Privacy Policy and Cookies

Last updated: 2026-09-21 Effective date: 2026-09-21

This policy explains what happens to personal data when you visit overrly.com - which cookies the site uses, what the contact form does with what you type into it, and which rights you have. It covers this website only. The Velapp mobile app has its own, separate policy, linked from the Velapp product page.

If anything here is unclear, write to kamil.kamyszek@overrly.com.

1. Who is responsible (Controller)

The controller of your personal data, as defined in art. 4(7) GDPR, is:

• Name: Kamil Kamyszek IT Solutions
• Trading as: Overrly
• Tax ID (NIP): 5080100981
• Place of business: Wrocław, Poland
• Contact for data protection matters: kamil.kamyszek@overrly.com

We give a postal address on request sent to that e-mail address.

We have not appointed a data protection officer. We do not carry out large-scale processing within the meaning of art. 37(1)(b) and (c) GDPR and we are not a public authority, so the obligation does not apply to us. We answer data protection requests within the time limit of art. 12(3) GDPR - without undue delay, and at the latest within one month.

2. What this site collects

The site is a static marketing site. There is no user account, no login, and no database behind it. Personal data reaches us in three situations only:

1. You send the contact form. You give us a name, an e-mail address, an optional company name, and the text of your message.
2. You accept analytics cookies. Google Analytics then records pseudonymous usage data about your visit (see section 5).
3. You book a meeting through Calendly. That happens on Calendly's own widget and under Calendly's own terms (see section 6).

Simply reading a page, with analytics refused, leaves us with nothing beyond the technical server logs described in section 4.

3. The contact form

What we do with it. The form does not write to any database. Our server turns your entries into one e-mail and sends it to our own mailbox, then forgets them. We use the address you gave us to reply.

Legal basis. Art. 6(1)(b) GDPR where your message concerns a possible contract or service, and otherwise art. 6(1)(f) GDPR - our legitimate interest in answering enquiries addressed to us.

How long we keep it. The resulting e-mail stays in our mailbox for as long as the matter is live, and normally no longer than 24 months after the last message in the thread. If the enquiry becomes an engagement, the correspondence is kept for as long as the contract and the retention periods in Polish tax and accounting law require (in practice 5 years from the end of the relevant tax year).

Who else sees it. The message passes through Resend (Resend, Inc., USA), our e-mail sending provider, and then rests in a mailbox hosted by Hostinger (EU). Both act as processors on our behalf.

No captcha tracking. The "are you human?" step before sending is a plain confirmation dialog rendered by this site. It is not Google reCAPTCHA and it sends nothing to a third party.

4. Hosting and server logs

The site is hosted by Vercel Inc. (USA), acting as a processor. Like any web server, Vercel's infrastructure records technical request data - IP address, time, requested URL, user agent - in operational logs that exist to keep the service running and to protect it from abuse. We do not use those logs to build any profile, and we do not join them to anything else. Legal basis: art. 6(1)(f) GDPR. They are retained only briefly (on the order of hours to a few days) by the hosting provider.

5. Cookies and analytics

Necessary cookies

This site sets no cookies of its own. It does not need one to remember your language: the language is part of the address (/en/... and /pl/...).

Your choice about analytics is stored in your browser's local storage under the key overrly.cookie-consent.v1. That is not a cookie, it is never sent to our server, and it exists so the site does not ask you the same question on every page. Keeping a record of your own choice is what art. 5(3) of the ePrivacy Directive calls strictly necessary, so it needs no separate consent.

Analytics cookies - only with your consent

If, and only if, you press Accept analytics in the banner, we load Google Analytics 4 (provider: Google Ireland Limited). Until then no request is made to Google at all and no analytics cookie is written. We use it to see which pages get read and which do not, so we know what to write next. We have not enabled Google Signals, advertising features, or ad personalisation, and we do not sell anything to anyone.

Legal basis. Your consent - art. 6(1)(a) GDPR, and art. 5(3) of the ePrivacy Directive as implemented in Poland by the Electronic Communications Law (Prawo komunikacji elektronicznej).

Transfer outside the EEA. Google may process the data in the United States. The transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework and, in addition, on standard contractual clauses under art. 46 GDPR.

Withdrawing your consent

Use the Cookie settings link in the footer of any page. It brings the banner back, and choosing Reject stops the analytics from using storage and deletes the analytics cookies this site has already written. Withdrawal is as easy as consent and costs you nothing (art. 7(3) GDPR). You can also clear or block cookies in your browser settings at any time; the site works normally without them.

6. Calendly (booking a meeting)

The Book a Meeting button opens a scheduling widget from Calendly LLC (USA). The widget's code and its cookies load only after you click that button - not while you are reading the page. From that point on, what you enter into the booking form (your name, e-mail and chosen slot) is processed by Calendly as well as by us, under Calendly's own privacy policy, so that we can both see the appointment. Legal basis for the booking itself: art. 6(1)(b) GDPR, at your request. If you would rather not use Calendly, write to us by e-mail instead.

7. Links out

The site links to third-party pages - LinkedIn, the App Store, Google Play, and sources quoted in articles. Following such a link takes you out of our site, and the page you land on is governed by that provider's own privacy policy, not this one.

8. Your rights

Under the GDPR you have the right to:

• access your data and get a copy of it (art. 15),
• rectify inaccurate or incomplete data (art. 16),
• erasure - "the right to be forgotten" (art. 17),
• restrict processing (art. 18),
• data portability (art. 20),
• object to processing based on our legitimate interest (art. 21),
• withdraw consent at any time, without affecting the lawfulness of what was done before the withdrawal (art. 7(3)).

To exercise any of them, write to kamil.kamyszek@overrly.com. We answer without undue delay and within one month at the latest.

You also have the right to lodge a complaint with the supervisory authority. In Poland that is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

9. What we do not do

• We do not sell or rent personal data.
• We do not run advertising or remarketing pixels - there is no Meta pixel, no LinkedIn Insight Tag, no Google Ads tag on this site.
• We make no automated decisions and do no profiling within the meaning of art. 22 GDPR.
• We do not knowingly collect data from children. This is a business site aimed at companies.

10. Changes to this policy

If the site starts using a new tool that touches personal data, this page changes first and the date at the top moves with it. A change that affects what we do with cookies also resets the banner, so you are asked again rather than carried over on an old consent.