Effective from 8 November 2026.
This policy explains what personal data we collect, for what purpose, how long we retain it, and what rights you have. We apply it in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), the Act of 10 May 2018 on the protection of personal data, and the Act of 12 July 2024 – the Electronic Communications Act.
1. Data controller
The controller of your personal data is TREJKA Sp. z o.o. with its registered office in Białystok, ul. Moniuszki 31a, 15-192 Białystok, entered in the National Court Register (KRS) under number 0000423570, Tax Identification Number (NIP) 9662085626, REGON 200704864 (hereinafter: „TREJKA”, „we”).
For matters relating to personal data, please contact us:
- contact person: Bartosz Stępniewski,
- email: well****@****ka.com,
- telephone: +48 695 423 811,
- by post: TREJKA Sp. z o.o., 31a Moniuszki Street, 15-192 Białystok.
2. Who is covered by this policy?
This policy applies to people who:
- visit the trejka.com website,
- contact us via the forms (contact, enquiry about working with us, quote calculator), by email or by telephone,
- are our clients or contact persons on the part of our clients and business partners,
- use the customer portal at panel.trejka.com,
- follow our social media profiles.
Data that we process on behalf of our clients. As we provide WordPress maintenance, IT support, backup and email services, we have access to data stored on our clients’ websites, servers, computers and email accounts. In this regard, we act as a data processor under a data processing agreement (Article 28 of the GDPR), whilst our client is the data controller. The rules governing the processing of this data are set out in the agreement with the client, not in this policy.
3. What data do we process, for what purpose and for how long?
| Objective | Data | Legal basis | Retention period |
|---|---|---|---|
| A reply to a message sent via the contact form, by email or by telephone | first name and surname, email address, telephone number, name of organisation or company, message content | Article 6(1)(f) of the GDPR – our legitimate interest in conducting correspondence | for the duration of the correspondence, and if no collaboration takes place – for up to 12 months from the last contact |
| Preparing a quotation or offer (the „Enquiry about cooperation” form, the quotation calculator) | as above, plus the website address, type of organisation, selected services and their scope, preferred method of contact, and additional information about the project | Article 6(1)(b) of the GDPR – actions taken at your request prior to entering into a contract; in the case of individuals acting on behalf of a company or organisation – Article 6(1)(f) of the GDPR | until the contract is concluded, or, if this does not happen, for up to 12 months from the date the offer was sent |
| Conclusion and fulfilment of the contract (WordPress support, IT support, backups, one-off services), handling of enquiries and faults, reports | identification and contact details of the client and contact persons, company details, history of requests and work carried out | Article 6(1)(b) of the GDPR (contract); for contact persons on the client’s side – Article 6(1)(f) of the GDPR | for the duration of the contract, and thereafter until the expiry of the limitation period for claims |
| Managing your account in the customer portal at panel.trejka.com | full name, email address, login details, information about activity in the dashboard | Article 6(1)(b) of the GDPR; for the client’s contact persons – Article 6(1)(f) of the GDPR | for the duration of the contract; once it has ended, we delete the account |
| Invoicing, accounting, tax and accounting obligations | data from invoices and accounting documents | Article 6(1)(c) of the GDPR – legal obligation | 5 years from the end of the calendar year in which the tax payment deadline expired |
| Identification, investigation and defence of claims | information necessary to substantiate a claim or a defence | Article 6(1)(f) of the GDPR | until the expiry of the limitation period for claims |
| Website security and protecting forms from spam | IP address, browser and device details, date and time of visit, data entered into the form | Article 6(1)(f) of the GDPR – our legitimate interest in protecting the website | for as long as is necessary to ensure safety, but for no longer than 12 months |
| Informing customers about important matters relating to our services (e.g. security incidents, changes to our offering) | full name, email address, telephone number | Article 6(1)(f) of the GDPR; we will only send you commercial communications by electronic means with your consent | until the end of the business relationship, the lodging of an objection or the withdrawal of consent |
| Statistical, personalisation and marketing cookies | cookie identifiers, data on website usage | Article 6(1)(a) of the GDPR and Article 399 of the Electronic Communications Act – your consent | until consent is withdrawn or the cookie expires |
| Managing social media profiles | profile name, content of comments and messages, reactions | Article 6(1)(f) of the GDPR – communication with followers | for the removal of content by you or by us |
Providing your details is voluntary, but without them we will not be able to reply to your message, prepare a quote or enter into a contract. The details required for invoices are mandated by law.
