1. General information
The controller of your personal data is Fox Strategy sp. z o.o., with its registered office at ul. Marszałka Józefa Piłsudskiego 23, 50-044 Wrocław, Poland, tax identification number (NIP) 8971837880, business registration number (REGON) 366905453 and National Court Register number (KRS) 0000671014 (“we”, “us”). This policy covers foxstrategy.pl, including its English-language pages (the “Website”), and the data you provide to us through forms, email, our newsletter or recruitment processes, among other channels.
For personal data enquiries, email biuro@foxstrategy.pl.
We process personal data in accordance with the General Data Protection Regulation — Regulation (EU) 2016/679 (“GDPR”) — and other applicable legislation, in particular Polish laws on data protection and electronic communications.
The tools used vary between pages. The English landing page and this English privacy policy use CookieYes and Google Analytics 4, with analytics loaded only after you consent. The Polish-language part of the Website also uses the additional services described below, where applicable. Our consent settings are shared across the domain.
2. What data we collect
The types of data we process depend on how you use the Website.
- Contact forms and email: we may process your name, email address, telephone number, company name, website address and the information included in your message.
- Newsletter: your email address and, if provided, your name or other information needed to manage your subscription; information about consent, subscription status and message delivery; and, if we use these measurement features, whether you open an email or click a link in it.
- Recruitment: information in your CV, application documents and recruitment correspondence.
- Technical data and server logs: your IP address, connection date and time, the page visited, browser, device or operating system information, and other technical data needed to operate and secure the Website.
- Analytics data: if you consent to analytics, we may receive information about how you use the Website through Google Analytics 4.
- Advertising and conversion measurement data: if you consent to advertising cookies, we may process information about visits, traffic sources, actions taken and identifiers used by Google Ads and Meta Pixel to measure campaign performance and, where the relevant feature is used, create audiences.
- Privacy preferences: information about consent being given, refused or withdrawn for individual cookie categories.
- External content: if you activate a map, recording, player or other content provided by a third party, its provider may receive your IP address, browser and device information, and information about your interaction with that content.
Providing data is voluntary. However, some data may be necessary for us to reply to a message, prepare a proposal, perform a contract, conduct recruitment or send you the newsletter.
3. Purposes and legal bases
We process personal data for the following purposes:
- Responding to enquiries, preparing proposals and taking steps to enter into a contract: Article 6(1)(b) GDPR.
- Other correspondence, including contact with people representing clients, business partners or other organisations: our legitimate interest in communicating and conducting our business, under Article 6(1)(f) GDPR.
- Entering into and performing contracts: Article 6(1)(b) GDPR.
- Managing the newsletter: your consent, under Article 6(1)(a) GDPR. Sending commercial communications is also subject to the requirements of the Polish Electronic Communications Law.
- Website statistics using Google Analytics 4: your consent, under Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law.
- Measuring advertising campaigns, attributing conversions and remarketing using Google Ads and Meta Pixel: only with your consent, under Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law.
- Displaying optional external content and features, such as maps, videos or players: your consent, where activation involves access to information on your device or the processing of personal data by the provider.
- Managing cookie preferences and demonstrating consent or its withdrawal: compliance with legal obligations, under Article 6(1)(c) GDPR, and our legitimate interest in demonstrating compliance with the law, under Article 6(1)(f) GDPR.
- Website security, error and abuse detection, and analysis of technical logs: our legitimate interest, under Article 6(1)(f) GDPR.
- Recruitment: depending on the type of data and the proposed working relationship, Article 6(1)(b) or (c) GDPR; for information provided voluntarily beyond the required scope, your consent under Article 6(1)(a) GDPR. We process data for future recruitment only with separate consent.
- Accounting, tax and other legal obligations: Article 6(1)(c) GDPR.
- Establishing, exercising or defending legal claims: our legitimate interest, under Article 6(1)(f) GDPR.
Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent.
4. How long we keep data
We do not keep personal data for longer than needed for the purpose for which it was collected.
- Correspondence and enquiries: for as long as needed to handle the correspondence or begin working together, and subsequently for a period justified by the need to document communications or establish, exercise or defend legal claims, no longer than the applicable limitation periods require.
- Contract-related data: for the duration of the contract, followed by the period required by law or needed to protect against potential claims.
- Newsletter: until you withdraw consent or we discontinue the newsletter. We may retain evidence of consent and its withdrawal for longer where necessary to demonstrate compliance or defend legal claims.
