How we process your data.

Privacy policy

Last updated: 21 September 2026

1. Data controller

The controller of your personal data is MSGA, with its registered office in Łódź, Piotrkowska 276A, 90-361 Łódź, Poland, Tax ID (NIP): 7331362657, Business Registry No. (REGON): 383902384 (hereinafter: the "Controller").

Contact regarding personal data matters: hello@msga.pro

2. Source of the data

We process personal data from three sources, depending on how we came into contact with you.

Data you provide to us directly. When you contact us through the form on our website, or by email, you provide us with your data yourself. We describe this in detail in section 3.
Data obtained from publicly available sources, such as: industry services, social media platforms (LinkedIn), company websites, public registers (the National Court Register (KRS), the Central Register and Information on Economic Activity (CEIDG)), and other publicly accessible business databases.
Data you have provided together with your consent to commercial contact. Where you have explicitly agreed to receive commercial or marketing communication from us (an opt-in), we process the data you provided for that purpose on the basis of that consent.

For data obtained from publicly available sources, pursuant to Article 14(3) of the GDPR this information is provided within a reasonable period, no later than within one month of obtaining the personal data, and where the data are to be used to communicate with the data subject: no later than at the first contact.

3. Data you provide through the contact form

When you contact us through the form on our website, we process the data you choose to provide: your first and last name, business email address, company name, the topic you select, and the content of your message.

The legal basis for this processing is Article 6(1)(b) of the GDPR, as processing is necessary to take steps at your request prior to entering into a contract, and, where applicable, Article 6(1)(f) of the GDPR (our legitimate interest in responding to inquiries addressed to us).

We use contact form data only to respond to your inquiry and, where relevant, to prepare and present an offer. We do not use contact form data for cold outreach or marketing campaigns unless you separately and explicitly consent.

The form is operated by Web3Forms, which delivers your submission to us by email and stores its content in an encrypted database for up to 3 years from submission, after which it is deleted automatically. Web3Forms acts as a data processor under a data processing agreement (DPA); it operates from outside the European Economic Area and may process data across infrastructure distributed over several regions. The safeguards applied to those transfers are described in section 10.

Providing your data through the form is voluntary; submitting the form requires your first name, last name, business email address, and message. Company name and topic are optional. Contact form data is retained for as long as necessary to handle your inquiry and any resulting business relationship, and no longer than 12 months from our last contact where no relationship is established.

4. Legal basis for processing

The legal basis for processing your personal data is the legitimate interest of the controller within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the GDPR).

That legitimate interest covers in particular the assessment of potential business relationships, handling correspondence, and maintaining relationships with business partners. Where the law requires separate consent for sending commercial information or for direct marketing (Article 398 of the Polish Electronic Communications Law), such communication is carried out only after the required consent has been obtained.

Where the processing is based on your consent, the legal basis is Article 6(1)(a) of the GDPR. In such cases we process your data only within the scope covered by your consent, and you may withdraw that consent at any time (see section 8).

5. Scope of the data processed

We process only professional data:

  • First and last name
  • Company name and job title
  • Business email address
  • Business phone number (if publicly available)
  • LinkedIn profile or other publicly available professional profiles

6. Purpose of the data processing

We process your data for the following purposes:

  • Establishing business contact: initiating commercial relationships in the B2B model
  • Presenting an offer of services: informing you about the Controller's services that may be relevant from the perspective of your professional activity
  • Conducting commercial communication: maintaining business relationships and exchanging industry information

7. Data retention period

Your data will be processed for a period no longer than 12 months from the last contact or attempted contact. After this period, the data will be reviewed to assess whether further processing is justified. If there is no legitimate interest in continuing the processing, the data will be permanently deleted.

The data will be deleted earlier if an effective objection to its processing is raised.

Data processed on the basis of your consent is retained until you withdraw that consent. Following withdrawal, the data will be deleted without undue delay, unless we have another legal basis for continuing to process it.

8. Your rights

Under the GDPR, you have the following rights:

  • Right of access: you may obtain information about what data we process concerning you (Article 15 of the GDPR)
  • Right to rectification: you may request the correction of inaccurate data (Article 16 of the GDPR)
  • Right to erasure: you may request the deletion of your data (the "right to be forgotten", Article 17 of the GDPR)
  • Right to restriction of processing: you may request the restriction of processing in certain cases (Article 18 of the GDPR)
  • Right to object: you may object at any time to the processing of data based on legitimate interest (Article 21 of the GDPR)
  • Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time; the withdrawal does not affect the lawfulness of processing carried out before the withdrawal (Article 7(3) of the GDPR)
  • Right to data portability: you may receive your data in a structured format (Article 20 of the GDPR)
  • Right to lodge a complaint: you may lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland)
To exercise your rights, send a message to: hello@msga.pro. We will respond without undue delay, no later than within 30 days.

9. Data recipients

Your data may be shared only with entities that support the Controller in achieving the processing purposes. The categories of recipients include:

  • Providers of CRM systems and customer relationship management tools
  • Providers of business communication and email outreach platforms
  • Providers of hosting services and IT infrastructure
  • Providers of analytics and reporting tools
  • Providers of contact form and form delivery services (Web3Forms)

Each of these entities processes the data on the basis of appropriate data processing agreements.

10. Transfers of data outside the EEA

In connection with the use of technological tools (including our form provider Web3Forms and our CRM and communication platforms), your data may be transferred to countries outside the European Economic Area. In the case of Web3Forms, the transfer takes place on the basis of the standard contractual clauses approved by the European Commission, incorporated into that provider's data processing agreement (DPA). For the remaining tools, the transfer takes place on the basis of the mechanisms provided for in the GDPR - an adequacy decision of the European Commission, standard contractual clauses, or other appropriate safeguards.

11. Automated decision-making

The Controller does not make decisions concerning you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.

12. Data security

We apply appropriate technical and organizational measures to protect your data against unauthorized access, loss, or destruction. Access to the data is granted only to authorized persons, and the systems we use are secured in accordance with current industry standards.

13. Changes to the privacy policy

The Controller reserves the right to update this Privacy Policy. We will inform you of any material changes via the website. The current version of the document is always available at: msga.pro/privacy-policy