Privacy notice

Effective from: 21 October 2026. This document describes the current technical configuration and data-processing rules for the Evin Media website.

1. Controller and contact

The data controller is Patryk Parcheta, operating under the Evin Media brand, Polish tax ID (NIP) 8631701733, statistical number (REGON) 380865406. Contact for personal-data matters: hello@evin.media.

A public correspondence address is not disclosed. A person exercising data-protection rights may request the appropriate correspondence channel by emailing the address above.

2. Data we process and its source

The contact form collects directly from you: your name, email address, optional company name, selected service area, and message. We also record the locale and internal source page, the version of the notice shown to you, a submission identifier, and technical statuses needed to persist the inquiry and deliver its notification.

To protect the form, the system may process an IP address briefly and convert it into a non-reversible HMAC token assigned to a 15-minute window. The raw IP address is not stored with the inquiry. We do not ask for passwords, API keys, payment information, or special-category data. Do not include them in your message.

3. Purposes and legal bases

• Handling an inquiry and taking pre-contractual steps — to assess the described project, respond, and agree a possible next step; Article 6(1)(b) GDPR.
• Correspondence, documenting discussions, and protecting legal claims — our legitimate interests in conducting business communications, recording their course, and establishing, exercising, or defending claims; Article 6(1)(f) GDPR.
• Security and abuse prevention — our legitimate interests in protecting the form, infrastructure, and visitors, including request-rate controls; Article 6(1)(f) GDPR.
• Legal obligations — where applicable law requires us to retain particular information; Article 6(1)(c) GDPR.
• Optional analytics — only after separate consent; Article 6(1)(a) GDPR. Analytics is currently disabled, and storing a browser preference does not activate it.

Providing data is voluntary, but the name, email, service selection, and message are required to submit and handle the inquiry. The form is not used for a newsletter or marketing without a separate lawful basis.

4. Recipients and service providers

We may entrust data to providers required to operate the website and handle the inquiry: Vercel (hosting and application execution), Neon (database), and Resend (email notification). The notification is delivered to the business mailbox hello@evin.media. Authorised IT maintenance providers and public authorities may also receive data where required by law.

The providers operate under their service terms and data-processing arrangements. Selecting an EU infrastructure region does not mean that every operation or support record remains exclusively inside the European Economic Area.

5. Transfers outside the EEA

Vercel, Neon, and Resend operate internationally. Data may be processed or made available to subprocessors outside the EEA, particularly in the United States. Depending on the provider and operation, a transfer may rely on a European Commission adequacy decision, including the EU–US Data Privacy Framework, or on Standard Contractual Clauses with the required safeguards. The current basis for a particular transfer follows the applicable provider terms, agreements, and subprocessor lists.

6. Retention

As a rule, an inquiry is retained for 12 months after the last meaningful contact. Data may be kept longer if an engagement begins, law requires it, or it is needed to establish, exercise, or defend legal claims — for the period applicable to that purpose. Rate-control records relate to a 15-minute window. Copies in the notification service, business mailbox, and backups follow the relevant provider's retention cycle.

Automated deletion is not active. Expiry of the retention period is handled through a documented review and approved manual deletion across the systems in scope.

7. Your rights

To the extent provided by the GDPR, you may request access, correction, erasure, restriction, and portability of your data, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

Send a request to hello@evin.media. We may ask for information necessary to confirm identity without collecting excessive data for that purpose. You may also lodge a complaint with the Polish President of the Personal Data Protection Office or, where applicable, another competent supervisory authority.

8. Automated decisions

Contact-form data is not used to make decisions about you that produce legal or similarly significant effects solely by automated means, and it is not used for profiling within Article 22 GDPR.

9. Security and changes

We use data minimisation, access restrictions, form validation, encrypted connections, and separation of secrets from source code. No method removes all risk. A material change to the purposes, providers, retention, or analytics requires an updated notice with a new version.

Information about browser storage appears on the Cookie settings page.