Privacy policy and cookies of the rpm.pl website
This document describes who processes your data on the rpm.pl website, for what purpose and on what legal basis, how long we keep it, who we entrust it to, and what rights you have. It fulfils the information obligation under Article 13 GDPR.
Data controller and contact
The controller of your personal data is RPM Studio sp. z o.o., ul. Piłsudskiego 67, 33-100 Tarnów, Poland, National Court Register (KRS): 0000455623, Tax ID (NIP): 9930075899, REGON: 851652169.
For matters relating to personal data, write to warszawa@rpm.pl or use the details on the CONTACT page. We have not appointed a data protection officer – requests are handled directly by the controller.
Purposes of processing, legal bases and retention periods
| Purpose | Legal basis | Retention period |
|---|---|---|
| Responding to an enquiry and preparing a quote (order form, voice-talent quote request, e-mail, phone) | Art. 6(1)(b) GDPR – pre-contractual measures; Art. 6(1)(f) GDPR – our legitimate interest in handling correspondence | up to 12 months from the last contact, and if an agreement is concluded – for the duration of its performance |
| Performing a recording, post-production or podcast session order, and settlements | Art. 6(1)(b) GDPR – performance of a contract; Art. 6(1)(c) GDPR – tax and accounting obligations | for the duration of performance, and settlement documentation for 5 years from the end of the tax year |
| Sharing selected voices via a link (e.g. /vo/..., /q/...) with a person indicated by the client | Art. 6(1)(f) GDPR – the parties' legitimate interest in efficient presentation of offers | until the link expires (maximum 365 days from creation), after which we delete the snapshot |
| Access to password-protected zones and the admin panel (session, security logs) | Art. 6(1)(f) GDPR – ensuring website security and detecting abuse | session up to 12 hours, technical logs up to 12 months |
| Visit statistics (analytics files) | Art. 6(1)(a) GDPR – your consent; Art. 173 of the Electronic Communications Law | until consent is withdrawn, no longer than 24 months |
| Marketing activities (marketing files, remarketing) | Art. 6(1)(a) GDPR – your consent | until consent is withdrawn, no longer than 24 months |
| Establishing and defending against claims | Art. 6(1)(f) GDPR | until the statute of limitations for claims expires |
Providing your data is voluntary, but without contact details we cannot prepare a quote or fulfil an order. Consents for analytics and marketing files are entirely voluntary, and refusing them does not limit your use of the website.
What data we collect
- Data provided in forms: first and last name, e-mail address, phone number, company name, invoicing details, the content of your enquiry, project description and fields of use, any script attachments.
- Technical data automatically recorded in server and CDN logs: IP address, browser and system type, the address of the visited page, date and time, referring page.
- Data from cookies and similar technologies – as described below.
- The voices you select and notes, if you use the quote or link-sharing features.
We do not carry out automated decision-making with legal effect or profiling within the meaning of Article 22 GDPR.
Recipients of data and transfers outside the EEA
We entrust data only to trusted providers acting on our instructions under data-processing agreements:
- hosting and CDN provider and attack protection (running the website, filtering traffic),
- file storage provider, where we keep voice talent photos and audio samples,
- database and server function provider handling quotes, link sharing and the admin panel,
- e-mail delivery provider (forwarding quote requests to our team),
- SMS gateway operator used for one-time-code login to the admin panel,
- accounting office, law firms and IT service providers – to the extent necessary to perform their tasks,
- entities authorised by law, if they make a request based on an appropriate legal basis.
Some providers may process data in countries outside the European Economic Area. In such cases, the transfer takes place on the basis of standard contractual clauses approved by the European Commission or an adequacy decision, together with additional technical safeguards (encrypted transmission, restricted access). A copy of the safeguards applied is available on request.
Your rights
- the right to access your data and receive a copy of it,
- the right to rectify inaccurate or incomplete data,
- the right to erasure ("the right to be forgotten"),
- the right to restriction of processing,
- the right to data portability for data processed on the basis of consent or a contract,
- the right to object to processing based on legitimate interest,
- the right to withdraw consent at any time – without affecting the lawfulness of processing carried out before its withdrawal,
- the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.
It is enough to send a request to warszawa@rpm.pl. We respond without undue delay, no later than within one month.
What cookies are and how we use them
Cookies are small text files saved on your device by the browser. We use them in three categories, and files other than necessary ones are only run once you consent via the banner.
| Category | Purpose | Basis | Lifetime |
|---|---|---|---|
| Necessary | maintaining the session, remembering your cookie decision, form security (CSRF protection), access to password-protected zones | necessary to provide the service – consent is not required | session or up to 12 months |
| Analytics | anonymous visit statistics: number of visits, pages viewed, browser type and country – used to improve the website | consent – blocked by default | up to 24 months or until consent is withdrawn |
| Marketing | matching advertising content and measuring campaign effectiveness | consent – blocked by default | up to 24 months or until consent is withdrawn |
Until analytics consent is given, statistical and marketing scripts are technically blocked – they do not create a session identifier or send events. After consent is withdrawn, we delete the related cookies and browser storage entries.
The website also embeds external materials, e.g. video players (YouTube, Vimeo) and Google map previews and the 3D tour. They load only after you click, and may set their own cookies in accordance with those providers' policies.
Changing and withdrawing consent
You can change your decision at any time – just use the "Cookie settings" link in the website footer, choose "Manage preferences" and save your new choice, or withdraw consent with a single click.
You can also block or delete cookies in your browser settings. Restricting necessary cookies may impair some features, e.g. playing samples or logging into protected zones.
Browser vendor instructions: Google Chrome Mozilla Firefox Microsoft Edge Safari
Security and changes to the policy
The website operates exclusively over HTTPS, uses attack protection and security headers, and only authorised persons have access to data. Data in the database is protected by record-level access rules, and sharing links use random tokens with limited validity.
We may update this policy in connection with changes in law, technology or the scope of our services. We will inform you of any material changes in a visible way on the website. If you have any questions, please contact us – details are available on the CONTACT page.