Privacy policy

The website runs on Cloudflare servers, which speed up loading and protect the website against attacks. On every visit, these servers record the IP address, time, page address and browser information in their logs. We use them to keep the website running and to detect abuse – this is our legitimate interest (Art. 6(1)(f) GDPR). The logs are kept for a short time, in line with the provider’s settings.

On your first visit, we ask for your consent to cookies. Without it, we store in your browser only what the website needs to work: your cookie choice, the theme (light or dark) and the language version, if you change them. We store PostHog cookies only with your consent, in accordance with Art. 399 of the Polish Electronic Communications Law and Art. 6(1)(a) GDPR.

You can change or withdraw your consent at any time with the “Cookie settings” button – below or in the website footer. When you withdraw consent, we delete the PostHog cookies from your browser. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

The website also contains links to other services, e.g. Nardeo Agro or Open Mercato. Once you go to them, their own privacy policies apply.

You can write to us using the form on the website or by email. In the form you give your full name, email address and message and – if you wish – your company name and a topic. Messages from the form go to our mailbox and are sent for us by Resend, Inc. When you write by email, you decide what you share with us: we process the address you write from, the details in your signature (e.g. first name, surname, company, phone number) and the content of the message together with any attachments. Our email is handled for us by home.pl S.A., with its registered office in Szczecin.

The form is protected against spam by Cloudflare Turnstile. It checks whether a person is sending the form and processes the IP address and basic information about the browser to do so. We do this on the basis of our legitimate interest, i.e. protection against spam and abuse (Art. 6(1)(f) GDPR).

We reply to messages and discuss working together on the basis of our legitimate interest (Art. 6(1)(f) GDPR). When you ask for an offer for yourself as a future party to a contract, the basis is also taking steps prior to entering into the contract (Art. 6(1)(b)).

If the conversation does not lead to working together, we delete the correspondence no later than 2 years after the last message, or earlier if you ask us to.

When you become our client or a contact person in a project, we process the data needed to conclude and perform the contract: company details, the names of the people who represent the company, business contact details, invoicing data and project correspondence. The legal basis is:

• the contract, when you are a party to it, e.g. you run a sole proprietorship (Art. 6(1)(b) GDPR),
• a legal obligation for invoices, accounting and taxes (Art. 6(1)(c)),
• our legitimate interest: contact with the people the client has designated for the cooperation, and establishing and defending claims (Art. 6(1)(f)).

If your data was provided to us by your employer or principal, they are its source. In that case, we usually receive your first name and surname, business email address and phone number, and job title.

We keep contract data for the duration of our cooperation and then until claims become time-barred – for claims related to business activity, as a rule 3 years. We keep accounting documents for 5 years, counting from the end of the year in which the tax payment deadline passed.

When building and maintaining our clients’ systems, we often have access to data about their customers, employees or business partners. In that case, the controller of that data is our client. We process it solely on the client’s instructions, under a data processing agreement (Art. 28 GDPR).

This policy does not cover such processing. If your data is in a system we look after, you can exercise your rights with the company that uses it, and we will help that company respond efficiently.

We use a few providers to whom we entrust data to the extent needed for their service. Each of them processes it solely on our instructions.

Data from invoices and settlements also goes to the accounting firm that keeps our books. Apart from that, data may be received by public authorities, e.g. the tax office, where the law requires it.

Cloudflare and Resend process some of the data in the USA. PostHog stores statistics and recordings on servers in the European Union, but as a US company it may also access them from there. The transfer is based on a European Commission adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses approved by the Commission (Articles 45 and 46 GDPR). We will send you a copy of the safeguards applied on request.

Write to hello@nardeo.com with the subject “Personal data”. We reply within one month. If the matter is particularly complex, this period may be extended by a further two months – in that case, we will let you know within the first month.

You can also lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

Providing data is voluntary. Without an email address we cannot reply to your message, and without the data needed for the contract and the invoice we cannot conclude or settle our cooperation – invoicing data is required by tax law.

We do not make decisions about you based solely on automated processing, including profiling (Art. 22 GDPR). Visit statistics and session recordings help us improve the website, not assess specific people.

We protect data the same way we protect our clients’ systems: access is limited to the people who need it, we secure accounts with two-factor authentication, and the entire website runs over an encrypted HTTPS connection. You can read more about our practices on the Trust and security page.

We update this document when we change providers, tools or the way we process data. We will clearly announce significant changes on the website. This version applies from 3 November 2026.