Skip to content
Legal Updated: 6 July 2026

Polityka prywatności

1. Data controller

The controller of your personal data is Tomasz Turmowicz, operating a sole proprietorship under the name „tophat.pl — agencja kreatywna”, with its registered office at ul. Warszawski Świt 12B/1, 03-368 Warsaw, Poland.

  • NIP (Tax ID): 7142026846
  • REGON: 384762554
  • Data protection contact: kontakt@tophat.pl

For any GDPR-related matters you can reach us by email at kontakt@tophat.pl or by post at the registered address above.

2. What data we collect and why

We collect only the data you provide yourself in the contact form available on tophat.pl:

  • name (or the form in which you’d like us to address you),
  • email address (for our reply),
  • company name (optional),
  • how you heard about us (optional),
  • planned timeline,
  • approximate project budget,
  • the services you’re interested in (multi-select),
  • your message.

The system also records the IP address the form was sent from — solely for technical purposes (limiting abuse and protecting against spam). The IP address is not used for profiling or marketing analytics.

Purpose of processing: responding to your inquiry, preparing a quote and conducting commercial correspondence.

Legal bases (GDPR):

  • Art. 6(1)(b) — steps taken at your request prior to entering into a contract,
  • Art. 6(1)(f) — our legitimate interest in communicating with potential clients,
  • Art. 6(1)(a) — your consent given by ticking the checkbox in the form.

The contact form is the only place where you knowingly provide us with your data — the site has no newsletter, comments or user registration. Details on analytics and marketing cookies (Google Analytics, Google Ads and others) are in section 7.

3. Who we share data with

Your form data may reach the following recipients (only to the extent necessary to handle your inquiry):

  • LH.pl — the hosting provider for tophat.pl (stores data on the server running the site),
  • Email mailbox provider — relays the form email to kontakt@tophat.pl.

We do not sell, rent or share your data for marketing purposes with any other parties.

4. How long we keep data

  • Contact form submissions: up to 3 years from the last contact (the limitation period for contractual claims) or until you ask us to delete them.
  • IP address logs (spam protection): a maximum of 1 hour — deleted automatically.

5. Your rights

Under the GDPR (Art. 15–22) you have the right to:

  • access your data and receive a copy of it,
  • rectification of inaccurate or incomplete data,
  • erasure of data (the “right to be forgotten”),
  • restriction of processing in certain situations,
  • data portability to another controller,
  • objection to processing based on legitimate interest,
  • withdrawal of consent at any time (withdrawal does not affect the lawfulness of processing carried out beforehand).

To exercise any of these rights, email kontakt@tophat.pl. We will respond within 30 days at the latest.

6. Complaint to the supervisory authority

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the supervisory authority:

President of the Personal Data Protection Office (UODO)
ul. Stawki 2
00-193 Warsaw, Poland
uodo.gov.pl

7. Cookies

The tophat.pl website uses two types of cookies:

Technical cookies (do not require consent):

  • Multilingual cookies (WPML): remember the site language you’ve chosen,
  • WordPress session cookies: used only after logging into the admin panel (does not apply to regular visitors).

Analytics and marketing cookies (only with your consent given in the banner): Google Analytics 4, Google Ads, Meta Pixel, LinkedIn Insight Tag and Microsoft Clarity — used to analyze traffic, measure ad performance and improve site quality.

Google Consent Mode (advanced mode)
The site uses Google Analytics 4 and Google Ads in Consent Mode v2. By default, before you give consent, all Google consent categories are set to “denied” — we do not set analytics or marketing cookies and do not identify you.

In advanced mode, Google’s tools may send so-called cookieless pings: anonymous, aggregated event information (e.g. a page view), without cookies or identifiers. Google uses these only to model aggregate statistics and conversions — they do not allow identification or cross-site tracking. Your IP address is sent with the request (for approximate location, not stored together with an identifier).

After clicking “Accept” we enable full cookie-based measurement. You can withdraw consent at any time in the cookie settings (the “Cookie settings” link in the site footer).

You can also delete cookies at any time in your browser settings.

8. Content embedded from other services

Some subpages contain content embedded from external services:

  • Google Maps — an embedded location map on the /kontakt/ subpage. The controller is Google Ireland Limited.
  • Instagram — embedded posts from our account. The controller is Meta Platforms Ireland Limited.
  • Unsplash — illustrative photos (temporary placeholders in the portfolio section, to be replaced with final work).

These services may collect data about your visit (e.g. IP address, browser type) in accordance with their own privacy policies:

Apart from Google reCAPTCHA (section 9) and the analytics/marketing tools described in section 7 (Google Analytics 4, Google Ads, Meta Pixel, LinkedIn Insight Tag, Microsoft Clarity) — the site does not use any other external scripts or CDNs; fonts (Rubik) and animations (Lottie) are hosted locally on the tophat.pl server.

9. Spam protection (Google reCAPTCHA)

The contact form is protected by Google reCAPTCHA v3, which secures it against spam and automated bots. For this purpose, reCAPTCHA analyzes how you use the site and may collect data such as your IP address, browser information and events (e.g. cursor movements, clicks) — transmitted to Google.

Service provider: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in protecting the contact form against spam and abuse.

Use of reCAPTCHA is subject to the Google Privacy Policy and the Google Terms of Service.

10. Automated decisions and changes to this policy

Profiling and automated decisions: your data is not used for profiling or automated decision-making. All business decisions (preparing a quote, continuing cooperation) are made by us personally.

Changes to the privacy policy: we may update this policy if the way we process data changes or when new legal requirements arise. Every change will be reflected in the “Last updated” section at the top of the document. We will inform you separately of any material changes if we remain in active correspondence.

Have questions about this policy or how we process your data?
Email: kontakt@tophat.pl