Privacy policy

The controller of personal data within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) is JAY DESIGN sp. z o.o., with its registered address at ul. Żurawia 32/34, 00-515 Warszawa, NIP: 7011143913, tel. +48 600 631 082, e-mail: jay.dizstudio@gmail.com (hereinafter — the “Controller”).

The Controller has not appointed a Data Protection Officer. Any questions relating to the processing of personal data can be directed to the Controller at the e-mail address above.

Personal data is processed in accordance with GDPR requirements for the following purposes:

• concluding and performing contracts;
• providing design and construction services;
• handling inquiries, correspondence, and communications;
• fulfilling accounting, tax, and bookkeeping obligations;
• establishing, exercising, or defending potential legal claims.

The legal basis for processing personal data includes, in particular, Article 6(1)(b), (c), and (f) GDPR.

Data provided in the contact forms and the calculator on the website is processed in order to respond and prepare a quote, i.e. to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR). Data collected through statistical and marketing cookies is processed solely on the basis of consent (Article 6(1)(a) GDPR) — see section 12.

The Controller may process, among others, the following categories of personal data:

• first and last name;
• phone number;
• e-mail address;
• the address of the investment property or registered business address;
• other data necessary to perform the contract or execute the project.

Personal data is stored in electronic form and, where necessary, also in paper form.

The Controller applies appropriate technical and organizational measures to protect personal data, in particular against loss, unauthorized access, alteration, or disclosure.

Access to personal data is restricted to authorized persons, to the extent necessary to achieve the defined processing purposes.

Personal data may be disclosed to entities that process data on behalf of the Controller, in particular IT service providers, accounting firms, and cooperating contractors.

Personal data is transferred solely under data processing agreements concluded in accordance with GDPR requirements, or on other lawful grounds.

Recipients may also include hosting and e-mail service providers, Usercentrics A/S (Cookiebot consent management platform), Google Ireland Ltd. (Google Analytics, Google Ads, Google Tag Manager) and Meta Platforms Ireland Ltd. (Meta Pixel) — to the extent described in section 12.

Personal data is retained:

• for the duration of the contract;
• after its termination — for the period required by applicable law;
• until the expiry of the limitation period for potential legal claims;
• or until an effective objection to the processing is submitted, where the processing is based on the Controller’s legitimate interest.

Persons whose personal data is processed have the right:

• to access their personal data;
• to rectify their personal data;
• to erase their personal data;
• to restrict the processing of their personal data;
• to data portability;
• to object to the processing of their personal data;
• to withdraw consent at any time — where processing is based on consent (without affecting the lawfulness of processing carried out before the withdrawal).

To exercise the above rights, a data subject may contact the Controller by sending a message to the e-mail address provided. The Controller will respond no later than within 30 days of receiving the request.

Where data is processed for marketing purposes, the data subject has the right to object to such processing, including profiling, at any time (Article 21(2) GDPR).

Persons whose personal data is processed have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) if they believe that the processing of their personal data infringes GDPR.

Supervisory authority: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland.

Personal data is not transferred to third countries or international organizations, except where information tools are used whose providers apply standard contractual clauses compliant with GDPR requirements.

In the case of Google tools (Google Analytics, Google Ads, Google Tag Manager) and Meta (Meta Pixel), data may be transferred to the USA on the basis of the European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.

Personal data is not subject to automated decision-making that produces legal effects concerning the data subject or similarly significantly affects them.

Only after consent to marketing cookies has been given, data on the use of the website may be used for profiling for marketing purposes, i.e. to display Jay Design ads on Google and Meta services to people who have visited the website. Consent may be withdrawn at any time.

Providing personal data is voluntary; however, failure to provide it may make it impossible to conclude a contract or provide services.

The jay-diz.com website uses cookies and similar technologies. Consents are managed via the Cookiebot platform (Usercentrics A/S).

• Necessary — ensure that the website works properly and remember your consent choices (Article 6(1)(f) GDPR); they do not require consent.
• Preferences and statistics — including Google Analytics: help us understand how visitors use the website.
• Marketing — Google Ads and Meta Pixel (Facebook, Instagram): measure the effectiveness of ads and allow ads to be shown to people who have visited the website.

Cookies other than necessary ones are used only after consent has been given in the banner (Article 6(1)(a) GDPR, Article 399 of the Polish Electronic Communications Law of 12 July 2024). You can change or withdraw your consent at any time on the Cookie Declaration page; withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. Cookies can also be deleted or blocked in your browser settings.

Google Ireland Ltd. and Meta Platforms Ireland Ltd. may also process data as independent controllers in accordance with their own privacy policies. The current list of cookies, including their retention periods, is available in the Cookie Declaration.

The Controller reserves the right to make changes to this Privacy Policy. The current version of the document is always available on the Controller’s website.

Last updated: 18 October 2026.