Privacy & cookie policy

1. General provisions

This Personal Data Protection Policy (the "Policy") sets out the rules and procedures for processing and protecting personal data at TBM Draft Vibe Sp. z o.o., with its registered office in Katowice (the "Company"), in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "GDPR") and national law.

The purpose of the Policy is to ensure that personal data is processed in line with the principles of lawfulness, fairness, transparency, minimisation, integrity, confidentiality and accountability.

The Policy applies to all employees of the Company and to persons cooperating under civil-law contracts.

2. Definitions

• Controller – TBM Draft Vibe Sp. z o.o., ul. Warszawska 40/2A, 40‑008 Katowice.
• Personal data – any information relating to an identified or identifiable natural person.
• Processing – any operation performed on personal data, including collection, recording, storage, disclosure and erasure.
• Processor – an entity that processes personal data on behalf of the Controller.
• Data subject – a client, contractor, employee, job candidate or other person whose data is processed by the Company.

3. Scope and purposes of processing

Personal data is processed in particular for the following purposes:

• delivery of design and consulting services,
• business communication (e-mail, phone, contact forms),
• handling enquiries and quotation requests,
• maintaining social media profiles (LinkedIn, Facebook, Houzz),
• marketing activities,
• recruitment,
• fulfilling obligations arising from law (accounting, tax).

4. Categories of data

The Company may process the following data:

• identification data (first name, surname, company name, tax ID, business registry number),
• contact data (address, e-mail, phone),
• professional data (CV, education, work experience – in recruitment),
• social media activity (comments, private messages).

5. Legal bases for processing

• Art. 6(1)(a) GDPR – the data subject’s consent,
• Art. 6(1)(b) GDPR – performance of a contract,
• Art. 6(1)(c) GDPR – legal obligations of the Controller,
• Art. 6(1)(f) GDPR – the legitimate interest of the Controller (e.g. marketing of its own services, protection against claims).

6. Data retention period

Personal data is stored for the period of:

• the duration of cooperation and the limitation period for claims (contracts, services),
• as required by law (e.g. tax and accounting – 5 years),
• until consent is withdrawn (marketing, newsletter),
• a maximum of 6 months for recruitment (unless the candidate consents to longer storage).

7. Data recipients

Personal data may be shared with:

• providers of hosting and IT services,
• providers of accounting, advisory and legal services,
• subcontractors and business partners involved in delivering services,
• social media operators (LinkedIn, Facebook, Houzz – in connection with company profiles).

8. Transfers outside the EU

Data may be transferred to third countries (the USA) in connection with the use of Facebook, LinkedIn and Houzz. The Controller applies appropriate legal safeguards, in particular standard contractual clauses.

9. Rights of data subjects

Every person whose data is processed has the right to:

• access their data,
• rectification,
• erasure ("the right to be forgotten"),
• restriction of processing,
• data portability,
• object to processing,
• lodge a complaint with the President of the Personal Data Protection Office (UODO).

10. Security measures

The Company implements organisational and technical measures to protect data, in particular:

• passwords and encryption,
• backups,
• network and IT equipment security,
• access control to data and premises,
• a clean-desk policy,
• employee training.

11. Data breaches

In the event of a personal data breach, the Company:

• analyses the incident and assesses the risk,
• reports the breach to the President of UODO within 72 hours (where required),
• notifies data subjects if the breach may result in a high risk to their rights.

12. Employee obligations

Every employee and associate of TBM Draft Vibe is required to:

• process data only within their granted authorisations,
• maintain confidentiality,
• report incidents related to data protection.

13. Final provisions

• The Policy is subject to regular reviews and updates, at least once a year.
• Matters not covered herein are governed by the GDPR and national law.
• The Policy enters into force on 1 August 2025.

1. General information

This Cookie Policy sets out the rules for using cookies and similar technologies on the tbmdv.pl website operated by TBM Draft Vibe Sp. z o.o., with its registered office in Katowice (the "Company").

2. What are cookies?

Cookies are small text files saved on the user’s device while using the website. Cookies may be read by the Company’s IT system or by third parties.

3. Purposes of using cookies

On tbmdv.pl, cookies are used for the following purposes:

• ensuring the website works correctly (technical cookies),
• creating visit statistics and traffic analysis (e.g. Google Analytics),
• personalising content and adapting the site to user preferences,
• marketing and remarketing activities (e.g. Facebook Pixel, LinkedIn Insight Tag, Houzz).

4. Types of cookies used

The Company uses the following types of cookies:

• Essential – required for the website to function (e.g. remembering preferences, handling contact forms),
• Analytical – allowing data collection on how the site is used (e.g. Google Analytics),
• Marketing – allowing personalised ads based on user activity (e.g. Facebook, LinkedIn, Houzz).

5. Cookie retention period

• Session cookies – stored until the browser is closed,
• Persistent cookies – stored for the period set in their parameters or until the user deletes them.

6. Managing cookies

The user may change cookie settings in their browser at any time, including blocking automatic handling of cookies or deleting saved files. Detailed information is available in the browser settings (e.g. Chrome, Firefox, Safari, Edge).

Not changing cookie settings means they will be saved on the user’s device.

7. Third-party cookies

The tbmdv.pl website uses third-party cookies, including:

• Google LLC (Google Analytics),
• Meta Platforms Ireland Ltd. (Facebook Pixel),
• LinkedIn Ireland Unlimited Company (LinkedIn Insight Tag),
• Houzz Inc. (widgets and integrations).

We use Google Analytics 4 (measurement ID G-T3G0QXQ7JQ) for traffic analysis, operating in consent management mode (Google Consent Mode v2). This means the tool is activated and analytical cookies are stored only after the user gives consent in the cookie banner — no analytical data is collected before acceptance. Consent can be withdrawn at any time — click “Cookie settings” in the page footer and choose “Essential only” — Google Analytics cookies will then be deleted. Cookies can also be deleted in the browser settings. Data collected via these cookies may be transferred to third countries (e.g. the USA) in accordance with applicable law and with appropriate safeguards in place.

8. Changes to the Cookie Policy

The Company reserves the right to amend this Cookie Policy in the event of legal, technological or organisational changes. The current version is always available on the website.