4. Who we share data with
We do not sell personal data. We only pass it on when necessary to the following recipients:
- hosting and server providers on which the website and our systems operate,
- Cloudflare, Inc. – content delivery network and website protection,
- CleanTalk – a service that protects forms from spam; when a form is submitted for review, the information sent includes, amongst other things, the IP address, email address and message content,
- the providers of the email and communication tools we use,
- a cloud storage provider where we store our backups (storage within the European Union),
- accountancy firms, law firms, banks and payment service providers – in relation to accounting and legal services,
- public authorities – only where required by law.
We enter into data processing agreements with suppliers acting on our behalf.
5. Transfer of data outside the European Economic Area
We store backups and customer data within the European Union. Some technical service providers (e.g. Cloudflare, CleanTalk) may also process data outside the EEA, including in the United States. In such cases, the transfer is based on a decision by the European Commission confirming an adequate level of protection (the EU-US Data Privacy Framework) or on standard contractual clauses approved by the European Commission. You can obtain a copy of these safeguards by contacting us.
6. Your rights
In relation to the processing of your data, you have the right to:
- access to data and the right to obtain a copy thereof (Article 15 of the GDPR),
- rectification of data (Article 16 of the GDPR),
- the right to erasure (Article 17 of the GDPR),
- restrictions on processing (Article 18 of the GDPR),
- data portability (Article 20 of the GDPR) – where we process data on the basis of a contract or consent,
- objection to processing (Article 21 of the GDPR) – where we process data on the basis of our legitimate interest,
- to withdraw consent at any time – without this affecting the lawfulness of the processing carried out prior to its withdrawal.
To exercise these rights, please write to well****@****ka.com. We will reply without undue delay, within one month at the latest.
You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office, 2 Stawki Street, 00-193 Warsaw, uodo.gov.pl.
7. Automated decisions and profiling
We do not make decisions about you based solely on automated processing, including profiling, which would have legal effects or similarly significantly affect you. The price calculator shows only an indicative price – the final quote is prepared by a member of staff.
8. Cookies
Cookies are small text files stored on your device by your browser. On your first visit, we display a banner where you can choose which categories of cookies you consent to:
- Necessary – always active, as the website won’t work properly without them. They are used, amongst other things, to remember your choices in the cookie banner (for 365 days), to protect forms from spam and bots, and to handle the login process.
- Statistics – they help us understand how you use the website. We only use them with your consent.
- Personalization – they remember your settings and preferences. We only activate them with your consent.
- Marketing – are used to display targeted adverts for our services. We only activate them with your consent.
At present, the website does not use any external analytics or advertising tools (such as Google Analytics or Meta Pixel). Should we implement them, they will only be activated once consent has been given, and we will add a list of them to this policy.
You can change or withdraw your consent at any time via the cookie settings available on the website. You can also block or delete cookies via your browser settings – however, blocking essential cookies may make it difficult to use the website.
9. Social media
The website contains links to our profiles on Facebook, Instagram, X, YouTube and LinkedIn. These are simply links – no data is sent to these platforms until you click on them. Once you visit a profile, that platform’s privacy policy applies. With regard to profile statistics on Facebook and Instagram, we are a joint data controller together with Meta Platforms Ireland Ltd.
10. Data security
Security is part of our day-to-day work, so we protect data in the same way we protect our customers’ data: we use an encrypted connection (SSL/TLS), access control and two-factor authentication, regular updates, monitoring and encrypted backups stored within the European Union. Only authorised personnel have access to the data.
11. Policy changes
We may update this policy if the law, our services or the tools we use change. The current version is always available on this page, and we state the date of the last update at the top of the document.
