Privacy policy
Last updated: 15 January 2025
This policy explains what personal data we collect on this website, why we process it, and the rights you have under the GDPR.
1. Data controller
The controller of your personal data is MonArch Architecture Studio, ul. Marszałkowska 84/92, 00-514 Warszawa, VAT ID 0000000000. For any data protection matter write to mon.architecture.stu@gmail.com.
2. What we collect
Contact and order forms: name, phone number, email address, your message and any files you attach (plot survey, zoning conditions, photographs).
Cost calculator: the project parameters you enter — service type, floor area, number of storeys, selected extras.
Client account: sign-in credentials, order history, documents and invoices, and your correspondence with the project manager.
Technical data: IP address, browser type, referring page and campaign parameters (UTM), recorded when a form is submitted in order to detect abuse.
3. Purposes and legal bases
Replying to your enquiry and preparing a quote — Art. 6(1)(b) GDPR (steps prior to a contract).
Performing the design contract, issuing invoices and running the client account — Art. 6(1)(b) and (c) GDPR (accounting obligations).
Statistics and marketing (Google Analytics, Meta Pixel) — Art. 6(1)(a) GDPR, only after you consent in the cookie banner.
Site security and spam protection (reCAPTCHA, login throttling, audit log) — Art. 6(1)(f) GDPR (legitimate interest).
4. Retention
Enquiries that do not lead to a contract are deleted after 24 months. Project and accounting records are kept for five years from the end of the tax year, as required by Polish law. Account data is kept until you delete the account.
5. Recipients
We share data only with processors that are necessary to deliver the service: hosting and object storage providers, the mail (SMTP) provider, our accountants, the payment provider, and — subject to your consent — Google and Meta for analytics. We never sell personal data.
Structural and building-services designs are produced by our partners. They receive only the data required to complete their part of the documentation.
6. Your rights
You have the right to access, rectify, erase, restrict and port your data, and to object to processing. You can withdraw consent for analytics and marketing cookies at any time in the cookie settings. You may also lodge a complaint with the Polish data protection authority (UODO).
7. Cookies
Strictly necessary cookies handle sign-in, sessions and security and cannot be switched off. Analytics and marketing cookies load only after you consent; until then no Google or Meta script is loaded at all.
8. Security
The site is served over HTTPS only. Passwords are stored as bcrypt hashes, files in encrypted object storage, and every administrative action is written to an audit log. The database is backed up daily.