Privacy policy

The controller responsible for processing personal data on this website under the EU General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection (FADP) is:

Company

Don Agency Spółka z o.o.

Address

Rynek Główny 28, 31-010 Kraków, Poland

Register

KRS 0001073665 (National Court Register, Poland)

Email

hello@don-agency.com

Further company details are listed in the imprint. DON offers its services to businesses only. This policy applies to everyone who uses this website, wherever they are.

Depending on how you use the site, we process:

• technical access data that every web server receives when you open a page (see Hosting);
• your privacy choice (the consent record), stored in a first-party cookie;
• what you enter in the contact form;
• if you apply for a role or join the talent pool: your application;
• only with your consent: analytics and advertising measurement data (Google Analytics, Google Ads, Meta) and the campaign information described under Contact form;
• only after you click to load it: the Calendly scheduler.

Fonts and images are served from our own server, so opening the site sends no request to Google Fonts or other font services. We do not sell personal data, and we do not use automated decision-making, including profiling, that has legal or similarly significant effects on you (Art. 22 GDPR).

When you send the contact form we process your name, email address, company (optional), the service you are interested in, your message (optional), the page you sent it from and the time. Purpose: to answer your enquiry and, if you wish, to prepare an offer. Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract) and Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries). Providing the data is voluntary, but without a name and an email address we cannot reply.

Where it is stored and sent: our server saves the enquiry in our database at our hosting provider (servers in the European Union, see Hosting) and forwards it to our inbox through the email delivery service Resend (Resend, Inc., USA) and/or, where we have connected one, to a customer-relationship or automation tool by webhook. Resend and that tool act as our processors under Art. 28 GDPR, as does our hosting provider. Resend is certified under the EU-U.S. Data Privacy Framework, including its UK Extension; for any other provider in a third country we use the EU Standard Contractual Clauses.

Spam protection: the form contains an invisible field and a timing check. To limit abuse, your IP address is held in the server’s memory for up to 10 minutes; it is neither stored with your enquiry nor passed on (Art. 6(1)(f) GDPR).

Campaign information, only with marketing consent: if you arrive through an ad or a campaign link, the page reads the campaign parameters in the address (for example utm_source, gclid or fbclid), the landing page and the referring website. They are stored in your browser’s session storage (deleted when you close the tab) and sent with the form only if you have switched on marketing in the cookie settings; otherwise they are discarded, also on our server (Art. 6(1)(a) GDPR, Art. 5(3) ePrivacy Directive). Only in that case do we also keep your browser’s user agent with the enquiry.

If you have also agreed to marketing cookies, your enquiry is reported to Meta as a conversion; see Analytics and marketing.

We do not use your enquiry to send you newsletters or other marketing emails. We reply to you personally.

When you apply for a role or send an open application to our talent pool, we process what you send us: your name and email address, and if you provide them your phone number, country of residence, a link to your profile or portfolio, your CV (PDF), your languages, your availability, your answers to the role’s questions and your message, together with the role and the time of the application. We use this information only to assess your application and, if we decide to work together, to prepare that. Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract). Providing the information is voluntary, but without your name, your email address and a CV or a profile link we cannot consider your application. Please do not send special categories of personal data, such as health information, or a photo; we do not need them.

Where it is stored and sent: our server saves your application, including your CV, in our database at our hosting provider (servers in the European Union, see Hosting) and forwards it, with your CV attached, to our recruiting inbox through Resend (Resend, Inc., USA) and/or, where we have connected one, to a recruiting or automation tool by webhook. Resend and that tool act as our processors under Art. 28 GDPR, as does our hosting provider; transfers to the USA rely on the EU-U.S. Data Privacy Framework or on the EU Standard Contractual Clauses. CVs are accepted as PDF files of up to 5 MB and are checked before they are stored or forwarded.

How long we keep it: if we do not hire you, we delete your application 6 months after telling you our decision.

Talent pool, only with your consent: if you tick the optional talent-pool box, we keep your application for 12 months after the recruitment ends, to contact you about other suitable roles (Art. 6(1)(a) GDPR). You can withdraw this consent at any time by emailing hello@don-agency.com; withdrawal does not affect processing that took place before it. When you withdraw, or when the 12 months end, we delete your application.

Spam protection: the application form contains an invisible field and a timing check. To limit abuse, your IP address is held in the server’s memory for up to 30 minutes and is not stored or passed on.

