Privacy Policy

Effective from 23 September 2026. This is an English translation. If it differs from the Polish version, the Polish version prevails.

This policy explains how Outofplace Poland sp. z o.o. processes personal data in connection with the website www.outofplace.space (in Polish and English), correspondence, and work with clients and suppliers. It provides the information required by Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

1. Controller

The controller of your personal data is Outofplace Poland sp. z o.o., with its registered office in Łomża, ul. Żabia 4, 18-400 Łomża, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) kept by the District Court in Białystok, 12th Commercial Division of the National Court Register, under KRS number 0001163427, NIP (tax ID) 7182173789, REGON 541259259, share capital PLN 5,000 (“Outofplace”, “we”).

For any matter concerning personal data, contact us:

• by e-mail: contact@outofplace.space,
• by phone: +48 502 856 472,
• by post: Outofplace Poland sp. z o.o., ul. Żabia 4, 18-400 Łomża, Poland.

We have not appointed a data protection officer, as Article 37 GDPR does not require one.

2. Who this policy covers

• visitors to the website,
• people who e-mail or call us,
• people representing our clients, prospective clients, suppliers and partners, and people they name as contacts,
• people who contact us through our profiles on Instagram, LinkedIn and Dribbble,
• people who send us job applications.

3. What data we process and where it comes from

Visiting the website. The website has no forms, user accounts, newsletter or payments. We use no analytics tools, advertising pixels or social media plugins. Each time a page is displayed, your browser transmits technical data that our hosting provider processes and that may be recorded in server logs: IP address, date and time of the request, page address, server response code, referring page, and browser and operating system information. The website may also store a cookie with your chosen language in your browser (section 10).

Contact. Clicking our e-mail address or phone number opens your e-mail program or calling app, and the copy button places our e-mail address on your device’s clipboard. The website sends us no data when you do this. When you e-mail or call us, we process the data you give us: name, e-mail address, phone number, company and job title, and the content of messages and attachments. We do not record phone calls.

Working with companies. We receive data of people representing clients, suppliers and partners, and of people named as contacts (name, business e-mail and phone number, job title, employer or principal), from those people or from the company they represent. Sometimes we obtain it from public sources: the company’s website, the Polish National Court Register (KRS), the Central Register of Business Activity (CEIDG) or a professional profile such as LinkedIn.

Social media. If you follow our profiles, comment or message us on Instagram, LinkedIn or Dribbble, we process your profile name, public profile information and the content of your comments and messages.

Recruitment. If you send us a CV, portfolio or cover letter, we process the data in those documents. Please do not send special categories of data, such as health data, unless necessary.

4. Purposes and legal bases

• Providing the website under the Terms of Service: Article 6(1)(b) GDPR (provision of an electronic service).
• Website security, abuse detection and troubleshooting, including server logs: Article 6(1)(f) GDPR. Our legitimate interest is a working, secure website.
• Remembering your chosen language version: Article 6(1)(f) GDPR (convenient use of the website in your chosen language), to the extent the cookie holding the language code is personal data.
• Replying to messages and keeping up correspondence: Article 6(1)(f) GDPR (answering enquiries and maintaining business relationships). If you ask about entering into a contract with you: Article 6(1)(b) GDPR (steps taken at your request before entering into a contract).
• Preparing offers, entering into and performing contracts: Article 6(1)(b) GDPR where you are the contracting party (e.g. a sole trader); Article 6(1)(f) GDPR where you represent a company or are its named contact (entering into and performing the contract with that company).
• Invoicing, accounting and tax: Article 6(1)(c) GDPR in connection with the Polish Accounting Act, Tax Ordinance and VAT Act.
• Establishing, pursuing and defending legal claims: Article 6(1)(f) GDPR.
• Running our social media profiles: Article 6(1)(f) GDPR (informing about our work and communicating with our audience).
• Recruitment: Article 6(1)(b) GDPR (steps taken at your request before entering into a contract), and for employment contracts also Article 6(1)(c) GDPR in connection with Article 22¹ of the Polish Labour Code. Data you provide on your own initiative beyond what is required: Article 6(1)(a) GDPR (consent given by sending it). Keeping your application for future recruitment: only with your separate consent (Article 6(1)(a) GDPR).

We do not send a newsletter. We send commercial information electronically only if you have agreed to it in advance.

