1. Data Controller
The data controller for personal data processed through this website is:
Multicert Sp. z o.o.
ul. Mydlarska 47, 04-690 Warszawa, Poland
NIP: 9522163792
Email: biuro@multicert.pl
2. What Data We Collect
We collect personal data when you voluntarily provide it through an enquiry or document request form:
- Name — to address you in our response
- Email address — to reply to your enquiry
- Company name (optional) — to understand your business context
- Country (optional) — to tailor our response
- Message content — the subject of your enquiry
To protect the forms and website, we also process limited technical data such as IP address, request time and server log information.
If you accept analytics, Google Analytics 4 processes information about page views, interactions, session and device characteristics, approximate location and a pseudonymous browser identifier. We do not send the content of your forms to Google Analytics. Google Analytics is not loaded before you accept it.
3. Purpose and Legal Basis
Your personal data is processed for the following purposes:
| Purpose | Legal Basis (GDPR) |
|---|---|
| Responding to your contact form enquiry | Article 6(1)(b) — performance of a contract or pre-contractual measures |
| Technical operation of the website (server logs) | Article 6(1)(f) — legitimate interest (security, uptime) |
| Website audience and conversion measurement with Google Analytics 4 | Article 6(1)(a) — your consent |
4. Data Retention
Form submissions are recorded in the secured WordPress database and forwarded to biuro@multicert.pl. We review and remove enquiry records and correspondence when they are no longer necessary, ordinarily no later than 3 years after the last contact, unless a longer period is required to establish, exercise or defend legal claims or to meet a legal obligation.
Server access logs are used to diagnose faults, prevent abuse and investigate security incidents. Routine entries are deleted no later than 30 days after collection. If a specific entry is isolated as evidence of an incident or legal claim, it is retained only until that investigation or claim is closed and the applicable limitation period expires.
Your analytics choice is valid for 180 days. Google Analytics cookies may remain for up to 2 years, unless you withdraw consent or delete them earlier. User-level and event-level Google Analytics data are retained for no longer than 14 months and are then deleted through Google's monthly process. This limit does not control the availability of standard aggregated reports. See Google's data-retention documentation.
5. Data Recipients
Your data may be shared with:
- dhosting.pl — hosting and server infrastructure provider in Poland
- Google Ireland Limited — Google Analytics provider, only after you accept analytics
Google may process analytics data outside the European Economic Area using the safeguards described in its Business Data Responsibility information. We do not sell or rent your personal data and do not use it for third-party advertising.
6. Cookies and Analytics Choice
Necessary technologies may include:
| Cookie | Purpose | Duration |
|---|---|---|
wordpress_sec_* |
WordPress authentication (admin only) | Session |
wordpress_logged_in_* |
WordPress login state (admin only) | Session |
_lscache_vary |
LiteSpeed Cache — page caching | Session |
We save your analytics choice in your browser's local storage under
epd_analytics_consent. It is treated as expired after 180 days.
If you accept analytics, the following Google Analytics cookies may be set:
| Cookie | Purpose | Duration |
|---|---|---|
_ga |
Distinguishes browsers for audience measurement | Up to 2 years |
_ga_70BQJY67R3 |
Maintains the state of the Google Analytics session | Up to 2 years |
You can accept or decline analytics in the consent panel. You can later change your
choice using Analytics settings at the bottom of the website. When you
decline or withdraw consent, Google Analytics is not loaded on subsequent page views
and the website removes its accessible _ga cookies. Declining analytics
does not affect the operation of the website or forms.
7. Your Rights
Under the GDPR, you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — correct inaccurate data
- Erasure — request deletion of your data ("right to be forgotten")
- Restriction — limit how we process your data
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interest
- Withdraw consent — withdraw analytics consent at any time without affecting earlier lawful processing
To exercise any of these rights, contact us at biuro@multicert.pl. We will respond within 30 days.
8. Supervisory Authority
If you believe your data protection rights have been violated, you may file a complaint with:
Urząd Ochrony Danych Osobowych (UODO)
ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland
Current UODO address
9. Changes to This Policy
We may update this policy to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page indicates when the latest revision was made.