- Recruitment: until the relevant recruitment process ends. If you separately consent to future recruitment, we retain your data for the period stated when collecting that consent, no longer than 12 months.
- Accounting and tax records: for the period required by applicable law.
- Server logs and security data: for as long as needed to ensure security and proper operation of the Website, generally no longer than 12 months, unless longer retention is necessary, for example because of a security incident or legal claim.
- Cookies, analytics and advertising data: for the lifetime of the relevant mechanism shown in the cookie settings panel, in accordance with the tool’s settings and your consent choices. Data stored in providers’ systems is retained according to the applicable retention settings and the provider’s rules.
5. Who receives your data
We do not sell personal data. We may share it with the providers described below where necessary to provide services, maintain security, perform measurement or conduct advertising in accordance with your consent choices. Depending on the service, a provider may act as a processor on our behalf, an independent controller or, where provided for by law, a joint controller.
We may use services from organisations that support our business, including:
- hosting and IT infrastructure providers;
- email, cloud service and collaboration tool providers, including Google Ireland Ltd.;
- Google Ireland Ltd. in connection with Google Analytics 4, Google Ads, Google Tag Manager, reCAPTCHA, Google Maps and YouTube content;
- Meta Platforms Ireland Ltd. in connection with Meta Pixel and campaign measurement;
- the provider of CookieYes, for managing consent and cookie preferences;
- Spotify AB, if you use embedded Spotify players;
- MailerLite Limited, based in Ireland, which provides the MailerLite newsletter system and processes subscriber data on our behalf;
- accounting and invoicing software providers;
- our accounting firm;
- our law firm and other professional advisers;
- IT, administrative and technical service providers.
Where an organisation processes data on our behalf, we entrust it only with the data needed for that purpose and under appropriate arrangements or a data processing agreement. Some recipients, such as professional advisers, may act as independent controllers within the scope required by law or the nature of their services.
We may also disclose data to public authorities, courts or other authorised bodies where required by law.
6. Transfers outside the EEA
Some providers we use — in particular Google, Meta, CookieYes, YouTube and Spotify — belong to international groups or use infrastructure outside the European Economic Area (EEA), particularly in the United States.
Where data is transferred outside the EEA, this takes place only where an appropriate legal basis under the GDPR exists, in particular:
- a European Commission adequacy decision, including for organisations participating in the EU–US Data Privacy Framework; or
- standard contractual clauses approved by the European Commission, or other safeguards provided for by the GDPR.
The scope and basis of a transfer depend on the provider, where the data is processed and the provider’s current participation in the relevant transfer mechanism. To request information about the safeguards used, email biuro@foxstrategy.pl.
8. Analytics, advertising and external services
Google Analytics 4, Google Ads and Google Tag Manager
We use Google Analytics 4, Google Ads and Google Tag Manager, provided to users in the EEA by Google Ireland Ltd. These tools may be used for statistics, campaign measurement, conversion attribution and managing measurement tags. The tools loaded depend on the page you visit.
On the Polish-language part of the Website, we use Advanced Google Consent Mode. Before consent is given, the relevant settings for analytics storage, advertising storage, ad personalisation and the use of user data for advertising are set to denied. In this state, Google should not write or read analytics or advertising cookies. Google tags may nevertheless send technical and aggregate signals without these cookie identifiers, known as cookieless pings. These can include device and browser information, the page address and the IP address used during transmission.
On the English landing page and this English privacy policy, Google Analytics 4 is loaded only after you consent to analytics, including where valid consent was previously saved on the domain. If you have not consented, or have refused analytics, these pages do not load GA4 or send its cookieless pings. We do not load the shared Google Tag Manager container, separate Google Ads tags or Meta Pixel on these English pages. Google signals and ad personalisation are disabled in their GA4 configuration.
After analytics consent, GA4 may use pseudonymous identifiers stored in cookies such as _ga and _ga_* to distinguish devices and visits. After advertising consent, Google Ads may use mechanisms such as _gcl_au or DoubleClick cookies to measure conversions and advertising activity on pages where those tools are used.
According to Google, an IP address may be used when data is collected, including to determine an approximate location, but it is not logged or stored by Google Analytics.
User-level and event-level data is kept according to our Google Analytics retention settings and, for a standard GA4 property, no longer than the maximum retention period offered by Google for that type of data. Retention settings do not apply in the same way to standard reports containing aggregated data.
