Privacy Policy

1. Data controller

The controller is "Ad Alio" sp. z o.o., trading under the Adalio brand.

2. Data we process

The scope depends on the selected contact path. Every form requires a full name, an email address, a preferred contact method and acknowledgement that the legal documents have been read. A phone number is optional. In addition:

• the homeowner form may include an optional topic and description,
• the business form requires a company or institution and a topic and may include a role, project location, type and stage,
• the partner or distributor form requires a company and operating country or region and may include the company profile, website, cooperation model and interest in regional exclusivity.

We also process submission metadata: submission ID, date, language, form and document versions, source page and, when present in the URL, UTM parameters and gclid. The IP address is used transiently for anti-spam checks and rate limiting but is not included in emails containing the enquiry.

3. Purposes and legal bases

• Handling the enquiry, contacting you and preparing an offer: Article 6(1)(b) GDPR - steps taken at your request before a possible contract. For B2B correspondence, Article 6(1)(f) GDPR may also apply - our legitimate interest in conducting and documenting business correspondence.
• Recording the enquiry in the CRM, delivery control and legal claims: Article 6(1)(f) GDPR - continuity, security and accountability.
• Attributing an enquiry source without activating optional cookies: Article 6(1)(f) GDPR - our legitimate interest in assessing the effectiveness of public contact paths and promotional activity. This covers the source page and UTM or gclid parameters when the user arrives through a URL containing them.
• Form protection, rate limiting and technical diagnostics: Article 6(1)(f) GDPR - protecting the Site against spam, automated submissions and failures.
• Analytics and advertising using optional cookies: consent under Article 6(1)(a) GDPR and the applicable Polish Electronic Communications Law.

The required checkbox confirms that the Privacy Policy has been read and the Terms have been accepted. It is not marketing consent and is not the legal basis for processing data needed to handle the enquiry.

4. Voluntary and required data

Using a form is voluntary. Required data is necessary to accept the enquiry, send a confirmation and contact you. Without it, the form cannot be handled. The email address is required because we send confirmation of receipt to it and use it for further correspondence. A phone number is optional and speeds up contact. Optional information may help with the first conversation but is not required.

5. Recipients and service providers

Data may be disclosed to recipients supporting "Ad Alio" sp. z o.o. only to the extent necessary to handle an enquiry, protect the service and operate the Site. Depending on the service, they act as processors on our instructions or as separate controllers within the scope arising from law and their service terms:

• Hostinger - static website hosting and infrastructure,
• HubSpot - CRM and form-submission handling,
• Brevo - transactional confirmations, internal notifications and fallback messages,
• Cloudflare - Turnstile form protection and the validation, short-term queueing and technical idempotency of enquiries in Workers, Queues and Durable Objects,
• Usercentrics/Cookiebot - cookie-choice management and consent records,
• Google - analytics and advertising tools only within the scope allowed by your CMP choice,
• email, IT support, accounting and legal providers and public authorities where required by law.

We do not sell personal data. Some providers may process data outside the European Economic Area. Where this occurs, mechanisms required by GDPR are used, in particular adequacy decisions or Standard Contractual Clauses. You may request information about the applicable mechanism and a copy of the safeguards at hello@adalio.pl.

6. CRM failures and email delivery

Normally the enquiry is recorded in the CRM, the user receives an email confirmation and Adalio receives an internal notification. If the CRM does not accept an enquiry, Brevo may send its details as a clearly marked fallback email to a monitored Adalio mailbox so that it can be entered into the CRM manually. This message does not replace the CRM and has a shorter retention period.

7. Retention

• leads and service history in the CRM - up to 3 years after the last contact, unless a longer period is needed for a contract, legal obligation or claims,
• fallback messages containing enquiry data - until entered manually into the CRM and no longer than 30 days,
• encrypted transport and the main queue containing enquiry data - until delivery or operational recovery and no longer than 24 hours; after failed attempts, a message may move to a separate dead-letter queue for up to another 24 hours, so the total buffering period may be up to 48 hours,
• an active technical idempotency record containing a pseudonymous enquiry hash, status and timestamp - no longer than 30 days; after deletion, an earlier version may remain for up to another 30 days in isolated disaster-recovery points managed by Cloudflare and unavailable during normal service operation,
• other technical logs without enquiry content - 30 days,
• cookie-choice data - for the period shown in the Cookiebot declaration or until the choice is changed.

8. Your rights

Depending on the legal basis and circumstances, you may request access, a copy, rectification, erasure, restriction, portability, object to processing and withdraw consent without affecting prior lawful processing. Contact hello@adalio.pl.

Right to object: you may object at any time to processing based on our legitimate interests, including CRM recording, enquiry-source attribution and technical diagnostics. We will stop that processing unless we demonstrate compelling legitimate grounds or need the data to establish, exercise or defend legal claims.

You may lodge a complaint with the President of the Polish Personal Data Protection Office: uodo.gov.pl.

9. Automated decisions

We do not make decisions producing legal effects solely by automated means. Source information may be used to analyse contact-path effectiveness but does not automatically determine whether an offer is accepted or the terms of cooperation.

10. Cookies, security and changes

Cookie details and choice controls are available in the Cookie Policy. We use organisational and technical measures appropriate to risk, including encrypted transport, server-side validation, anti-spam checks, rate limiting and submission idempotency.

This Policy may change when our processes, providers or applicable law change. The new version is published at this URL with its update date.