AR23, strategic and AI consultancy
PLEN

Privacy policy

In force from 29 October 2026.

1. Controller

The controller of personal data is AR23 sp. z o.o., ul. Opolska 110, 31-323 Kraków, Poland, NIP 6751540390, KRS 0000609559.

For matters concerning personal data, you can contact us through the form on the Contact page or by post at the address above.

2. Contact form

When you send a message through the form, we process: your full name, company name, e-mail address, phone number, the content of the message, the service page from which the form was sent, and the date. Company and phone are optional. Without your name, e-mail address and message we cannot reply.

  • Purpose: to reply to your message and prepare a proposal for cooperation.
  • Legal basis: our legitimate interest in handling correspondence (Article 6(1)(f) GDPR) and, if we discuss a contract, steps taken at your request before entering into it (Article 6(1)(b) GDPR).
  • Protection against abuse: to limit spam, we store an encrypted hash of your IP address (not the address itself) and accept no more than 5 messages per hour from one address. Legal basis: our legitimate interest in protecting the form (Article 6(1)(f) GDPR).
  • Retention: 12 months from the last message in a given matter. If we conclude a contract, the data needed to settle it is kept for as long as tax and accounting law requires and until claims become time-barred.

3. Visit statistics

The hosting provider keeps aggregate visit statistics: number of visits, pages viewed, traffic source, country and device type. The site does not store cookies in your browser for this purpose and does not use advertising or tracking tools.

4. Cookies

The site stores one cookie: __cf_bm, set by Cloudflare to tell human traffic from automated traffic (bot protection). It is necessary for the site to run securely and expires after 30 minutes. It does not require consent, as it is not used for analytics or advertising.

5. Fonts

Typefaces are loaded from Google Fonts servers. When the page is displayed, your browser connects to Google servers, which receive your IP address and browser information.

6. Who receives the data

Only providers without whom the site and the form would not work. They process data on our behalf and on our instructions:

  • Lovable (lovable.dev): website hosting, the form database and sending notifications of new messages. The database is located in the European Union (Ireland).
  • Cloudflare: delivering the site and protecting it against attacks.
  • Google: the mailbox that receives form notifications, and fonts (section 5).

We do not sell data or share it for marketing purposes.

7. Transfers outside the European Economic Area

Some providers (Google, Cloudflare, Lovable) use infrastructure or entities outside the EEA, including in the United States. Transfers are based on a European Commission adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses approved by the Commission.

8. Your rights

You have the right to access your data, to rectify, erase and restrict its processing, to data portability, and to object to processing based on our legitimate interest. Just write to us through the contact form or by post.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

We do not make decisions based solely on automated processing, including profiling.

9. Changes to this policy

The current version is always available at this address, with its effective date at the top.