Privacy policy

1. Who is the controller of your data

The controller of your personal data is ROKMATES sp. z o.o., ul. Odolańska 38, 02-562 Warszawa, NIP 5252850924, KRS 0000882573, REGON 388154580.

For data protection matters write to contact@rokmates.com or use the postal address above. We have not appointed a Data Protection Officer - all matters are handled at that address.

2. What data we collect

We collect only the data we actually need.

Contact form: first name, email address, optionally a phone number, the message and the selected contact type (brand or creator). Providing the data is voluntary, but without it we cannot reply.

Analytics events: the page visited, language, device type, browser and operating system family, traffic source with UTM parameters, approximate location at country and city level, interface clicks, scroll depth and time spent on a section.

Technical data processed in transit: the visitor IP address is used to rate limit submissions from a single source (spam and abuse protection). We do NOT store it in the database with the event, nor in the data export.

3. Purposes and legal bases

We process data for the following purposes:

• Answering a form enquiry and contacting a prospective client - first name, phone, email, message - Art. 6(1)(b) and (f) GDPR.
• Protecting the form against spam (Cloudflare Turnstile, honeypot field, rate limiting) - IP address and verification signals - Art. 6(1)(f) GDPR.
• Security and operation of the site - technical data - Art. 6(1)(f) GDPR.
• Traffic statistics in our own analytics tool - session and visitor identifiers, usage data, approximate location - Art. 6(1)(a) GDPR (consent).
• Settlements and accounting obligations - data required for documents - Art. 6(1)(c) GDPR.
• Establishing, pursuing or defending claims - data from the categories above - Art. 6(1)(f) GDPR.

4. Who we share your data with

We do not sell your data. We use the following processors:

• Resend (Resend, Inc., USA) - delivery of form emails. The sender is the notif.rokmates.com subdomain. Brand enquiries go to business@rokmates.com, creator enquiries to tworca@rokmates.com.
• Cloudflare, Inc. (USA) - Turnstile, protecting the form against automated abuse (including IP address and interaction signals).
• Vercel Inc. (USA) - site hosting and content delivery.
• Supabase - the database holding analytics events and the accounts of people with access to the panel.
• Google Ireland Ltd. / Google LLC (USA) - sign-in to the internal admin panel with a company account (Google receives no visitor data in that process) and, AFTER YOU GIVE MARKETING CONSENT, advertising measurement: Google Tag Manager, Google Analytics 4 and Google Ads. Without that consent these tools set no cookies and do not link your visit to an advertising account.

5. What we do not do

We use no Meta Pixel, TikTok Pixel or LinkedIn Insight Tag. We embed no external video players and no fonts from third party servers - typefaces are served from our own domain, so no font provider receives your IP address.

Google Analytics and Google Ads run only after you give marketing consent. We pass them nothing you type into the form: no name, no email address, no phone number and no message body. Conversion measurement sends a technical submission number which on its own says nothing about you.

We run no remarketing and no profiling based on form data, and we make no decisions about you that produce legal effects solely by automated means (Art. 22 GDPR).

Analytics events never contain a name, surname, email address, phone number, message body or any form field content. We store only field NAMES (for example "email"), never their values. The rule is enforced server side by a closed allow list of properties.

6. Transfers outside the EEA

Some providers (Resend, Cloudflare, Vercel, Google) are established or run infrastructure in the United States, so using their services may involve transferring data outside the European Economic Area.

Transfers rely on the mechanisms provided by the GDPR - an adequacy decision of the European Commission (including under the EU-U.S. Data Privacy Framework), standard contractual clauses (SCC) or other appropriate safeguards applied by the provider. We will provide information about a specific provider on request.

PENDING LEGAL CONFIRMATION: the data processing region for Supabase and the transfer basis for that provider.

7. How long we keep data

Retention periods:

• Contact form correspondence - 12 months from the end of the correspondence.
• Data of people we ended up working with - the duration of the collaboration and the period required by law, including accounting rules (as a rule 5 years).
• Analytics events - 25 months from the event by default. The admin panel allows shortening that period and deleting older data; the minimum enforced in code is 1 month.
• Data processed on the basis of consent - until consent is withdrawn, and no longer than 3 years from the last activity.
• Data in Google tools (Analytics 4, Ads) - according to the retention period set in our accounts with that provider; we will give the current value on request. Withdrawing marketing consent stops further collection.

8. Cookies and consent

The site uses three kinds of cookies and browser storage.

Necessary: the `rokmates_consent` cookie remembers your consent decision so the banner does not reappear on every visit. The `rk_admin` panel session cookie applies only to signed-in staff and is never set for site visitors.

Analytics: session and visitor identifiers, stored ONLY after consent is given. Without consent we send no events at all.

Marketing: Google Analytics 4 and Google Ads cookies, stored ONLY after you give separate marketing consent. We then also keep the advertising click identifier, so that we know which campaign led to an enquiry. Without that consent the identifier is not stored and Google tools run in a cookieless mode or do not run at all.

You can change or withdraw consent at any time in the cookie settings in the site footer, and delete cookies in your browser.

9. Admin panel

We view site statistics in our own panel, available only to Rokmates staff. Sign-in uses a Google account on the company domain - the system has no passwords and no public registration.

Permissions are split across four roles, from read-only access to account management. Every request is checked server side against the current state of the account, so revoking access takes effect immediately.

The panel operates on the analytics events described in section 2. It holds no contact form data - that goes to an email inbox only.

10. Security

The site is served over an encrypted connection (HTTPS) only. We apply a Content Security Policy restricting resources to our own domain, headers preventing framing and content type sniffing, and the form is protected by Cloudflare Turnstile, a honeypot field and rate limiting.

Panel access is secured by a cryptographically signed token in a cookie inaccessible to scripts, valid for 7 days.

11. Your rights

You have the right to access your data and obtain a copy, to rectification, erasure, restriction of processing, data portability, to object to processing based on our legitimate interest, and to withdraw consent at any time - without affecting the lawfulness of processing before withdrawal.

To exercise these rights write to the address in section 1. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

12. Changes to this policy

We may update this policy. The current version is always available at rokmates.com/privacy-policy and the date of the last update is shown at the top of the document.