PRIVACY AND COOKIE POLICY
How ILUXA WEB handles data on this site: what we collect, why, who sees it, how long we keep it and what you can ask us to do. Written in plain language.
Service: https://iluxa-web.com
Version 2.0 · Last updated: 16 September 2026
In short
- ILUXA WEB is a one-person web studio in Poznań, Poland. Illia Yanukovich is responsible for your data (the "controller").
- We collect data in three situations: when you send the contact form, when your browser loads a page (technical data such as your IP address), and, only if you agree, for Google Analytics statistics.
- We do not sell data, show advertising or build profiles of visitors.
- The 3D configurators in the Lab run entirely in your browser. Images you load into them never reach our server.
- You can ask us to show, correct or delete your data at any time: [email protected].
1. Who we are
The controller of your personal data is Illia Yanukovich, running a sole proprietorship under the name ILUXA WEB. NIP: 7831940318, REGON: 543133663, VAT: PL7831940318. Address: ul. Półwiejska 47, Poznań, Poland.
Email: [email protected]. Phone: +48 730 643 208.
We have not appointed a data protection officer, because the law does not require one for a business of our size and kind. Write to the address above with any privacy question.
2. What data we collect and where it comes from
We only collect data from you or from your browser. We do not buy data, receive it from partners or take it from public sources.
2.1 Contact form
Name, email address, phone number, message, and, if you fill it in, company name. Name, email, phone and message are required: without them we cannot answer you. The form also contains a hidden field that only spam robots fill in; we do not read it.
2.2 Technical data when you visit
Every request your browser makes carries your IP address, browser and operating system type and version, preferred language, the page requested, the time, and the page you came from. Cloudflare (our network protection) and our own web server receive this data. The web server writes it to access logs.
When you send the contact form, our server keeps your IP address for 10 minutes to limit submissions to 5 per address in that time. This stops the form from being flooded.
2.3 Settings kept in your browser
Two small cookies remember your choices: what you chose in the cookie banner, and which language you picked in the language switcher. See section 4.
2.4 Statistics (only with your consent)
If you choose "Accept all" in the cookie banner, Google Analytics 4 collects: a random visitor identifier stored in a cookie, the pages you view and how long, your device and browser type, your approximate region worked out from your IP address, and the site you came from. We never send Google your name, email or anything you type into the form.
2.5 Lab configurators
The pool and apparel configurators work only inside your browser. The shapes, colours, prints and images you choose or load are not sent to us and are not stored anywhere but your own device.
3. Why we use the data and on what legal basis
| Purpose | Data | Legal basis (GDPR) | How long |
|---|---|---|---|
| Answering your enquiry, discussing and quoting a project | Contact form data | Art. 6(1)(b): steps taken at your request before entering into a contract | 5 years from our last contact with you |
| Keeping a record of enquiries, and establishing or defending legal claims | Contact form data | Art. 6(1)(f): our legitimate interest in documenting business correspondence | 5 years from our last contact with you |
| Delivering the site, keeping it secure, blocking attacks and spam | Technical data, server logs, the rate-limit record | Art. 6(1)(f): our legitimate interest in a stable and secure site | Logs: 14 days. Rate-limit record: 10 minutes |
| Remembering your cookie choice and language | Two preference cookies | Art. 6(1)(f): our legitimate interest in the site behaving the way you set it; storing them needs no consent because you asked for it | 12 months |
| Understanding how the site is used | Google Analytics data | Art. 6(1)(a): your consent, given in the cookie banner | Google keeps event data for 2 months; its cookies last up to 2 years |
| Handling your requests about your data | Your contact details and our correspondence | Art. 6(1)(c): our legal obligation to answer such requests | Until the request is closed, then as part of correspondence above |
Where we rely on a legitimate interest, we have weighed it against your rights and concluded that the processing is limited, expected and low-risk for you. You can object at any time (section 8).
