Privacy policy

Who is the data controller

The controller of your personal data is Piotr Malinowski, trading as sixboxes Piotr Malinowski, ul. Srebrzyńska 51 lok. 41, 91-082 Łódź, Poland, tax ID (NIP) 7272790304, REGON 101675547 (referred to below as “we” or “the Controller”). We run the ntsr.pl website under the Not Sorry Collective brand.

For anything related to data protection, you can reach us at question@ntsr.pl.

What data we process and where it comes from

The ntsr.pl website has no contact forms, user accounts or newsletter sign-up. The data we process comes from emails people send us, for example to question@ntsr.pl.

This may include your name, email address, company name, the content of your message and anything else you choose to share with us.

Purposes and legal basis

We process your data for the following purposes:

• responding to your message and preparing a proposal, based on Article 6(1)(b) GDPR (steps taken before entering into a contract, at your request) or Article 6(1)(f) GDPR (our legitimate interest in maintaining correspondence),
• performing a contract, if we start working together, based on Article 6(1)(b) GDPR,
• meeting accounting and tax obligations related to that work, based on Article 6(1)(c) GDPR,
• establishing, pursuing or defending legal claims, based on Article 6(1)(f) GDPR (our legitimate interest),
• keeping the website secure and reviewing technical server logs, based on Article 6(1)(f) GDPR (our legitimate interest).

How long we keep your data

If correspondence does not lead to a project, we keep it for up to 12 months from your last message.

If we start working together, we keep the data for the duration of the contract and until any claims arising from it become time-barred. Accounting records are kept for the period required by law, which is 5 years from the end of the tax year in which they were created.

Who we share data with

We may share your data with: our email provider, Google (Google Workspace, Google Ireland Ltd.); our hosting and CDN provider, Cloudflare, Inc., which processes technical request data, such as IP addresses, to deliver the website and protect it from attacks; our accounting office, if we start working together; and bodies authorised to receive it under the law.

Google and Cloudflare may process data outside the European Economic Area, including in the United States. This happens on the basis of the European Commission’s adequacy decision (the EU-US Data Privacy Framework) or standard contractual clauses.

Your rights

You have the right to access your data, correct it, have it deleted, restrict its processing, transfer it, and object to processing based on our legitimate interest.

You also have the right to lodge a complaint with the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

Providing your data is voluntary, but without an email address we will not be able to reply to you. We do not make automated decisions and we do not profile your data.

Cookies and browser storage

The ntsr.pl website does not use cookies or any analytics or advertising tools. In browser storage (localStorage and sessionStorage) we only save settings you choose yourself: light or dark theme (the ntsr-theme key), your language version (the ntsr-language key), and whether you have already seen the entrance animation in the current session (the ntsr-intro-seen key).

This data is not used for tracking and you can delete it at any time in your browser settings.

External links

The website contains links to our clients’ websites. We have no control over the privacy practices on those sites, which are the responsibility of their own administrators.

Changes to this policy

We may update this privacy policy from time to time, for example when the law changes or the website’s scope changes. Last updated: 23 September 2026.