Privacy Policy
Last updated: 8 August 2026
1. Personal Data Controller
The controller of personal data is:
netPOINT Tomasz Kuciapski
ul. 15 Sierpnia 2
96-500 Sochaczew
Tax Identification Number (NIP) / EU VAT number: PL7751620451
Email: [email protected]
For matters relating to the processing of personal data and the exercise of data protection rights, you can contact the Controller using the email address above.
2. Scope of This Policy
This policy explains how personal data is processed in connection with:
- using the website https://netpoint.systems;
- submitting requests for a price list through a form on the website;
- contacting us by telephone, email or WhatsApp;
- the Controller’s use of Meta Pixel;
- submitting enquiries through Instant Forms in Facebook or Instagram advertisements;
- correspondence, preparing quotations and providing services.
The website is primarily intended for businesses and organisations. However, the contact details of an individual, including someone representing a business or organisation, may constitute personal data and are protected as described in this policy.
3. Price List Enquiry Form on the Website
The website https://netpoint.systems provides a form for requesting a price list, information about the scope of services, an estimate or a quotation. The form is technically operated using the Contact Form 7 plugin installed on the website.
The Controller may process information entered by the user in the form fields, namely:
- email address.
Data submitted through the form is processed in order to:
- receive and handle an enquiry about pricing or services;
- reply to the person submitting the form;
- provide information about prices, the scope of services and how they are delivered;
- prepare an initial cost estimate or individual quotation;
- take steps requested by the person making the enquiry before potentially entering into a contract;
- continue correspondence relating to the enquiry;
- document arrangements and establish, pursue or defend legal claims.
The legal bases for processing personal data are:
- Article 6(1)(b) of the GDPR – where processing is necessary to take steps at the request of the data subject before entering into a contract or to perform a contract;
- Article 6(1)(f) of the GDPR – the Controller’s legitimate interests in handling enquiries, conducting correspondence, documenting arrangements and protecting against legal claims.
Providing personal data is voluntary. However, failure to provide information marked as required in the form may make it impossible to submit an enquiry or receive a response.
Submitting a price list enquiry form does not subscribe the user to a newsletter or constitute consent to receive marketing communications unrelated to that enquiry.
Data submitted through the form is sent to the configured email address via the Controller’s server and email infrastructure. By default, the Contact Form 7 plugin itself does not store submitted messages in the WordPress database. If an additional archiving or anti-spam solution is used with the form, data processing will also depend on its configuration and will be reflected in this policy as appropriate.
Data relating to an enquiry that does not result in a contract is generally retained for up to 12 months after correspondence has ended, unless earlier deletion is possible and appropriate or longer retention is necessary to establish, pursue or defend legal claims.
The website also provides buttons for initiating contact by telephone, WhatsApp or email. Simply clicking a telephone or email button does not send the content of a message or any data entered by the user to the Controller. The Controller receives data only when the user chooses to make a call or send a message. When WhatsApp is used, data is also processed by the service provider in accordance with WhatsApp’s applicable policies.
4. Technical Data and Server Logs
When the website is used, the server may automatically record standard technical information, such as:
- IP address;
- date and time of the connection;
- requested page address;
- information about the browser and operating system;
- server response code;
- referring website address;
- information about errors and security-related events.
This information is used to display the website correctly, maintain security, diagnose errors, prevent misuse and carry out basic technical administration.
The legal basis for processing is the Controller’s legitimate interest in maintaining a properly functioning and secure website, pursuant to Article 6(1)(f) of the GDPR.
Technical logs are retained for as long as necessary to maintain website security and diagnose problems, generally for no longer than 12 months, unless a longer period is necessary to investigate a security incident, defend a legal claim or comply with a legal obligation.
5. Contact by Telephone, Email and WhatsApp
If a user contacts the Controller by telephone, email or WhatsApp, the Controller may process, in particular:
- first and last name;
- company or organisation name;
- job title or role;
- telephone number;
- email address;
- profile name or identifier used in the messaging service;
- message content;
- information about the company, website, planned project or requested service;
- any other information voluntarily provided during the conversation.
This data is processed solely to:
- respond to the enquiry;
- discuss the services requested;
- prepare the scope of work, a cost estimate or a quotation;
- take steps requested by the person making contact before entering into a contract;
- continue correspondence relating to the enquiry;
- enter into and perform a contract if the parties agree to work together;
- establish, pursue or defend legal claims.
The legal bases for processing are:
- Article 6(1)(b) of the GDPR – taking steps at the data subject’s request before entering into a contract or performing a contract;
- Article 6(1)(f) of the GDPR – the Controller’s legitimate interests in conducting correspondence, handling enquiries, documenting arrangements and protecting against legal claims;
- Article 6(1)(c) of the GDPR – complying with legal obligations if the contact leads to the conclusion and settlement of a contract.
