Privacy notice
Last updated: 21 October 2026
This notice is the information required by Article 13 of the GDPR. It explains what personal data we collect through this website, why, on what legal basis, for how long we keep it and what you can require of us.
Who is the controller
The controller of your personal data is EWG Advisory Sp. z o.o., Księcia Witolda 49/15, 50-202 Wrocław, Poland, entered in the National Court Register under KRS 0001260613, NIP 8982337282.
In all matters concerning your data, write to contact@ewg-advisory.com or call +48 884 320 024. We have not appointed a Data Protection Officer: our processing does not meet the conditions in Article 37 of the GDPR that would require one.
What data we collect
We collect only what you type into an enquiry form: your name, organisation or company, email address and — where you choose to give them — telephone number, country, sector, and the details of your mandate, project or message.
Our hosting provider also records standard server log data for every request, including the IP address, the time of the request and the browser identifier. We use it only to keep the site running and to limit automated abuse of the forms.
Why we process it, and on what legal basis
Each purpose has its own basis under Article 6(1) of the GDPR:
Answering your enquiry
Article 6(1)(b) — steps taken at your request before entering into a contract; and Article 6(1)(f) — our legitimate interest in responding to business enquiries addressed to us.
Carrying out an engagement
Article 6(1)(b) — performance of the contract between us.
Accounting and tax records
Article 6(1)(c) — compliance with our legal obligations under Polish accounting and tax law.
Keeping the site secure
Article 6(1)(f) — our legitimate interest in protecting the site and the forms from automated abuse.
Establishing or defending claims
Article 6(1)(f) — our legitimate interest in being able to pursue or defend a claim.
Who else sees it
Enquiries are read by EWG Advisory. Beyond that, your data may be handled by:
Netlify, Inc.
Hosts this site and receives form submissions. Acts as our processor under a data processing agreement meeting Article 28 of the GDPR.
Accounting and legal advisers
Only where an engagement follows and the work requires it. Bound by contract and by professional secrecy.
Public authorities
Only where disclosure is required by law.
Transfers outside the European Economic Area
Netlify, Inc. is established in the United States, so your submission is transferred outside the EEA. Two safeguards apply: Netlify is certified under the EU–U.S. Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection, and Netlify additionally applies the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914.
You may ask us for a copy of the safeguards by writing to contact@ewg-advisory.com.
How long we keep it
We do not keep data longer than the purpose requires:
An enquiry that leads nowhere
24 months from our last contact, after which it is deleted.
An engagement
For the duration of the engagement and then for the limitation period for claims arising from it — as a rule three years for claims connected with business activity (Article 118 of the Polish Civil Code).
Accounting documents
For the period required by Polish accounting and tax law — as a rule five years from the end of the relevant financial or tax year.
Server logs
For the retention period applied by our hosting provider.
Your rights
Under Articles 15 to 22 of the GDPR you may require:
Access
Confirmation of whether we process your data, a copy of it, and the information in this notice.
Rectification
Correction of data that is inaccurate, and completion of data that is incomplete.
Erasure
Deletion of your data where one of the grounds in Article 17 applies.
Restriction
That we hold your data without further processing while a dispute about it is resolved.
Portability
Your data in a structured, commonly used, machine-readable format, where processing is based on contract and carried out by automated means.
Objection
That we stop processing based on our legitimate interest. We must then stop unless we show compelling legitimate grounds that override your interests.
To exercise any of these, write to contact@ewg-advisory.com. We will respond within one month of receiving your request, as Article 12(3) of the GDPR requires; if the request is complex we may extend that by two further months and will tell you why.
Complaints
If you believe we are processing your data unlawfully, you may lodge a complaint with the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warszawa (correspondence address: ul. Stawki 2, 00-193 Warszawa), uodo.gov.pl.
You are welcome to raise the matter with us first, at contact@ewg-advisory.com, but you are not required to.
Is giving us your data required?
No. Providing your data is entirely voluntary and is neither a statutory nor a contractual requirement. It is, however, necessary for us to answer you: without a name and an email address we cannot reply to an enquiry.
No automated decision-making
We do not make decisions about you by automated means and we do not profile you, within the meaning of Article 22 of the GDPR. Every enquiry is read and assessed by a person.
Cookies and your device
This site stores nothing on your device. It sets no cookies, uses no local storage, runs no analytics, no advertising and no social media plug-ins, and loads no resources from third-party servers — the typefaces are served from our own domain.
Because nothing is stored on or read from your terminal equipment, the consent required by Article 399 of the Polish Electronic Communications Act (Prawo komunikacji elektronicznej) does not arise, and this site needs no cookie banner. Should that ever change, we will ask for your consent first and update this notice.
Changes to this notice
If we change how we process personal data, we will update this page and change the date at the top. Where the change is material, we will say so here.