On your first visit we ask for your choice. Until you agree, only the strictly necessary consent cookie is set; no analytics or advertising tag is loaded and no campaign information is stored. Legal basis: storing information on your device without consent is allowed only where it is strictly necessary for the service you request (Art. 5(3) ePrivacy Directive, implemented in Poland by Art. 399 of the Electronic Communications Law (Prawo komunikacji elektronicznej), in Germany by Section 25 TDDDG, in Austria by Section 165(3) TKG 2021 and in the UK by Regulation 6 PECR). Everything else requires your consent (Art. 6(1)(a) GDPR). You can withdraw or change your consent at any time, with effect for the future, through “Cookie settings” at the foot of every page; cookies and stored data of withdrawn categories are deleted.

The consent record: the don_consent cookie stores the version of this policy, the time of your choice, the categories you allowed and whether your browser sent a Global Privacy Control signal. It is the proof of your choice (Art. 7(1) GDPR) and leaves your browser only as a cookie on requests to our own server. We ask again after 12 months, and whenever this policy changes in a way that affects your choice.

We do not use local storage or other tracking technologies, and no request goes to a third party before you consent or click.

These services are loaded only if their category is switched on in the cookie settings. We use Google Consent Mode v2: every Google signal is set to “denied” before a Google tag can load, and only the categories you allow are updated to “granted”. If your browser sends a Global Privacy Control signal, marketing stays switched off (see Your privacy choices). Legal basis: Art. 6(1)(a) GDPR and the consent rules named under Cookies.

Google Analytics 4 (analytics): Google Ireland Limited, Ireland. Records which pages are visited, how long, from which kind of device and roughly from which region, so we can improve the site. According to Google, Google Analytics 4 does not log or store IP addresses. Analytics data is kept for the retention period set in our Google Analytics property (at most 14 months) and then deleted automatically.

Google Ads conversion tracking (marketing): Google Ireland Limited. Measures whether a visit that started with one of our Google ads led to an enquiry.

Meta Pixel and Conversions API (marketing): Meta Platforms Ireland Limited, Ireland. The Pixel records page views and a “Lead” event in your browser. When you send the contact form, our server reports the same event directly to Meta (Conversions API), with your email address in hashed form (SHA-256), your IP address, your browser’s user agent and Meta’s click and browser identifiers, so Meta can match it to an ad click; a shared event ID prevents double counting. For this collection and transmission we are jointly responsible with Meta (Art. 26 GDPR); Meta’s controller addendum applies.

Google LLC and Meta Platforms, Inc. in the USA may receive data; both are certified under the EU-U.S. Data Privacy Framework. More information: Google privacy policy, Meta privacy policy.

You can book a call through Calendly (Calendly LLC, USA). The scheduler is not loaded when you open our pages: you first see a preview, and only when you click to load it does your browser connect to Calendly, which then sets its own cookies and processes the details you enter to book (such as name, email address and chosen time). Legal basis: Art. 6(1)(a) GDPR (your click) and Art. 6(1)(b) GDPR (arranging the call). Calendly LLC is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework. More information: Calendly privacy notice.

This website is hosted by Hostinger International Ltd., Cyprus, on servers in the European Union. When you open a page, the server automatically processes your IP address, the date and time, the page requested, the referring page and your browser and operating system. Purpose: to deliver the website securely and to detect attacks. Legal basis: Art. 6(1)(f) GDPR. Hostinger acts as our processor under Art. 28 GDPR on the basis of its data processing addendum. Server logs are kept only as long as these purposes require and are then deleted.

Hostinger also runs the database in which we store enquiries and applications (see Contact form and email, and Job applications). We read it only through a password-protected administration area. To protect that area against password guessing, failed sign-in attempts are counted per IP address in pseudonymised form (a hash made with a secret key) and deleted after two days at the latest (Art. 6(1)(f) GDPR).

We share personal data only with:

• our hosting provider (processor; see Hosting);
• the email delivery service Resend, Inc., USA, and, where connected, a customer-relationship, recruiting or automation tool (processors);
• Calendly LLC, USA, only after you load the scheduler;
• Google and Meta, only with your consent (see Analytics and marketing);
• professional advisers bound to confidentiality and public authorities, where the law requires it.

Some of the recipients above are in the USA. Transfers rely on the European Commission’s adequacy decision of 10 July 2023 for the EU-U.S. Data Privacy Framework (for certified companies: Google, Meta, Resend, Calendly) and, for data from the UK and Switzerland, on the UK Extension and the Swiss-U.S. Data Privacy Framework where the recipient takes part in them. Where a recipient is not certified, we use the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), with the UK Addendum or the Swiss amendments where needed. You can ask for a copy of these safeguards at hello@don-agency.com.