Providing data is voluntary. However, without sufficient contact details, the Controller may be unable to respond or prepare a quotation.
Data provided in an enquiry that does not result in a contract is generally retained for up to 12 months after correspondence has ended. It may be deleted earlier at the data subject’s request if there is no other legal basis for continuing to process it.
If an enquiry results in a contract, the data may be retained for the duration of the business relationship and subsequently for the periods required under tax and accounting laws and the rules governing limitation periods for legal claims.
6. Meta Instant Forms on Facebook and Instagram
The Controller may run advertising campaigns on Facebook and Instagram using Instant Forms, also referred to as lead forms or contact forms.
These forms are displayed and operated within Meta’s services, not directly on https://netpoint.systems. Information entered in a form, or automatically filled in from a user’s profile, is first processed by Meta under the policies applicable to its services and is then made available to the Controller as the advertiser and owner of the form.
Depending on the particular form, the Controller may receive:
- first and last name;
- email address;
- telephone number;
- company name;
- job title or type of business;
- website address;
- information about the service required;
- answers to questions included in the form;
- any additional message voluntarily provided by the user;
- technical information and details of the advertisement or form through which the enquiry was submitted.
The exact information required is displayed in each form before it is submitted.
Data submitted through an Instant Form is used solely to:
- receive and handle the specific enquiry;
- contact the person who submitted the form;
- provide information about the service selected in the form;
- discuss the potential scope of cooperation;
- prepare a quotation or cost estimate;
- take steps before potentially entering into a contract;
- document the correspondence and protect against legal claims.
Submitting an enquiry does not subscribe the user to a newsletter. The Controller does not use data obtained through Instant Forms to send bulk marketing messages unrelated to the enquiry and does not sell such data to other parties.
The legal bases for processing are:
- Article 6(1)(b) of the GDPR – taking steps at the request of the person submitting the enquiry before potentially entering into a contract;
- Article 6(1)(f) of the GDPR – the Controller’s legitimate interests in responding, conducting correspondence, documenting arrangements and protecting against legal claims.
Providing data is voluntary. However, failure to provide information marked as required will prevent the form from being submitted or a response from being provided.
Data received by the Controller through a Meta Instant Form is handled separately from the price list enquiry form on https://netpoint.systems and is not automatically transferred to that form. The data may be stored in Meta’s form management systems and in the tools used by the Controller to read and respond to the enquiry, particularly email, telephone or messaging applications.
Data relating to an enquiry that does not result in a contract is generally retained by the Controller for no longer than 12 months after contact has ended. If a contract is entered into, the data may be processed for the duration of the business relationship and for any additional periods required by legal obligations and the limitation periods for legal claims.
Meta may also process user data independently in accordance with its own privacy policy and the terms governing the use of its forms. The Controller does not determine every operation performed independently by Meta within its services.
7. Meta Pixel
The website may use Meta Pixel, provided by Meta Platforms Ireland Limited.
Meta Pixel is used to:
- measure the effectiveness of advertisements shown on Facebook and Instagram;
- determine whether a user visited the website after viewing or clicking an advertisement;
- compile aggregated statistics about website visits and user actions;
- improve the targeting of advertising campaigns;
- carry out remarketing activities where the user has consented to marketing cookies.
The following information, among other data, may be processed through Meta Pixel:
- IP address;
- browser and device information;
- address of the page visited;
- date and time of the visit;
- referring website address;
- identifiers stored in cookies or device storage;
- information about basic actions taken on the website;
- information about the advertising campaign from which the user arrived.
Meta Pixel is not used by the Controller to read the content of users’ telephone conversations, WhatsApp messages or email messages.
Marketing cookies and Meta Pixel should only be activated after the user has given the appropriate consent through the cookie management tool.
The legal basis for storing and accessing marketing cookies and the associated processing of personal data is the user’s consent, in accordance with Article 6(1)(a) of the GDPR and applicable laws governing the storage of information on users’ devices.
Consent is voluntary and may be withdrawn at any time by changing the settings in the cookie preferences panel. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
Through the use of Meta Pixel, Meta may receive information about how the website is used and process it under its own policies, including to provide, secure and develop its advertising services.
8. Cookies
The website uses cookies and similar technologies. Cookies may be used to personalise advertisements on Google – https://business.safety.google/privacy/
Essential Cookies
Essential cookies enable the website and its consent management system to function properly. They may be used without the user’s consent where they are necessary to provide the service or record the user’s privacy choices.
