Privacy policy
Last updated: 2026-10-05
This notice covers hotsy.pl (Hotsy — ceramic stove tiles and chimney surrounds). It describes only what this site actually does.
1. Controller
The controller is Hotsy.
Contact: hotsy.dziadkowiec@gmail.com, tel. +48 570 514 878.
The site does not publish a full legal company name, registered address or tax ID (NIP). We will update this document when those details appear on the site. We have not appointed a data protection officer.
2. What data we collect, and how
- Contact form — name, email address and message. The form does not submit this data to our server. It opens your email client addressed to hotsy.dziadkowiec@gmail.com. We receive the data only if you send the email.
- Product order — the same mailto flow, with the product name in the subject line.
- Phone and email published on the site — if you call or write, we process the data from that conversation or correspondence.
- Server logs (Cloudflare) — IP address, date and time, URL, browser. Created automatically when you open a page.
- PostHog — analytics. If a PostHog key is configured, the script loads when you use the site, with no consent banner. PostHog stores a cookie and localStorage (identifier, session) and may collect events (including clicks via autocapture), device and browser data, and the page URL. A pageview is recorded on each visit and each change of subpage. Analytics is not necessary for the site to work. Data goes through our subdomain hot.hotsy.pl (a Cloudflare Worker), which forwards it to PostHog together with your IP address.
Language (PL/EN) is chosen in the URL. We do not set a language cookie. There are no maps, newsletter, user accounts or embedded videos.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Replying to messages and handling product orders | GDPR Art. 6(1)(b) — steps prior to a contract when you ask about a product or want to order. GDPR Art. 6(1)(f) — legitimate interest: answering people who contact us. |
| Serving the site and security (Cloudflare logs) | GDPR Art. 6(1)(f) — legitimate interest: keeping the site available and secure. |
| Usage statistics (PostHog) | This is not necessary processing. The script runs when you use the site; we do not ask for consent first and there is no cookie banner. Analytics of this kind requires consent (GDPR Art. 6(1)(a) and Polish PKE Art. 399) — we describe the site as it is implemented. |
4. Recipients
- Cloudflare — hosting and CDN (Cloudflare Workers).
- PostHog — analytics (when a key is configured). Data is stored in the PostHog EU cloud (Frankfurt).
- Your own email provider — when the form opens a mail client.
We do not use Resend, Mapbox, Google Maps, Booking.com or advertising pixels.
5. Transfers outside the EEA
Cloudflare and PostHog may process data outside the European Economic Area. PostHog stores the data in the EU, but it is a US company and may access it from outside the EEA. Such transfers rely on an adequacy decision (including the EU-US Data Privacy Framework where the organisation is listed) or standard contractual clauses (GDPR Art. 46).
6. Retention
- Enquiry and order emails: for as long as needed to handle the matter, usually up to 12 months, longer if a complaint or claim is pending.
- Cloudflare server logs: usually up to 14 days.
- PostHog cookie: 365 days (renewed on a later visit). Data in PostHog — until deleted on request or according to the PostHog project retention.
7. Cookies and similar technologies
There is no consent banner. We are not installing a consent manager. Analytics cookies are not “necessary”.
| Name / storage | Purpose | Duration | Type |
|---|---|---|---|
PostHog cookie ph_…_posthog and localStorage | Analytics identifier and state (default: localStorage+cookie) | Cookie: 365 days | Optional (analytics), PostHog |
| Cloudflare cookies | Delivering the page, load balancing, security | Session or a short technical period | Necessary to serve the site |
We do not set a language cookie. The product 3D preview runs locally in the browser (Three.js) and does not load a third-party model analytics service.
8. Your rights
You have the right of access, rectification, erasure, restriction, portability and to object to processing based on GDPR Art. 6(1)(f). If processing were based on consent, you may withdraw it at any time without affecting earlier processing. Email hotsy.dziadkowiec@gmail.com is enough.
9. Complaint to UODO
You may lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, https://uodo.gov.pl. Complaint form: https://uodo.gov.pl/pl/501/2271.
10. Whether providing data is required
Name, email and message are needed to send an enquiry. IP address and technical data are collected automatically if you load the page. PostHog identifiers are created automatically when the analytics script loads. You do not have to use the form to browse the catalogue.
11. Automated decision-making
We do not take automated decisions, including profiling within the meaning of GDPR Art. 22. PostHog analytics does not produce legal or similarly significant effects.
12. Changes to this notice
If processing changes (a new script, form or vendor), we will update this text and the date at the top of the page.