Privacy Policy for Po Kolei
Effective date: May 1, 2026
1. Controller and scope
The controller or operator in connection with the Po Kolei website is Go Solutions LLC, a company registered in Wyoming, United States, with address 30 N Gould St Ste R, Sheridan, WY 82801, USA. General contact: office@go-solutions.org. Privacy, legal, rights and takedown contact: office@go-solutions.org.
The website operates at pokolei.com and uses WordPress, hosting and part of its infrastructure in the United States, the Porkbun domain registrar, email, security, cache, CDN, analytics, newsletter, anti-spam, social media, AI and automation providers. The website is primarily intended for Polish-speaking users, especially in Poland, but is accessible globally. This policy takes a cautious approach to data protection: it does not assume that GDPR applies to every processing activity, but where GDPR, UK GDPR, ePrivacy, Polish electronic communications law or other mandatory data protection rules apply, the operator will respect user rights to the required extent.
2. Categories of data
When the website is used, technical data and server logs may be processed, including IP address, user agent, device and browser data, date and time of request, requested URL, referrer, server response code, security identifiers, WAF logs, CDN, cache, backup and uptime monitoring logs. These data are needed for website operation, security, troubleshooting and abuse prevention.
The website may process data from cookies and similar technologies, including cookie identifiers, local storage, pixels, tags, device identifiers, event data, page views, session duration, referral source, approximate location, browser and device data, where analytics, marketing, social media, security or AI/automation tools are implemented.
If the user contacts the operator by email or form, contact details, email address, name or organisation, message content, attachments, communication metadata and information needed to handle the matter may be processed. Users should not send sensitive data, professional secrets, confidential documents or information that they do not want to disclose to external technology providers.
If a newsletter is launched, the website may process email address, subscription date and time, subscription IP address, consent status, form source, double opt-in log, sending history, opens, clicks, unsubscribe status and proof of consent or withdrawal. If comments are enabled, the website may process name or nickname, email address, comment content, IP address, user agent, website address provided by the user, Gravatar hash, anti-spam data, captcha data and moderation status.
3. Purposes
Data may be processed to operate the website, maintain infrastructure, ensure security, protect against spam and abuse, handle forms and correspondence, publish and moderate comments, send newsletters, manage consents, perform analytics, measure traffic, improve content quality, conduct marketing or remarketing only if implemented and lawfully supported, integrate social media, display embedded content, use AI and automation, pursue claims, defend against claims and comply with legal obligations.
The operator may also process data to handle reports concerning errors, corrections, copyright, personal rights, image rights, privacy, AI-generated content, violations of the Terms or technical abuse. In such cases, data of the reporting person, the affected person and the material concerned may be kept for the time needed to handle the report and protect claims.
4. Legal bases for EEA/UK users
Where GDPR or UK GDPR applies, processing may be based on the controller's legitimate interests in operating the website, security, abuse prevention, handling correspondence, defending and pursuing claims, analysing statistics where permitted by law and managing content. Newsletter, analytics cookies, marketing cookies, social pixels, session recording, remarketing and similar technologies may be based on the user's consent where consent is required.
Processing of contact data may be based on performing the user's request or taking steps at the user's request, and in some cases on the operator's legitimate interest. Processing may also be necessary to comply with legal obligations, where applicable, or to establish, pursue or defend legal claims.
5. Recipients and providers
Data may be disclosed to hosting providers, domain registrar, DNS, CDN, WAF, cache, backup, uptime monitoring, WordPress security tools, email providers, newsletter providers, analytics, SEO, social media, advertising, anti-spam, captcha, comment, AI and automation providers, as well as legal, accounting, technical advisers, auditors and public authorities where required by law.
The operator may use tools such as Google Analytics 4, Google Tag Manager, Google Search Console, Google AdSense, Matomo, Plausible Analytics, Cloudflare Web Analytics, Microsoft Clarity, Hotjar, Rank Math SEO, Meta Pixel, X Ads Pixel, Mailchimp, MailerLite, Brevo, Substack, Akismet, Antispam Bee, Google reCAPTCHA, hCaptcha, Cloudflare Turnstile, Gravatar, Cloudflare, Porkbun, AI providers and similar services. This is not a closed list and may change as the website develops.
