Legal

Privacy Policy

Effective date: 1 October 2026

This Privacy Policy explains how personal data is processed when you visit bailaagency.com or use the contact form.

1. Data controller

The controller of your personal data is:

Laura Gotowska
ul. Czereśniowa 12
62-302 Węgierki
Poland

NIP: 7891788937
REGON: 383871086
E-mail: hello@bailaagency.com

The business may use the brand name Baila or Baila Agency.

2. What data we process

2.1 Data submitted through the contact form

The contact form contains the following fields:

  • name and surname (required);
  • business or brand name (optional);
  • e-mail address (required);
  • where you are based (optional);
  • the service you are enquiring about (required);
  • message content (required);
  • an optional checkbox indicating that you would also like to receive examples of our work.

All of the above is included in the e-mail notification sent to us.

If you tick the box asking for examples of our work, we treat that as part of your enquiry and send the examples in our reply. It does not subscribe you to a newsletter or a mailing list, and we do not use it to send you unrelated marketing.

Please do not include sensitive personal data or other information that is not necessary for your enquiry.

2.2 Technical and security data

When you visit the website, Cloudflare may process technical data required to deliver, secure and protect the website, including your IP address, browser and device information, and security logs.

The website uses Cloudflare Turnstile as an anti-bot and abuse-prevention measure. Turnstile may process the IP address, TLS fingerprint, User-Agent header, website key and website origin. Turnstile may also use strictly necessary cookies or similar technical mechanisms.

When you submit the contact form, the website's Cloudflare Worker reads your IP address to enforce a limit of up to five submissions per minute from one IP address. This IP address is not included in the e-mail sent to us and is not stored by us in a database.

The application logs contain only the status of an operation, such as "sent" or "rejected as spam". They do not contain your name, e-mail address or message content.

3. How the contact form works

The contact form does not send data directly from your browser to Brevo. The current flow is:

1. your browser sends a request to /api/lead on the same website domain;
2. the Cloudflare Worker verifies the Turnstile token with Cloudflare;
3. the Worker sends the enquiry through the Brevo API;
4. Brevo sends an e-mail notification to hello@bailaagency.com;
5. the notification is received and stored in a Gmail account.

We do not use a database, CRM, spreadsheet or n8n webhook for contact-form submissions. An optional n8n webhook exists in the code but is not enabled and has no configured address.

We process personal data for the following purposes:

Responding to an enquiry and discussing possible services

We use the data submitted through the form to read, assess and answer your enquiry, communicate with you and, where requested, take steps before entering into a contract.

The legal basis is Article 6(1)(b) GDPR where the enquiry concerns steps at your request before entering into a contract. For general enquiries that are not connected with a possible contract, the legal basis is Article 6(1)(f) GDPR — our legitimate interest in responding to correspondence and developing or maintaining business relationships.

Website security and abuse prevention

We use technical data, including IP addresses processed for rate limiting, Turnstile data and security information, to protect the website, prevent automated abuse and spam, and maintain the security of the contact form.

The legal basis is Article 6(1)(f) GDPR — our legitimate interest in protecting the website, our systems and the contact channel.

If necessary, we may retain and use relevant data to establish, exercise or defend legal claims.

The legal basis is Article 6(1)(f) GDPR — our legitimate interest in protecting and enforcing our legal rights.

If an enquiry results in a contract, we may process relevant data to fulfil legal obligations, including accounting and tax obligations.

The legal basis is Article 6(1)(c) GDPR — compliance with a legal obligation to which the controller is subject.

We do not use contact-form data for a newsletter, mailing list, behavioural advertising, remarketing, analytics or automated decision-making.

5. Recipients and service providers

Your data may be disclosed to the following recipients or service providers, only to the extent necessary for the purposes described above:

Cloudflare, Inc. — United States

Cloudflare provides hosting, Cloudflare Workers, website security, anti-bot protection through Turnstile and e-mail forwarding through Cloudflare Email Routing. Cloudflare may process technical data and may transiently process contact-form data while the Worker routes the submission to Brevo.

