The controller of personal data processed in connection with the use of the Robolupa website (robolupa.com and robolupa.pl) is OceanSphere Service Sp. z o.o., ul. Nowogrodzka 31, 00-511 Warszawa, Poland, KRS: 0001211680, NIP: 7011291111, REGON: 543507885, email: editor@robolupa.com (the "Controller"). The legal basis for processing is Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and the Polish Act of 10 May 2018 on the Protection of Personal Data.
1. What we do not do
The site does not use Google Analytics or any other third-party analytics or advertising tool and does not set cookies of its own (details: Cookie Policy). Browsing the catalog does not require you to provide any data. We currently do not measure visits with any tool installed on the pages; if we start our own cookie-free statistics tool, we will describe it here before switching it on.
To check that our forms work, we count anonymously how many forms were started and submitted (no cookies, no identifiers, no IP address or field contents stored). The figures are used for aggregate statistics only.
2. What data we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Serving the page (web server logs) | IP address, timestamp, requested page address, User-Agent | Art. 6(1)(f) GDPR (legitimate interest — security and diagnostics) | up to 30 days |
| Email contact with the editorial team (error report, question) | email address and message content | Art. 6(1)(f) GDPR (legitimate interest — handling the request) | up to 12 months after the matter is closed |
| Enquiry form about deploying a robot ("Ask about a robot" page and the form on a company page) | full name or company name, email address, the enquiry text and — if you give them — company, phone, type of robot, budget, planned timing, model; the page the enquiry was sent from; hash of the IP address | Art. 6(1)(a) GDPR (consent ticked in the form, including consent to pass the enquiry on to selected companies) | up to 12 months after the enquiry is sent, or until consent is withdrawn, whichever comes first |
| Counting forms (how many forms were started and submitted) | only the number of events per day and form; no IP address, no identifier, no field contents | Art. 6(1)(f) GDPR (legitimate interest — checking that the forms work); aggregate data not linked to a person | no limit (aggregate data) |
| YouTube video (only after you click the play button) | IP address and browser data transmitted to YouTube (Google) | Art. 6(1)(a) GDPR (clicking the button) | per Google's policy; the Controller does not store this data |
The Controller does not store IP addresses in plain form in the form database — only a cryptographic hash with a secret salt, used to limit abuse (rate limiting).
3. Enquiry form about deploying a robot
The form lets you send an enquiry about deploying a robot in your company. Required: your full name (or company name), email address and consent; the other fields (company, phone, type of robot, budget, planned timing, model, description of the task) are optional. Together with the enquiry we store the address of the page it was sent from (for example a category or model page) and a hash of the IP address, which is used only to limit abuse.
We read enquiries by hand. With the consent you tick in the form, we pass them on to companies chosen by the editors — integrators or robot dealers from our catalogue that fit the topic — covering what was filled in (including your name, email address and phone number if you gave one). A company that receives the enquiry processes it as a separate controller and is itself responsible for any further contact. If no company fits the enquiry, we pass it on to no one.
Consent is voluntary; without it we cannot handle the enquiry through the form (you can write to editor@robolupa.com instead). You can withdraw consent at any time by email, without affecting the lawfulness of processing carried out before withdrawal. After withdrawal we delete the data from the enquiry, and if it was already passed to a company, we tell that company that consent was withdrawn.
We do not send an automatic confirmation message; we reply by hand to the email address given in the form.
4. Contacting the editorial team
Contact with the editorial team is by email to the editorial address on the robolupa.com domain (editor@robolupa.com). We use the content of the message and the sender's address only to reply and do not pass them to third parties.
5. YouTube video
Model pages and some articles contain a button to play a video. Until you click the play button, we do not connect to YouTube. After the click we load the player from the youtube-nocookie.com domain, which transmits your IP address and browser data to Google (recipient: Google Ireland Limited; data may also be transferred to Google LLC in the USA). Further processing is governed by Google's privacy policy.
6. Recipients of data
Data may be passed to processors acting on the Controller's behalf under data processing agreements compliant with Article 28 GDPR: the provider of the server on which the site runs (Hetzner Online GmbH, Germany — EEA), and the email provider handling the editorial addresses (forwarding messages to the operator's mailbox). If a provider is established outside the European Economic Area, the transfer is based on standard contractual clauses (SCCs) or an adequacy decision of the European Commission. We do not sell data. We also pass on the data from the enquiry form to companies (integrators or robot dealers) chosen by the editors — only with the consent ticked in the form, as described in section 3.
7. Your rights
Everyone has the right of access to their data, rectification, erasure, restriction of processing, data portability and the right to object to processing based on legitimate interest; where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Requests concerning your data (access, rectification, erasure) and the withdrawal of consent to pass an enquiry on to companies can be sent to editor@robolupa.com. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, Poland.
8. Data security
The Controller applies technical and organizational measures appropriate to the risk of processing (encrypted HTTPS connection, restricted access to data, backups). Data is not used for automated decision-making or profiling that produces legal effects for the user.