Privacy

Last updated: 10 November 2026.

Who is responsible for your data

The data controller is Tomasz Szuster, Krajkowo 45, 62-050 Krajkowo, Poland, who runs Maroc Collective. For questions about your personal data, email partners@maroccollective.com or write to the postal address above.

What we collect and why

The contact form sends us your first name, email address, chosen subject, message and language, together with your company name and any other details you choose to include. We use this information to handle your enquiry and continue the conversation. Sending a message does not add you to a marketing list.

We rely on our legitimate interest in answering enquiries and maintaining contact (Article 6(1)(f) GDPR). If you ask us to take steps before entering into a contract with you, we rely on Article 6(1)(b). We may retain information needed to establish, exercise or defend legal claims on the basis of Article 6(1)(f).

Providing your details is voluntary. The form needs a first name, email address, subject and message so that we can process your enquiry; company and phone details are optional. You can also email us directly. Please do not send health information, identity documents or other particularly sensitive information.

Security and technical information

Our servers process connection information, including IP addresses, timestamps and request details, to deliver the website, identify errors and prevent abuse. Our legal basis is our legitimate interest in keeping the service secure (Article 6(1)(f) GDPR). The form’s abuse protection stores a hashed IP address and the time of each attempt. The limit covers the preceding hour; expired entries are removed on the next attempt and may remain longer if there is no traffic. Your message goes to our mailbox, not to the rate-limit database.

The website does not use marketing analytics or marketing cookies. We do not use profiling or make decisions about you with legal effects based solely on automated processing.

Service providers and international transfers

The controller and technical service providers use data as needed to provide the service. We use AWS CloudFront to deliver the website and Amazon SES in Frankfurt to send email. Global services may involve processing outside the EEA. The AWS data processing terms include standard contractual clauses for relevant transfers. Contact us for details or a copy of the safeguards.

How long we keep information

We keep correspondence for as long as needed to handle your enquiry and any related follow-up. After that, we retain only information needed to meet legal obligations or deal with legal claims, until the relevant time limits expire or a dispute is resolved. The period depends on the nature of the matter and the obligations it creates. We keep technical information for as long as needed to investigate faults and protect the service, then delete or anonymise it. Backups are overwritten as part of the backup cycle.

Your rights

You can request access to, correction or deletion of your personal data, or ask us to restrict its use. You also have a right to data portability where the GDPR conditions apply. You can object to processing based on legitimate interests on grounds relating to your particular situation. The rights available depend on the legal basis and circumstances.

You can complain to the President of the Polish Personal Data Protection Office (uodo.gov.pl) or the relevant supervisory authority in your country. See the GDPR for the applicable rights and obligations.