5. Do you have to provide data

Providing data is voluntary. Without contact details, however, we cannot reply to you, and without the data needed for a contract we cannot conclude or perform it. Invoicing data is required by tax law. Technical data such as your IP address is necessary for the website to be displayed in your browser.

6. Recipients

We entrust data to processors acting on our behalf under data processing agreements:

• Vercel Inc. (USA): website hosting and content delivery network (CDN), including server logs;
• Cloudflare, Inc. (USA): DNS for the outofplace.space domain; website traffic does not pass through Cloudflare’s servers, and Cloudflare processes only technical DNS query data;
• Spaceship, Inc. (USA): e-mail for the outofplace.space domain (Spacemail service);
• providers of accounting, legal and IT services and of communication and office tools, to the extent needed for their services.

As separate controllers, data may be received by:

• the operators of Instagram, LinkedIn and Dribbble, regarding your activity on those platforms, under their privacy policies. For statistics about our profiles we may be a joint controller with the platform operator, on terms set by that operator;
• banks and payment providers, for settlements;
• public authorities and courts, only where the law requires it.

We do not sell personal data or share it with others for marketing purposes.

7. Transfers outside the European Economic Area

Vercel, Cloudflare and Spaceship are based in the USA, and their infrastructure also operates outside the EEA. Transfers are based on:

• Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection of personal data under the EU-US Data Privacy Framework (Article 45 GDPR), for Vercel Inc. and Cloudflare, Inc., which are certified under it (list of certified companies: dataprivacyframework.gov (opens in a new tab)). Both companies also use standard contractual clauses;
• standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 (Article 46(2)(c) GDPR), for Spaceship, Inc.

You can request a copy of these safeguards at contact@outofplace.space.

8. How long we keep data

• Server logs: up to 30 days.
• Language cookie: until the end of your browser session.
• Correspondence: as long as needed to handle the matter, then up to 3 years from the last message, matching the limitation period for claims related to business activity (Article 118 of the Polish Civil Code). Correspondence about a contract is kept like contract data.
• Contract data: for the term of the contract and then until claims become time-barred: as a rule 3 years for business-related claims and 6 years for others, with the period ending on the last day of a calendar year.
• Accounting and tax documents, such as invoices: 5 years from the end of the calendar year in which the tax payment deadline passed.
• Social media: as long as the content remains on our profile or until you or the platform operator remove it; messages: like correspondence.
• Job applications: until the recruitment ends. If we are not recruiting, we reply and delete the application within 30 days. With your consent to future recruitment: up to 12 months or until you withdraw consent.

Data processed on the basis of legitimate interest is deleted earlier if you successfully object.

9. Your rights

You have the right to:

• access your data and receive a copy (Article 15 GDPR),
• rectification (Article 16 GDPR),
• erasure (Article 17 GDPR),
• restriction of processing (Article 18 GDPR),
• data portability for data we process by automated means on the basis of a contract or consent (Article 20 GDPR),
• object to processing based on our legitimate interest, on grounds relating to your particular situation (Article 21 GDPR). After an objection we stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or grounds for establishing, pursuing or defending legal claims,
• withdraw consent at any time where processing is based on it. Withdrawal does not affect the lawfulness of processing before it.

To exercise these rights, write to contact@outofplace.space or to our registered address. We reply within one month. For complex requests this may be extended by two further months, and we will tell you if so. We may ask for information needed to confirm your identity.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland (uodo.gov.pl (opens in a new tab)).

10. Cookies

The website uses no analytics, advertising or tracking cookies. Under normal conditions it stores no cookies; the language version is part of the address. In rare cases, when the hosting provider’s protection needs to verify your browser (e.g. during an attack on the website), Vercel stores a short-lived security cookie. Details are in our Cookie Policy.

11. Automated decisions and profiling

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). We do not profile website visitors.

12. Security

We apply technical and organisational measures appropriate to the risk (Article 32 GDPR). The website is served only over encrypted HTTPS, and access to mailboxes and documents is limited to people who need it. Please do not send us passwords or special categories of data by e-mail.

13. Links to other websites

The website links to other services, including our social media profiles, the websites of our brands (Portivo, Sprawna Matura, Levera) and clients’ websites. Once you go there, their controllers’ privacy policies apply.

14. Changes to this policy

We update this policy when the way we process data or the law changes. The current version, with its effective date, is always available on this page.