We do not directly combine Google Analytics data with the contents of messages submitted through contact forms.
On the English landing page, the contact buttons open your email application with a suggested subject and message. Selecting a topic does not send an enquiry. Once you consent to analytics, we measure service selections, topic choices and clicks on or copying of our contact address. These custom events do not include the contents of your message or free-form text. A contact click does not confirm that an email was sent.
You can withdraw consent at any time in the Website’s cookie settings. Google also provides a browser add-on for opting out of Google Analytics.
Meta Pixel
After you consent to advertising cookies, we may activate Meta Pixel, provided by Meta Platforms Ireland Ltd., on pages where it is used. It helps measure campaigns in Meta services, attribute conversions and, where enabled, create audiences and personalise advertising. Meta Pixel may use cookies such as _fbp and _fbc. The script is blocked if advertising consent is refused.
reCAPTCHA
Forms may be protected by Google reCAPTCHA. This tool helps distinguish human activity from automated spam attempts and may analyse technical information about the device, browser and use of the page. We use it to protect forms and the Website. reCAPTCHA may use cookies or local storage, including mechanisms named _GRECAPTCHA, rc::a, rc::b, rc::c or rc::f.
Maps, videos and players
The Website may contain third-party content, particularly Google Maps, YouTube videos and Spotify players. Loading this content may establish a connection to the provider’s server and transmit technical data. Where activation requires consent, it is subject to your choices in CookieYes. Once you open the content, the provider may process data under its own privacy policy.
MailerLite
We use MailerLite to manage Sprytny Newsletter. For customers in the EEA, the provider is MailerLite Limited, based in Ireland. We may process email addresses, names, consent and subscription status, and, if we use MailerLite’s measurement features, information about delivery, email opens and link clicks. MailerLite processes subscriber data on our behalf.
You can unsubscribe at any time using the link in each newsletter email.
CookieYes
We use CookieYes to display the consent panel, remember your choices and manage optional mechanisms. Cookies used solely to remember your privacy preferences are necessary for this function. CookieYes itself connects to its provider’s services to load the panel and record consent choices; the consent controls described above do not mean that all technical communication with service providers stops.
9. Security
We apply technical and organisational measures appropriate to the nature of the personal data and the risks involved.
These include encrypted HTTPS connections, access controls, limiting access to people who need the data for their work, and appropriate measures to protect and restore data.
No method of transmission or storage can guarantee absolute security.
If you receive a message impersonating Fox Strategy with an unusual request for passwords, payment card details or other confidential information, contact us through another channel before taking action.
11. Your rights
Depending on the legal basis and circumstances of processing, you may have the right to:
- access your personal data and receive a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict processing;
- data portability, where processing is automated and based on consent or a contract;
- object to processing based on our legitimate interests;
- withdraw consent at any time where processing is based on it.
These rights are not absolute. In some circumstances, the law allows us to continue processing certain data, for example where necessary to comply with a legal obligation or establish, exercise or defend legal claims.
To exercise your rights, email biuro@foxstrategy.pl.
We will respond without undue delay, generally within one month of receiving your request. For complex requests, or where we receive a number of requests, the GDPR allows this period to be extended by a further two months. If an extension is needed, we will inform you and explain why within the first month.
If we have reasonable doubts about the identity of the person making a request, we may ask for additional information to confirm their identity.
Exercising your rights is generally free of charge. Where permitted by the GDPR, particularly for manifestly unfounded or excessive requests, we may charge a reasonable fee or refuse to act on the request.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland (Prezes UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland.
We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
12. Changes to this policy
We may update this policy if the tools we use, the way we process personal data or applicable legislation change.
The current version is published on this page. The date of the latest update appears at the beginning.
YOUR PERSONAL DATA
Questions or a request?
For access, correction, erasure or any other privacy enquiry, email biuro@foxstrategy.pl.
10. Social media and external websites
We maintain profiles on platforms including Facebook, Instagram and LinkedIn.
If you visit or interact with our profiles, the platform operator processes data under its own rules. Depending on the feature, we may act as an independent controller or, in some cases — such as certain statistics provided to page owners — jointly with the platform operator.
The Website may also link to external websites. If you follow such a link, the other website operator’s privacy rules apply. We are not responsible for how those independent controllers process data.