Legal information

Privacy policy.

This policy explains what personal data we may process, why we process it and what rights you have.

Last updated: 24 August 2026matstory.com

Data controller

Details required before the form goes live

The entrepreneur’s full legal name, registered or business address and Polish tax number must be inserted here. These details are not being guessed.

The controller is [FULL LEGAL BUSINESS NAME / ENTREPRENEUR’S NAME], with its address at [ADDRESS], Polish tax number [NIP], operating the MatStory brand (the “Controller” or “MatStory”).

Privacy contactShow email address

What data we process and why

We may process information submitted through the form, in particular your name, email address, phone number, selected topic and the content of your enquiry. The form sends this data directly to MatStory’s server and mailbox. To protect the form against abuse, we also process basic connection data, including the IP address, as well as the reCAPTCHA token, action and risk score.

PurposeLegal basis

Responding to enquiries and correspondenceGDPR Art. 6(1)(f) — legitimate interest in communication

Preparing an offer or taking pre-contractual stepsGDPR Art. 6(1)(b)

Protecting the form against spam and abuseGDPR Art. 6(1)(f) — legitimate interest in securing the website

Establishing, pursuing or defending claimsGDPR Art. 6(1)(f)

Meeting legal, accounting and tax obligationsGDPR Art. 6(1)(c)

Providing data is voluntary, but fields marked as required are necessary to handle your message. Please do not send special-category data or information that is not needed for your enquiry.

How long we keep data

We retain correspondence for the time required to handle the matter and then for the period necessary to protect against potential claims. Data connected with a contract, settlement or accounting documentation is retained for the period required by law. Where processing is based on consent, data is retained until consent is withdrawn or the purpose ends earlier.

Recipients and international transfers

Data may be entrusted to providers of hosting, email, IT maintenance, customer-service systems, accounting and legal advice, solely to the extent needed for services provided to the Controller. When the form is submitted, we use Google reCAPTCHA to assess the risk of abuse. Data may also be disclosed to authorised bodies where required by law.

Google may process data outside the European Economic Area. In that case, transfer mechanisms required by the GDPR are used, such as an adequacy decision or Standard Contractual Clauses. See the Google Privacy Policy for details.

Your rights

Depending on the legal basis and circumstances, you may have the right to:

access your data and receive a copy;
rectify or complete your data;
erase data or restrict its processing;
data portability;
object to processing based on legitimate interests;
withdraw consent at any time, without affecting earlier lawful processing;
lodge a complaint with the competent supervisory authority; in Poland this is the President of the Personal Data Protection Office.

To exercise your rights, contact the Controller. We may request information needed to verify your identity before fulfilling a request.

Security, profiling and changes

We use organisational and technical measures appropriate to risk, restrict access to data and require suitable safeguards from providers. reCAPTCHA v3 automatically assesses abuse risk solely to accept or reject an attempt to submit the form. This assessment does not produce legal effects or similarly significantly affect the user.

This policy may be updated as the website develops, new tools are introduced or the law changes. The new version will be published on this page with an updated date.