Privacy Policy

Last updated: March 28, 2026

1. Data Controller

The controller of your personal data is Wojciech Buła, operating as Blackgate Consulting, based in Wrocław, Poland. You can reach us at contact@blackgate.consulting.

2. What Data We Collect

We collect personal data that you voluntarily provide through our forms:

• Contact forms & booking: name, email address, phone number, company name, message content, and optionally attached files (pitch decks, one-pagers, etc.).
• Diagnostic surveys (Quick Scan & Full X-Ray): name, email, phone number, role, and your responses to diagnostic questions about your startup.

When you submit a form, we also log your IP address and browser user-agent string for security purposes (spam prevention and abuse detection). This data is stored alongside your submission and subject to the same retention period described in Section 7.

We do not use cookies, tracking pixels, analytics tools, or any third-party scripts that collect data about your browsing behavior. The Full X-Ray survey uses your browser's local storage (localStorage) to auto-save your draft — this data stays on your device and is never sent to us unless you explicitly submit the form.

3. How We Use Your Data

We use your data exclusively to:

• Respond to your inquiry or booking request.
• Review and provide feedback on your diagnostic submission.
• Send you a copy of your submission if you request it.

We do not use your data for marketing, profiling, automated decision-making, or any purpose other than the one you provided it for.

4. Legal Basis

We process your data based on Article 6(1)(b) GDPR — processing necessary to take steps at your request prior to entering into a contract (e.g., when you submit a diagnostic or book a call), and Article 6(1)(f) GDPR — our legitimate interest in responding to inquiries and providing consulting services.

5. Who Has Access to Your Data

Your data is accessed only by Wojciech Buła and the Blackgate Consulting team. We do not sell, rent, or share your personal data with third parties. Your form submissions are delivered via email to our internal mailbox hosted on the same server as this website.

6. Data Transfers

All data is processed and stored within the European Economic Area (EEA). Our website and server are hosted in the EU. We do not transfer your data outside the EEA. We do not load external resources (fonts, scripts, or analytics) from third-party servers.

7. How Long We Keep Your Data

We retain your data for as long as necessary to fulfill the purpose it was collected for — typically until we've completed our response to your inquiry or the consulting engagement has ended. In any case, we delete personal data no later than 12 months after our last interaction, unless a longer retention period is required by law.

8. Your Rights

Under GDPR, you have the right to:

• Access your personal data and request a copy of it.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict processing of your data.
• Object to processing based on legitimate interest.
• Data portability — receive your data in a structured, machine-readable format.
• Lodge a complaint with the Polish supervisory authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

To exercise any of these rights, email us at contact@blackgate.consulting. We will respond within 30 days.

9. Security

All data is transmitted over HTTPS (TLS encryption). Form submissions use CSRF protection to prevent unauthorized requests. We do not store passwords or payment information.

10. Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top reflects the most recent revision. Continued use of the website after changes constitutes acceptance of the updated policy.