Most privacy policies are written for lawyers. This one is written for you. It explains what we collect, why we collect it, how we protect it, and exactly how to control it. The legal points are all here. They are just easier to find.
Unnamed Project is a marketing agency. We are the data controller for personal data collected through our website, our client engagements, and our communications with you. That means we decide what data is collected and how it is used, and we are accountable to you and to EU privacy authorities for handling it correctly.
Unnamed Project
Wrocław, Poland
Email: [email protected]
For privacy-specific questions, including requests to access, correct, or delete your data, write to us at [email protected] with the subject "Privacy request." We respond within 30 days, usually faster.
We collect only what we need to do our work properly. Nothing speculative, nothing for resale. Here is exactly what we collect and the purpose behind each.
What we do not collect. We do not collect special categories of data (health, religion, ethnicity, political views, sexual orientation, biometrics) unless you explicitly provide it as part of a project, and we never collect data through deceptive means like hidden trackers or covert form fields.
Under GDPR and AVG, we need a clear legal basis for everything we do with your data. We rely on four:
When we are working with you as a client, we process your data to deliver our services. This includes communicating with you, building deliverables, and managing the engagement.
For things like responding to enquiries, sending business communications, and running website analytics, we rely on legitimate interest. We balance this against your rights and only proceed when our processing would not unreasonably affect you. You can object to this processing at any time.
For non-essential cookies, marketing emails, and any future use of your data beyond the original purpose, we ask for your consent. You can withdraw it at any time, easily and without consequence.
Some data we keep because tax law, accounting law, or other regulations require it. This applies mostly to invoices and contracts, which we are required to retain for several years.
Concretely, here is what your data does at Unnamed Project:
We use your contact details and enquiry information to reply to you and send proposals if there is a fit. We use project information to deliver our work, communicate with you during engagements, and produce reports or case studies (always with your prior approval before anything is published).
We use website analytics to understand which pages help visitors and which do not, and to improve the site over time. We use email engagement data to understand which content is useful and to send less of what is not. We never make automated decisions about you that produce legal effects, and we do not engage in profiling for advertising purposes.
We share data only when we have to, only with parties we trust, and only for the purposes explained here. We do not sell your data to anyone, ever.
To run the agency we rely on a small number of trusted third-party tools. Each one processes data on our behalf under a Data Processing Agreement. They include Google Workspace for email, calendar, and document storage, our website hosting provider, payment processing if applicable to your engagement, project management tools, and email service providers for marketing communications. We review these tools regularly and replace any that fail to meet our security standards.
If an EU authority issues a valid legal request for data, we comply, but only to the extent legally required. We notify affected users where the law allows us to do so.
If Unnamed Project ever merges, is acquired, or sells assets, your data may be transferred to the successor entity. We would notify you in advance and your rights under this policy would carry over.
Some of the tools we use are based in the United States or other countries outside the European Economic Area. When data leaves the EEA, we use legal safeguards approved by the European Commission. These include the EU-US Data Privacy Framework where applicable, Standard Contractual Clauses, and additional technical measures like encryption.
We never transfer data to countries with weak privacy protections without these safeguards in place. If you want details about a specific tool we use and the transfer mechanism it relies on, ask us at [email protected].
We keep data only as long as we need to. Specifically:
Under GDPR and AVG, you have specific rights about your personal data. We honour all of them. Exercising these rights is free, and we never penalise you for it.
Ask us what data we hold about you, and we will send you a copy.
If your data is wrong or incomplete, we will correct it.
Ask us to delete your data and we will, unless we are legally required to keep it.
Ask us to pause processing while we sort something out.
Ask for your data in a structured format you can take elsewhere.
Object to processing based on legitimate interest, including marketing.
Where we relied on consent, you can take it back at any time.
If we mishandle anything, you can file a complaint with your DPA.
To exercise any of these, email [email protected] with "Privacy request" in the subject line. We respond within 30 days, usually faster. We may ask for ID verification before fulfilling sensitive requests, to make sure we are sending data to the right person.
Privacy and security are different things, but you cannot have one without the other. Here is what we actually do, not just what we are required to claim.
Every form on our website uses HTTPS (TLS 1.2 or higher). Data we store, whether in Google Workspace, our website backend, or any project tool, is encrypted at rest by the platform itself.
Only people who genuinely need access to your data have it. Unnamed Project is a small team. Access is granted on a need-to-know basis and revoked immediately when someone leaves a project or the agency.
Every account that touches client data requires multi-factor authentication. No exceptions. This is the single highest-impact security control we apply, and it is enforced across the team.
We review our tools, access logs, and processes at least quarterly. If a vendor has a security incident, we assess whether to continue using them. If they cannot demonstrate adequate response, we replace them.
If a security incident affects your personal data, we follow the GDPR breach notification rules. We notify the relevant Data Protection Authority within 72 hours, and we notify affected individuals directly when the breach is likely to result in a high risk to their rights and freedoms. We do not hide breaches.
Honest disclosure. No security measure is perfect. What we promise is that we use industry-standard protections, that we have not had a known data breach, and that we will be transparent if one occurs. If something goes wrong, you will hear about it from us before you read about it elsewhere.
We use cookies sparingly and only for the purposes listed below. You can accept, reject, or manage cookies through the consent banner the first time you visit, and you can change your choice at any time.
Required for the website to function. These cannot be disabled. They include session management, security, and form submission. No tracking, no third parties.
We use a privacy-respecting analytics tool with IP anonymisation enabled. This tells us how people use the site without identifying anyone individually. You can opt out at any time.
If you arrived here from a paid campaign, a small marketing cookie may have been set to attribute the visit. We do not use cookies for cross-site tracking or behavioural advertising. You can reject these without affecting how the site works.
Our services are not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has submitted information to us, contact us at [email protected] and we will delete it immediately.
We update this policy when our practices change or when the law requires it. The "last updated" date at the top of this page tells you when. For material changes (anything that meaningfully affects your rights or the data we process), we notify clients and email subscribers directly. For minor changes, the updated date is enough.
Previous versions are available on request.
If you think we have mishandled your data, please tell us first at [email protected]. We take privacy seriously and almost always resolve issues directly. You also have the right to file a complaint with your local data protection authority without contacting us first.
EU residents may lodge a complaint with their national data protection authority. A list of authorities is available on the European Data Protection Board website.
Privacy questions, security questions, or anything that needed a more specific answer than this page provides. We respond to every email.
Email us directly