but completing the required fields is necessary to submit a message. Certain data may also be necessary to enter into a contract, provide a service or comply with legal obligations.

Data may be obtained directly from the individuals concerned or, in business relationships, from their employers, the entities they represent or individuals who share contact details in connection with business cooperation.

16. Automated Decision-Making

The controller does not make decisions concerning data subjects based solely on automated processing that would produce legal effects or similarly significantly affect them. CAPTCHA mechanisms may automatically assess the risk of abuse associated with use of the website and contact form.

17. Data Security

The controller implements technical and organisational measures appropriate to the nature of the personal data processed and the associated risks. Connections to the website are secured using HTTPS. Access to personal data is restricted to persons and entities that require it to perform specific tasks.

18. Changes to This Privacy Policy

This Privacy Policy may be updated to reflect changes in website operation, services used, business processes or applicable law. The current version of this document is published on the website at https://forneus.pl/en/privacy-policy/.