6. Transfers to the US and other third countries
The website uses infrastructure and providers located in the United States, and data may be processed in the United States or other third countries. The level of data protection in the United States and other third countries may differ from the level of protection in the EEA or the UK. If GDPR or UK GDPR applies to a specific transfer, the operator should use an appropriate transfer mechanism, such as an adequacy decision, standard contractual clauses, supplementary safeguards or other lawful mechanism.
The user should be aware that clicking an external link or interacting with embedded content, share buttons, social media, newsletters or analytics tools may transmit data to an independent provider that processes data under its own rules.
7. AI tools and automated processing
User data may be processed using AI tools or automation only to the extent necessary for website operation, security, contact handling, comments, newsletters, analytics, moderation, spam protection and content management. AI may be used to classify messages, detect spam, moderate comments, detect abuse, analyse security, prepare draft responses, translate, organise reports and analyse aggregated or pseudonymised traffic, trend and content popularity data.
The operator does not intend to make decisions about users that produce legal effects or similarly significantly affect them solely by automated means. If such decisions are introduced in the future, the documents should be updated and users should receive required information and safeguards.
Data submitted in messages, comments or forms may be processed by email, hosting, anti-spam, security or AI tools where necessary to handle the matter. AI providers may act as processors, subprocessors or independent controllers depending on the service and its terms. The operator should limit personal data transferred to AI tools to what is necessary for the specific purpose and avoid entering sensitive data, confidential documents or unnecessary information.
8. AI in content and graphics production
AI may be used to generate or improve content and graphics, but the operator should avoid entering personal data, sensitive data, confidential documents or unnecessary information into AI tools. If the content of a report, comment, email or form is used in an AI tool to prepare a draft response, classification, translation or analysis, data may be transferred to an AI provider.
9. Newsletter and consents
The newsletter should be based on a separate user consent. Double opt-in is recommended, meaning confirmation of subscription by clicking a link in an email. The operator should log consent, including date, time, IP address, form, consent wording and confirmation status. The user may withdraw consent at any time through an unsubscribe link or by contacting the operator.
Editorial newsletters should be distinguished from commercial or marketing information. Promotional content, ads, behavioural segmentation, remarketing or marketing profiling should only be used where covered by consent and proper user information.
10. Retention
Technical and security logs are kept for a short period justified by security, diagnostics and abuse prevention, unless longer storage is needed to investigate an incident or protect claims. Correspondence and contact data are kept until the matter is completed and then for the limitation period of potential claims or the period required by law.
Newsletter data are kept until unsubscribe, consent withdrawal or termination of the newsletter, and consent logs may be kept longer as evidence of compliance. Comments are kept while the comment is published or until deletion, and moderation and anti-spam data for the period needed to protect the website. Analytics, cookie, marketing and social media data are kept according to the relevant tool settings and Cookie Policy. Infringement reports are kept for the handling period and claim-protection period.
11. EEA/UK user rights
Where GDPR or UK GDPR applies, the user may have the right of access, rectification, erasure, restriction of processing, objection, data portability, withdrawal of consent and complaint to a competent supervisory authority. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.
To exercise rights, contact office@go-solutions.org. The operator may request information necessary to verify identity and the scope of the request. Some rights may be limited where processing is necessary to establish, pursue or defend claims, comply with legal obligations, protect freedom of expression, serve editorial purposes or rely on other legal grounds.
12. Children and US state privacy laws
The website is not knowingly directed to children and is not designed as a service for persons below the age required by applicable law. If the operator learns that it processes a child's data without required consent or legal basis, it will take reasonable steps to delete or limit such data.
The operator does not sell personal data in the ordinary meaning of that term. If US state privacy laws, including laws similar to CCPA/CPRA, apply to particular processing activities, the operator will respect user rights to the required extent. This policy does not mean that CCPA/CPRA automatically applies to every activity of the website.
13. Changes
The operator may update this Privacy Policy because of changes in law, tools, providers, website functions, AI, analytics, newsletters, comments, ads or data processing models. Material changes should be indicated by updating the effective date or by another appropriate notice on the website.