Privacy Policy
Last updated: 15 August 2026. This version takes effect on the day this website goes live.
This policy explains what happens to personal data when you visit lab4-studio.com, book a call with us, or write to us. It is written to be read, not to be survived.
1. Who we are
The controller of your personal data is Andrii Murko, trading as Lab4 Studio (hereinafter “Lab4 Studio”, “we”, “us”), a sole proprietorship registered in Poland.
- Address: Stefana Okrzei 18/32, 03-710 Warszawa, Poland
- NIP: 1133134585
- REGON: 528667273
- Email: hello@lab4-studio.com
We are not required to appoint a Data Protection Officer, and we have not appointed one. Every privacy question goes to the address above and is answered by us directly.
2. What this policy covers
This website and the conversations that start through it. Work we deliver is governed by the contract signed for that work; where that contract says something different about the data you entrust to us during a project, the contract applies to that data.
The website is aimed at business visitors in the European Union, the United Kingdom and the United States. It is not directed at children, and we do not knowingly collect data from anyone under 16.
3. What we collect
Personal data reaches us in exactly four ways, and we hold none of it on this website.
When you use the contact form
The form on the home page asks for three things: your name, your work email, and a description of what you are trying to solve. It sends them to us as an email and stores nothing — there is no database of enquiries on this site, so the message lives only in our inbox, under the retention period below.
The form uses no CAPTCHA and no third-party anti-spam service. It protects itself with checks that involve no other company and set no cookies: a token tying the submission to this site, a field hidden from people, a check that the form was not submitted faster than a human could read it, and a limit on how many messages one connection may send in an hour. That last check keeps a one-way fingerprint of your IP address for one hour and never the address itself.
When you book a call
Booking runs on Calendly. To schedule a meeting you provide:
- your name;
- your email address;
- anything you choose to write in the field “Please share anything that will help prepare for our meeting”.
Calendly also records the time zone and the meeting time, and sends both of us a calendar invitation. The free-text field is optional and open — please put in it only what is useful for the meeting, and no more.
When you email us
We receive your email address, your name if you sign with it, and whatever the message contains, including attachments.
Automatically, when you browse
Our hosting produces standard server logs: IP address, browser and device type, the pages requested, and the time of the request. These are created for every website and exist so that the site can be operated and defended.
With your consent, we also use Google Analytics 4, loaded through Google Tag Manager, to count visits and see which pages are read. Without consent, no analytics cookies are set and no analytics data is collected. What each cookie does and how long it lives is listed in our Cookie Policy.
4. Why we use it, and on what legal basis
| What | Why | Legal basis (GDPR) |
|---|---|---|
| Booking details and the message you write | To prepare for and hold the meeting, and to answer you | Art. 6(1)(b) — steps taken at your request before a contract; Art. 6(1)(f) — our legitimate interest in answering enquiries |
| Name, email and message from the contact form | To read your enquiry and reply to it | Art. 6(1)(b) — steps taken at your request before a contract |
| A one-way fingerprint of your IP address, for one hour | To stop one connection flooding the form | Art. 6(1)(f) — our legitimate interest in a form that works |
| Emails you send us | To reply and to keep the thread of a conversation | Art. 6(1)(b) and Art. 6(1)(f) |
| Server logs | To run the site, diagnose faults, and defend against abuse | Art. 6(1)(f) — our legitimate interest in a working, secure site |
| Analytics | To understand which pages are useful and improve them | Art. 6(1)(a) — your consent, which you may withdraw at any time |
| Invoices and accounting records | Because Polish tax law requires us to keep them | Art. 6(1)(c) — a legal obligation |
We do not use your data to build profiles, we make no automated decisions about you, and we do not sell or rent personal data to anyone.
5. Cookies
Essential cookies keep the site working and your consent choice remembered. Analytics cookies are set only after you accept them in the consent banner. You can change or withdraw your choice at any time through the banner, and the full list of cookies is in the Cookie Policy.
6. Who else sees your data
We keep the list of processors short on purpose. Each of them acts on our instructions under a data processing agreement.
- Hostinger — hosting for this website and for our email. Our server is located in the United Kingdom and backups are held in Germany.
- Calendly LLC (United States) — meeting scheduling.
- Google — Google Analytics 4 and Google Tag Manager, only after consent. For visitors in the European Economic Area and the United Kingdom, the provider is Google Ireland Limited.
Beyond these, we disclose personal data only where the law requires it, or where it is necessary to establish or defend a legal claim.
7. Transfers outside the EEA
Our website and mail are hosted in the United Kingdom, which the European Commission recognises as providing an adequate level of protection for personal data; no additional safeguards are required for that transfer. Backups are held in Germany, inside the European Economic Area.
Calendly is based in the United States, and Google may process data on servers outside the European Economic Area. Those transfers rely on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission’s standard contractual clauses, together with the additional safeguards those clauses require.
8. How long we keep it
| Data | Kept for |
|---|---|
| Enquiries and email correspondence | 24 months from the last message |
| Booking records in Calendly | 12 months from the meeting |
| Analytics data | 14 months |
| Server logs | Up to 30 days |
| Contracts, invoices and accounting records | 5 years from the end of the calendar year in which the tax became due, as Polish law requires |
9. Your rights
Under the GDPR — and, for visitors in the United Kingdom, the UK GDPR — you may ask us to:
- tell you what data we hold about you, and give you a copy;
- correct it if it is wrong;
- delete it;
- restrict how we use it;
- hand it to you, or to someone else, in a portable format;
- stop processing based on our legitimate interest, by objecting to it.
Where we rely on your consent, you may withdraw it at any time; that does not affect anything done before you withdrew it.
Write to hello@lab4-studio.com and we will answer within one month. There is no charge, and we will not ask you to explain why.
If you think we have handled your data badly, you can complain to a supervisory authority. In Poland that is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa. In the United Kingdom it is the Information Commissioner’s Office. Elsewhere in the EEA it is the authority of the country you live in. We would rather you told us first.
10. If you are in the United States
We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not use it for targeted advertising. Where state privacy law gives you rights to know, delete, or correct your personal information, write to us at the address above and we will honour them without discriminating against you for asking.
11. Security
The site is served over HTTPS, access to our mail and hosting accounts is protected by strong, unique credentials and two-factor authentication, and the number of people who can reach your data is one. No system is beyond reach, and we will not claim otherwise — but if a breach ever put you at risk, we would tell you and the supervisory authority within the deadlines the law sets.
12. Changes to this policy
When this policy changes, the new version is published on this page and the date at the top is updated. If a change materially affects how we use data you have already given us, we will say so plainly rather than rely on you noticing.
13. Contact
Andrii Murko, trading as Lab4 Studio
Stefana Okrzei 18/32, 03-710 Warszawa, Poland
NIP 1133134585 · REGON 528667273
hello@lab4-studio.com