Brevo — Sendinblue SAS, France

Brevo provides the API and transactional e-mail delivery used to send a notification about a new enquiry. Based on the current configuration, Brevo receives the data necessary to create and send that notification. Brevo is established in France, within the European Economic Area.

Google LLC — United States

Google provides the Gmail mailbox in which the e-mail notification is received and stored. The address hello@bailaagency.com is an alias handled by Cloudflare Email Routing and forwarded to the Gmail account.

We do not disclose contact-form data to advertising networks, analytics providers, CRM providers, social-media pixels or remarketing providers.

6. Transfers outside the European Economic Area

Cloudflare, Inc. and Google LLC are established in the United States. Their services may therefore involve the transfer or processing of personal data outside the European Economic Area, including in the United States.

For Cloudflare, the transfer safeguards are based on the EU-U.S. Data Privacy Framework where the relevant transfer is covered by Cloudflare's valid certification. Where the Data Privacy Framework does not apply or is no longer available, Cloudflare's contractual safeguards include the European Commission's Standard Contractual Clauses and additional safeguards under Cloudflare's Data Processing Addendum.

Google states that Google LLC and its wholly owned U.S. subsidiaries have certified adherence to the EU-U.S. Data Privacy Framework. Transfers covered by that framework are based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework. Google also states that it relies on Standard Contractual Clauses for transfers where required or where the transfer is not covered by an adequacy decision.

The legal basis for these transfers is Article 46 or Article 45 GDPR, as applicable to the particular transfer and the safeguard used by the relevant provider.

7. How long we keep data

  • Enquiries that do not result in a contract: the content of the enquiry and related correspondence is kept in the Gmail mailbox for up to 12 months after the last substantive communication, and is then permanently deleted, including from the mailbox's trash. We review the mailbox for this purpose at least once every three months.
  • Enquiries that result in a contract: relevant data is moved into the ordinary contract, business, accounting and tax records and kept for the period required by applicable law or for the period necessary to establish, exercise or defend legal claims.
  • Technical and security data: we do not keep a separate application log containing the form content or the sender's IP address. Cloudflare and Turnstile may retain technical and security data for the periods set by their applicable services, settings and policies. Brevo may retain transactional e-mail and delivery logs in accordance with its applicable service settings and policies.

8. Your rights

Subject to the conditions and limitations set out in the GDPR, you may have the right to:

  • obtain access to your personal data and information about its processing;
  • correct inaccurate or incomplete data;
  • request erasure of your personal data;
  • request restriction of processing;
  • object to processing based on our legitimate interest;
  • receive data that you provided to us in a structured, commonly used and machine-readable format, where the right to data portability applies;
  • lodge a complaint with a supervisory authority.

To exercise your rights, contact us at hello@bailaagency.com. We may need to verify your identity before fulfilling a request. We normally respond within one month. This period may be extended by a further two months where permitted by the GDPR, taking into account the complexity and number of requests.

You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), in particular if you believe that your personal data is processed in breach of the GDPR. Information about contacting UODO is available at uodo.gov.pl/p/kontakt.

9. Cookies and similar technologies

The website does not use its own cookies, Google Analytics or any other analytics tools. It does not use advertising pixels or remarketing technologies and does not operate a newsletter or mailing list.

Cloudflare Turnstile may use strictly necessary cookies or similar technical mechanisms for anti-bot protection and website security. They are not used by us for advertising, analytics or behavioural tracking.

10. Automated decision-making and profiling

We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects.

11. Security

We use reasonable technical and organisational measures appropriate to the nature and risk of processing. The contact-form architecture is designed so that submitted data is not stored in a website database, CRM or spreadsheet. Access to the Gmail mailbox and service-provider accounts is limited to authorised persons and protected with strong, unique credentials and multi-factor authentication.

12. Changes to this Privacy Policy

We may update this Privacy Policy if the website, contact form, service providers or applicable law changes. The current version is published on this page together with its effective date.

← Back to the site