• Enquiries: as long as needed to handle them. If no contract follows, we delete them once the enquiry is closed and no follow-up questions are to be expected, unless statutory retention obligations (for example under commercial or tax law) require longer storage.
• Job applications: 6 months after we tell you our decision; in the talent pool, 12 months after the recruitment ends (only with your consent, which you can withdraw at any time).
• Backup copies: our database is backed up regularly so that it can be restored after a fault. Data we delete stays in these copies until they are overwritten, for 6 weeks at the latest, and we use them only to restore the database.
• Consent record (cookie): 12 months, then we ask again.
• Analytics and advertising data: according to the retention settings of the respective service (see above).
• IP address for spam protection: up to 10 minutes (contact form) or 30 minutes (application form), in memory only.
• Pseudonymised IP address after a failed sign-in to our administration area: two days at the latest.
• Campaign information in session storage (only with marketing consent): until you close the browser tab.

• Access to your data (Art. 15 GDPR)
• Rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR; see below)
• Withdrawal of consent at any time, with effect for the future (Art. 7(3) GDPR)
• A complaint to a supervisory authority (Art. 77 GDPR; see below)

To exercise your rights, write to hello@don-agency.com. We answer within one month (Art. 12(3) GDPR) and may first ask you to confirm your identity.

Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation (Art. 21(1) GDPR). We then stop, unless we demonstrate compelling legitimate grounds or the processing is needed to establish, exercise or defend legal claims. Where data is used for direct marketing, you can object at any time without giving reasons, and we stop (Art. 21(2) and (3) GDPR). Write to hello@don-agency.com.

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live, where you work or where the alleged infringement took place (Art. 77 GDPR). The supervisory authority where we are established is the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl).

If you are in the UK, the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR) apply. You have the rights described above and can complain to the Information Commissioner’s Office (ico.org.uk). Transfers from the UK to the USA rely on the UK Extension to the EU-U.S. Data Privacy Framework (the UK-US data bridge) or on the UK International Data Transfer Addendum. We apply the same cookie consent standard to visitors from the UK as in the EU.

If you are in Switzerland, the Federal Act on Data Protection (FADP) applies. You have the rights to information, rectification and erasure, objection and data portability (Art. 25 ff. FADP), and you can contact the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). Data may be disclosed to the USA (Swiss-U.S. Data Privacy Framework, recognised by the Federal Council as adequate since 15 September 2024) and to states of the EU and the EEA; for other states we use the Standard Contractual Clauses recognised by the FDPIC.

If you live in the USA, this section supplements this policy under the California Consumer Privacy Act as amended by the CPRA (CCPA) and the comprehensive privacy laws of other states, such as Virginia, Colorado, Connecticut, Texas and Oregon, to the extent they apply to us.

What we collect (in the last 12 months): identifiers (name, email address, IP address), professional information (company, the service you are interested in, your application and CV) and, only with your consent, internet activity on this site (analytics and advertising measurement). We collect it from you and from your browser, for the purposes described above, and keep it for the periods under How long we keep data. We do not intentionally collect sensitive personal information, and we do not use any data to infer characteristics about you.

Sale and sharing: we do not sell personal information for money. If you switch on marketing in the cookie settings, the advertising measurement by Google and Meta may count as “sharing” for cross-context behavioural advertising, or as “targeted advertising” under state laws. You can opt out at any time by switching marketing off in the cookie settings. We honour Global Privacy Control: if your browser sends it, marketing stays off, in your browser and on our server. We do not knowingly sell or share the personal information of anyone under 16.

Your rights, depending on your state: to know about and access the personal information we hold about you, to delete it, to correct it, to receive a portable copy, to opt out of sale, sharing, targeted advertising and profiling, and not to be discriminated against for using these rights. Send your request to hello@don-agency.com. We verify it by contacting you at the email address we have on file and answer within 45 days (extendable once by 45 days where the law allows). An authorised agent can make a request for you with your signed permission. If we decline your request, you can appeal by replying to our answer with the word “Appeal”; we decide within the period your state’s law sets, and if we deny the appeal you can contact your state’s Attorney General.

Do Not Track: there is no common standard for browsers’ Do Not Track signals, so the site does not respond to them separately. It loads no analytics or advertising tag without your consent in any case, and it honours Global Privacy Control as described above (California Business and Professions Code § 22575). We do not disclose personal information to third parties for their own direct marketing (California Civil Code § 1798.83).

This website and our services are aimed at businesses and are not directed to children. We do not knowingly collect personal data of children under 16 (in the USA: under 13, Children’s Online Privacy Protection Act, COPPA). If you believe a child has sent us personal data, write to hello@don-agency.com and we will delete it.

DON works for companies across the world. Wherever you are, we apply the GDPR standard described in this policy to your data. If the law of your country gives you further rights, write to hello@don-agency.com and we will honour them.

Questions about data protection: hello@don-agency.com. We update this policy when the website or the services we use change. The date in the contents shows the version in force; if a change affects what you agreed to, the cookie banner asks you again.