Marketing Cookies
Marketing cookies, including the _fbp cookie associated with Meta services, may be used to measure campaigns, compile advertising statistics and carry out remarketing.
They are activated only after the user’s consent has been obtained.
Managing Consent
Users can accept or reject optional categories of cookies and change their choices using the settings available on the website.
Users can also delete or block cookies through their browser settings. However, restricting essential cookies may affect the correct operation of some website features.
9. Recipients of Personal Data
The Controller does not sell personal data or share it with other companies for their own independent marketing purposes.
Access to personal data may be granted only to parties whose involvement is necessary to operate the website, manage communications or fulfil the Controller’s obligations, in particular:
- the hosting and server infrastructure provider;
- the email service provider;
- telecommunications providers;
- providers of IT, administrative and security services;
- Meta Platforms Ireland Limited in connection with Meta Pixel, Facebook, Instagram, WhatsApp and Instant Forms;
- software and service providers whose tools are used to operate the website, manage the enquiry form and conduct correspondence;
- accountants, legal advisers or tax advisers, where sharing data is necessary;
- public authorities legally entitled to receive personal data.
Service providers acting on behalf of the Controller receive only the data necessary to perform their assigned tasks and are required to protect it appropriately.
10. Transfers of Personal Data Outside the European Economic Area
Using services provided by global technology companies, particularly Meta services, may involve the processing of personal data outside the European Economic Area (EEA).
Where such transfers occur, service providers should apply the safeguards required by data protection law, such as a European Commission adequacy decision or Standard Contractual Clauses together with any necessary additional safeguards.
More detailed information about where and how individual service providers process personal data can be found in their respective privacy policies.
11. Data Retention Periods
Personal data is retained only for as long as necessary to achieve the purpose for which it was collected, in particular:
- technical data and logs – generally for up to 12 months;
- data relating to an enquiry submitted through the website form, email, WhatsApp, telephone or a Meta Instant Form that does not result in a contract – generally for up to 12 months after contact has ended;
- data relating to the preparation of quotations and negotiations – for the duration of those discussions and the period necessary to protect against legal claims;
- data relating to a concluded contract – for the duration of the contract and then for the periods required by tax and accounting obligations and the limitation periods for legal claims;
- data processed on the basis of consent – until consent is withdrawn, the purpose is no longer applicable or the data is deleted earlier;
- data stored in cookies – for the period indicated in the cookie management tool’s settings or until the user deletes the cookies.
Meta and other independent service providers determine their own data retention periods in accordance with their respective policies.
12. Data Subject Rights
To the extent provided for by the GDPR, data subjects have the right to:
- receive information about the processing of their personal data;
- access their personal data;
- receive a copy of their personal data;
- have inaccurate data corrected or incomplete data completed;
- request the erasure of their personal data;
- request the restriction of processing;
- data portability, where processing is based on consent or a contract and is carried out by automated means;
- object to processing based on the Controller’s legitimate interests;
- withdraw consent at any time where processing is based on consent;
- lodge a complaint with the President of the Personal Data Protection Office (the Polish data protection supervisory authority).
Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
Requests to exercise these rights can be sent to: [email protected].
The Controller may ask for information necessary to verify the identity of the person making the request to prevent personal data from being disclosed to an unauthorised person.
13. Automated Decision-Making
The Controller does not make decisions concerning people who submit enquiries that produce legal effects or similarly significantly affect them solely through automated processing.
Meta’s systems may use automated mechanisms to deliver, measure and target advertisements. Further details of these mechanisms are provided in Meta’s documentation and privacy policy.
14. Data Security
The Controller implements appropriate technical and organisational measures to protect personal data against loss, unauthorised access, disclosure, alteration or destruction.
These safeguards are adapted to the nature of the data, the purpose of processing and the level of risk. However, no method of data transmission or storage can guarantee the complete elimination of all risks.
15. Special Categories of Personal Data
The Controller does not expect users to provide special categories of personal data through the website enquiry form, Meta Instant Forms, email or messaging services. This includes information about health, racial or ethnic origin, religious beliefs, political opinions, sex life or sexual orientation.
Users should not provide such information unless it is necessary and has been agreed in advance with the Controller.
16. External Links and Services
The website may contain links to external services, including Facebook, WhatsApp and other websites.
After leaving https://netpoint.systems, personal data may also be processed under the policies of the operator of the external website or service visited. The Controller is not responsible for the content or privacy practices of independent third-party websites.
17. Changes to This Privacy Policy
This policy may be updated if the website’s operation, the services used, the scope of personal data processing or applicable laws change.