1. Data Controller
The data controller is Krakspire Sp. z o.o. (KRS: 0000953902, NIP: 6762611739, REGON: 521233880), with its registered office at Krupnicza 5/1, 31-123 Krakow, Poland. You can contact us at hello@krakspire.com or +48 12 314 90 09.
2. Data We Collect
We collect personal data that you provide directly through our contact form, email, phone, or in-person meetings. This may include your name, email address, phone number, nationality, passport or ID details, employment information, and other data necessary for immigration proceedings.
We also collect technical data automatically when you visit our website, including your IP address, browser type, pages visited, and cookies. See Section 7 for details on cookies.
3. How We Use Your Data
We use your personal data to respond to your inquiries, provide immigration consultancy services, prepare and submit applications to Polish authorities, communicate with you about your case, comply with legal obligations, and improve our website and services.
4. Legal Bases for Processing (Art. 6 GDPR)
We process your data based on one or more of the following legal grounds:
- Contract performance (Art. 6(1)(b)) — to provide our consultancy services under a service agreement
- Legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, and regulatory requirements
- Legitimate interest (Art. 6(1)(f)) — to respond to inquiries, improve our services, and maintain website security
- Consent (Art. 6(1)(a)) — for optional cookies and marketing communications, where applicable (you can withdraw consent at any time)
5. Data Sharing and Processors
We may share your personal data with Polish government authorities (voivodeship offices, Border Guard, Office for Foreigners) as required for your immigration applications.
We also work with the following service providers (data processors) who help us operate our business:
- Vercel — website hosting (USA)
- Cloudflare — DNS, CDN, and bot protection on our contact form via Cloudflare Turnstile (USA)
- Sanity — content management system used for our blog content; serves blog images from its CDN (USA / EU)
- Resend — email delivery for contact-form messages and notifications (USA / EU)
- CookieYes — cookie consent management (UK)
- Google — Google Maps on our contact page (loaded only with your consent), website analytics (Google Analytics via Google Tag Manager), and advertising/conversion tracking (Google Ads), each loaded only with the matching consent (USA)
- Umami — privacy-friendly, cookieless web analytics, self-hosted on Vercel (EU). Processes only aggregated, non-identifying usage data.
- Ahrefs Analytics — cookieless website analytics for SEO performance (EU)
These providers are contractually bound to protect your data in accordance with GDPR requirements. We do not sell your personal data to third parties.
6. Data Retention
We retain your personal data for as long as necessary to fulfill the purposes described in this policy. For completed service agreements, we retain records for the period required by Polish law (typically 5 years for tax and accounting purposes). Contact form submissions are retained for up to 12 months unless a service agreement is established. Cookie consent records are retained for the duration of the consent (up to 12 months).
7. Cookies
Our website uses cookies to ensure proper functionality and improve your experience. You can manage your cookie preferences through the cookie banner displayed when you first visit our site, or by clicking the cookie settings link in the footer.
7.1 Necessary Cookies
These cookies are essential for the website to function and cannot be switched off. They are usually only set in response to actions you take, such as setting your language preference or submitting the contact form.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| cookieyes-consent | CookieYes | Stores your cookie consent preferences | 1 year |
| NEXT_LOCALE | Krakspire (Next.js) | Remembers your selected language (EN/PL/DE/ES) | 1 year |
| __cf_bm | Cloudflare | Bot management; set by Cloudflare Turnstile when you load the contact form | 30 minutes |
| cf_clearance | Cloudflare | Confirms you have passed Cloudflare's bot protection challenge | 30 days |
7.2 Functional Cookies
These cookies enable features like embedded content. They are only set after you accept functional cookies.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| NID, CONSENT | Google Maps | Required for embedded map on contact page (loaded only with consent) | 6 months / 2 years |
7.3 Analytics Cookies
We use a combination of cookieless and cookie-based analytics. Cookie-based analytics (Google Analytics) are only placed after you give analytics consent. Cookieless analytics (Umami, Ahrefs Analytics) work without setting cookies and process only aggregated, non-identifying usage data.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| _ga, _ga_* | Google Analytics | Distinguishes unique visitors | 2 years |
| _gid | Google Analytics | Distinguishes users (short-term) | 24 hours |
| (none — cookieless) | Umami | Aggregated page-view counts and referrer reporting | n/a |
| (none — cookieless) | Ahrefs Analytics | SEO performance monitoring | n/a |
7.4 Advertising Cookies
We use Google Ads to measure the effectiveness of our advertising and to remarket to past visitors. These cookies are only placed after you give advertising consent.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| _gcl_au | Google Ads | Conversion linker — attributes conversions to ad clicks | 3 months |
| IDE, test_cookie | Google DoubleClick | Ad personalization and frequency capping | up to 13 months |
7.5 Google Maps
Our contact page includes an embedded Google Maps widget to show our office location. This widget is not loaded automatically. It only loads after you click “Load Google Maps” or accept functional cookies. When loaded, Google may place cookies and process your IP address according to Google's Privacy Policy.
8. International Data Transfers
Some data processors, including Google, Vercel, Cloudflare, Sanity, and Resend, may process data outside the EEA (primarily in the USA). Where this occurs, appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, the EU–US Data Privacy Framework.
9. Your Rights
Under the GDPR, you have the right to:
- Access your personal data (Art. 15)
- Rectify inaccurate data (Art. 16)
- Request erasure of your data (Art. 17)
- Restrict processing (Art. 18)
- Data portability (Art. 20)
- Object to processing (Art. 21)
- Withdraw consent at any time (Art. 7)
To exercise any of these rights, contact us at hello@krakspire.com.
10. Complaints
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Polish supervisory authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. Last updated: April 2026.
12. Contact
If you have questions about this Privacy Policy or our data practices, contact us at:
Krakspire Sp. z o.o.
KRS: 0000953902 | NIP: 6762611739 | REGON: 521233880
Krupnicza 5/1, 31-123 Krakow, Poland
Email: hello@krakspire.com
Phone: +48 12 314 90 09