How we process your data.

Last updated: 14 August 2026

1. Data controller

The controller of your personal data is MSGA, with its registered office in Łódź, Piotrkowska 276A, 90-361 Łódź, Poland, Tax ID (NIP): 7331362657, Business Registry No. (REGON): 383902384 (hereinafter: the "Controller").

Contact regarding personal data matters: [email protected]

2. Source of the data

We process personal data from three sources, depending on how we came into contact with you.

Data you provide to us directly. When you contact us through the form on our website, or by email, you provide us with your data yourself. We describe this in detail in section 3 below.

Data obtained from publicly available sources, such as: industry services, social media platforms (LinkedIn), company websites, public registers (the National Court Register (KRS), the Central Register and Information on Economic Activity (CEIDG)), and other publicly accessible business databases.

Data you have provided together with your consent to commercial contact. Where you have explicitly agreed to receive commercial or marketing communication from us (an opt-in), we process the data you provided for that purpose on the basis of that consent.

For data obtained from publicly available sources, pursuant to Article 14(3) of the GDPR this information is provided no later than within one month of obtaining the personal data, or at the first contact with the data subject.

3. Data you provide through the contact form

When you contact us through the form on our website, we process the data you choose to provide: your first and last name, business email address, company name, job role, the content of your message, and any service interests you select.

The legal basis for this processing is Article 6(1)(b) of the GDPR, as processing is necessary to take steps at your request prior to entering into a contract, and, where applicable, Article 6(1)(f) of the GDPR (our legitimate interest in responding to enquiries addressed to us).

We use contact form data only to respond to your enquiry and, where relevant, to prepare and present an offer. We do not use contact form data for cold outreach or marketing campaigns unless you separately and explicitly consent.

Our contact form is operated through Web3Forms, which transmits your submission to us by email. Web3Forms acts as our data processor and may process your data on servers located outside the European Economic Area (in the United States), on the basis of the standard contractual clauses approved by the European Commission (see section 10).

Providing your data through the form is voluntary, but the name, business email address, and message are necessary for us to respond to your enquiry. Contact form data is retained for as long as necessary to handle your enquiry and any resulting business relationship, and no longer than 12 months from our last contact where no relationship is established.

4. Legal basis for processing

The legal basis for processing your personal data is the legitimate interest of the controller within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the GDPR).

The legitimate interest consists in establishing business contacts, conducting commercial (B2B) communication, and presenting an offer of services related to the recipient's professional activity.

Where the processing is based on your consent - in particular where you have explicitly agreed to receive commercial or marketing communication from us - the legal basis is Article 6(1)(a) of the GDPR. In such cases we process your data only within the scope covered by your consent, and you may withdraw that consent at any time (see section 8).

5. Scope of the data processed

We process only professional data:

First and last name
Company name and job title
Business email address
Business phone number (if publicly available)
LinkedIn profile or other publicly available professional profiles

6. Purpose of the data processing

We process your data for the following purposes:

Establishing business contact - initiating commercial relationships in the B2B model
Presenting an offer of services - informing you about the Controller's services that may be relevant from the perspective of your professional activity
Conducting commercial communication - maintaining business relationships and exchanging industry information

7. Data retention period

Your data will be processed for a period no longer than 12 months from the last contact or attempted contact. After this period, the data will be reviewed to assess whether further processing is justified. If there is no legitimate interest in continuing the processing, the data will be permanently deleted.

The data will be deleted earlier if an effective objection to its processing is raised.

Data processed on the basis of your consent is retained until you withdraw that consent. Following withdrawal, the data will be deleted without undue delay, unless we have another legal basis for continuing to process it.

8. Your rights

Under the GDPR, you have the following rights:

Right of access - you may obtain information about what data we process concerning you (Article 15 of the GDPR)
Right to rectification - you may request the correction of inaccurate data (Article 16 of the GDPR)
Right to erasure - you may request the deletion of your data (the "right to be forgotten", Article 17 of the GDPR)
Right to restriction of processing - you may request the restriction of processing in certain cases (Article 18 of the GDPR)
Right to object - you may object at any time to the processing of data based on legitimate interest (Article 21 of the GDPR)
Right to withdraw consent - where processing is based on your consent, you may withdraw it at any time; the withdrawal does not affect the lawfulness of processing carried out before the withdrawal (Article 7(3) of the GDPR)
Right to data portability - you may receive your data in a structured format (Article 20 of the GDPR)
Right to lodge a complaint - you may lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland)

To exercise your rights, send a message to: [email protected]. We will respond without undue delay, no later than within 30 days.

9. Data recipients

Your data may be shared only with entities that support the Controller in achieving the processing purposes. The categories of recipients include:

Providers of CRM systems and customer relationship management tools
Providers of business communication and email outreach platforms
Providers of hosting services and IT infrastructure
Providers of analytics and reporting tools
Providers of contact form and form delivery services (Web3Forms)

Each of these entities processes the data on the basis of appropriate data processing agreements.

10. Transfers of data outside the EEA

In connection with the use of technological tools (including our contact form provider Web3Forms, as well as CRM and communication platforms), your data may be transferred to countries outside the European Economic Area, including the United States. In such cases, the transfer takes place on the basis of standard contractual clauses approved by the European Commission or an adequacy decision.

11. Automated decision-making

The Controller does not make decisions concerning you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.

12. Data security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, or destruction. Access to the data is granted only to authorised persons, and the systems we use are secured in accordance with current industry standards.

13. Changes to the privacy policy

The Controller reserves the right to update this Privacy Policy. We will inform you of any material changes via the website. The current version of the document is always available at: msga.pro/privacy-policy