4. Cookies and similar technologies
The site sets these cookies:
| Name | Set by | Purpose | Type | Lifetime |
|---|---|---|---|---|
| iluxa_cookie_consent | ILUXA WEB | Remembers your choice in the cookie banner so it is not shown again | Necessary | 12 months |
| lang | ILUXA WEB | Remembers the language you picked so the site opens in it next time | Necessary | 12 months |
| _ga, _ga_* | Google Analytics | Tells one visitor from another for statistics | Analytics: only after "Accept all" | Up to 2 years |
| Cloudflare security cookies (for example __cf_bm) | Cloudflare | Tells real visitors from automated attacks | Necessary | Up to 30 minutes |
We use no advertising or social-media cookies. Fonts and videos are served from our own server, so no third party learns that you watched them.
Your choice. The banner offers "Accept all" and "Essential only" with equal weight. Nothing is pre-selected. If you choose "Essential only", Google Analytics is not loaded at all.
Changing your mind. Click "Cookie settings" at the bottom of any page. This deletes the consent cookie and the Google Analytics cookies, and the banner appears again so you can choose afresh. You can also delete cookies in your browser settings at any time.
Google explains what it does with data from sites that use its services at policies.google.com/technologies/partner-sites.
5. Who we share data with
We do not sell personal data and do not pass it to advertisers. These companies process data on our behalf, under contracts that bind them to our instructions:
- Hosting provider in Germany: runs the server where the site, the contact-form database and the logs live.
- Cloudflare, Inc. (USA): sits in front of our server, filters attacks and speeds up delivery. It sees your IP address and requests. Cloudflare privacy policy.
- Brevo (Brevo SAS, France): sends us the email notification containing what you wrote in the contact form. Brevo privacy policy.
- Google Ireland Limited (Ireland): Google Analytics 4, only if you consented. Google privacy policy.
We disclose data to public authorities only when the law obliges us to.
6. Transfers outside the European Economic Area
Your data is stored in the EU: the server is in Germany and Brevo is in France. Two of our providers are US companies: Cloudflare and Google. They process data mainly in the EU, but can transfer it to the United States. Both are certified under the EU-US Data Privacy Framework, which the European Commission recognises as providing adequate protection, and both also sign the EU standard contractual clauses as a fallback. Write to us if you want a copy of these safeguards.
7. How long we keep data
The periods are in the table in section 3. In brief: contact-form data for 5 years after our last contact, server logs for 14 days, the rate-limit record for 10 minutes, preference cookies for 12 months, and Google Analytics event data for 2 months. When a period ends, we delete the data.
8. Your rights
Under the GDPR you can ask us to:
- Access the data we hold about you and receive a copy.
- Correct data that is wrong or incomplete.
- Delete your data.
- Restrict what we do with it while a question is settled.
- Receive the data you gave us in a machine-readable file (portability).
- Withdraw consent to analytics at any time. This does not affect what happened before you withdrew it.
Right to object. You can object at any time to processing that we base on a legitimate interest (section 3). We will then stop unless we have compelling grounds that outweigh your interests.
To use any of these rights, email [email protected] or write to the postal address in section 1. It is free. We answer within one month; for complex requests we can take up to two months more and will tell you if so. We may ask you to confirm your identity so that we do not hand your data to someone else.
9. Complaints
If you believe we handle your data unlawfully, you can complain to the Polish supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. You can also complain to the authority in the EU country where you live or work. We would appreciate the chance to resolve the issue first, but you do not have to contact us before complaining.
10. Automated decisions
We make no automated decisions about you and do not profile visitors. No artificial-intelligence system processes your data on this site.
11. Children
The site is addressed to businesses. We do not knowingly collect data from anyone under 16. If you believe a child has sent us data, write to us and we will delete it.
12. Security
The site is served only over HTTPS. Cloudflare filters attacks before they reach the server. Contact-form data is stored in a database on a server in the EU that only the controller can access. Email notifications go to a mailbox only the controller reads. No system is completely secure. If a breach were to put your rights at high risk, we would inform you and the supervisory authority as the law requires.
13. Changes to this policy
This is version 2.0. Version 1 was in force until 16 September 2026; this version restructured the document, added the language cookie, the "Cookie settings" link, Brevo and the retention periods. We date every version at the top of the page. If a change affects how we use your data, we announce it with a notice on the site for 30 days before it takes effect. We do not apply material changes retroactively to data collected under an earlier version.
14. Contact
Illia Yanukovich ILUXA WEB, ul. Półwiejska 47, Poznań, Poland · [email protected] · +48 730 643 208
