Privacy Policy
Last updated: 28 September 2026
This policy explains what happens to personal data you submit through evaudiences.com — mainly through the order form — and what rights you have over it. It is written to meet Regulation (EU) 2016/679 (GDPR).
1. Who is responsible
The controller of your data is Łukasz Ostrowski, trading as Lost JDG, Łódź, Poland. Contact: lukicorp@gmail.com.
No data protection officer has been appointed — that obligation does not apply to a business of this size and processing profile. Write to the address above with any privacy question.
2. What data is collected
| Data | Where it comes from |
|---|---|
| Company name, contact name, work email | Order form — required |
| VAT number | Order form — optional, used for reverse-charge invoicing |
| Order details: format, communities, publish date, campaign brief | Order form |
| IP address and browser user agent | Recorded with the order for security and abuse prevention |
| Invoice and payment records | Created after you accept an order |
| Aggregated traffic statistics | Google Analytics — only if you consent to analytics cookies |
Do not put special-category data, credentials or other people's personal data into the brief field. It is not the place for it.
3. Why it is processed, and on what legal basis
- Handling your order and the contract — quoting, confirming, publishing the placement and reporting on it. Legal basis: Art. 6(1)(b) GDPR (steps prior to, and performance of, a contract).
- Invoicing and accounting — issuing invoices and keeping them as required by Polish tax law. Legal basis: Art. 6(1)(c) GDPR (legal obligation).
- Security of the site — rate limiting, CSRF protection and abuse investigation using the IP address stored with the order. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in keeping the service available and free of abuse).
- Analytics — understanding which pages are read. Legal basis: Art. 6(1)(a) GDPR (consent). Withdraw it at any time, see section 7.
Providing the required form fields is necessary to receive a quote. Without them no order can be processed. The VAT number is optional and only affects how the invoice is issued.
4. How long it is kept
- Enquiries that do not lead to an order: 12 months from the last contact.
- Orders, invoices and accounting records: 5 years from the end of the tax year in which the invoice was issued, as required by Polish tax law.
- Server access and security logs: up to 12 months.
- Analytics data: up to 14 months in Google Analytics, in aggregated form.
5. Who else sees it
Data is not sold and is not used for anyone else's marketing. It is shared only with providers who process it on our behalf, under a data processing agreement:
- Hosting: the site and its database run on a server located in Warsaw, Poland, managed through the xCloud panel.
- Email: Google (Gmail / Google Workspace) delivers the confirmation emails.
- Analytics: Google Analytics 4, only with your consent, with IP anonymisation enabled.
- Accounting: the accountant and the tax authority, to the extent required by law.
Google may process data outside the European Economic Area. Those transfers rely on the European Commission's Standard Contractual Clauses and the EU–US Data Privacy Framework. Everything else stays within the EEA.
6. Your rights
Under the GDPR you may request:
- access to your data and a copy of it;
- rectification of data that is wrong or incomplete;
- erasure, where we no longer need the data and no tax obligation requires us to keep it;
- restriction of processing;
- portability of the data you provided, in a machine-readable format;
- objection to processing based on legitimate interest;
- withdrawal of consent at any time, without affecting processing done before the withdrawal.
Write to lukicorp@gmail.com — requests are answered within one month. If you think your data is handled incorrectly, you may lodge a complaint with the Polish supervisory authority, Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa.
7. Cookies and local storage
The site uses as little as it can get away with:
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
ev_csrf | Necessary cookie | Protects the order form against cross-site request forgery. | 6 hours |
ev_cookie_consent | Necessary, local storage | Remembers your cookie choice so the banner does not reappear. | Until you clear it |
_ga, _ga_* | Analytics cookie | Google Analytics 4 — aggregated traffic statistics. Set only after you accept analytics. | Up to 2 years |
Analytics scripts are not loaded until you accept them. To change your mind, clear this site's data in your browser — the consent banner will appear again on your next visit. No advertising or cross-site tracking cookies are used.
8. Automated decision-making
There is no automated decision-making or profiling with legal or similarly significant effects. Orders are reviewed by a person.
9. Security
The site is served over HTTPS, the form is protected by a CSRF token and rate limiting, and access to the database and mailbox is restricted to the controller. No method of transmission is perfectly secure, but data is kept to the minimum needed to do the job.
10. Changes to this policy
If this policy changes, the new version is published on this page with an updated date. Material changes affecting existing orders are communicated by email.