Privacy Policy
Version dated 2026-08-24 for FormByForm.
This policy applies only to the global country gateway at formbyform.com. Country services reached from the gateway have their own privacy policies and make their own disclosures on their domains.
1. Controller and contact
The data controller and site operator is Mateusz Król, address: ul. Żurawinowa 7, 42-271 Częstochowa, Polska, Polish tax ID (NIP) 5732923161, REGON 387632869.
For privacy questions or requests, contact [email protected]. Communication is available in Polish and English.
2. What the gateway does
FormByForm is a static country gateway. It explains the relationship between the global brand and country services, shows which countries are available or planned, and lets a visitor make an explicit country choice.
The gateway does not provide a shared form catalogue, form editor, document preview, PDF or DOCX generation, user account, comment feature, contact form or automatic country redirect. It does not ask for or receive form values and it does not save form drafts.
3. Data processed when the page is requested
A web request necessarily carries technical connection data, including an IP address, to the hosting and network infrastructure so that the page can be delivered and protected. This processing is limited to delivery, reliability, diagnosis and security. Its legal basis is the Operator's legitimate interest in operating a secure and reliable website under GDPR Article 6(1)(f).
The application uses privacy-minimal operational logs. Production access logs omit IP addresses, query strings, referrers and user agents and are rotated by size. A technical error or security event may be recorded without the content of any form because the gateway has no form input. Logs are kept only for the operational and security period for which they are needed.
4. Cookies, browser storage and measurement
The gateway does not save a language or country choice, create an account or profile, or use advertising technology. It uses the following browser storage only when the separately configured analytics choice is available:
| Key | Medium and category | Purpose | Lifetime |
|---|---|---|---|
wnsk_privacy_consent | localStorage, necessary | remembers the visitor's privacy choice on the FormByForm origin | up to 180 days |
_ga | cookie, analytics after consent | distinguishes a consenting browser for Google Analytics | up to 180 days from creation, without renewal |
_ga_* | cookie, analytics after consent | stores session state for the separate FormByForm Analytics stream | up to 180 days from creation, without renewal |
Current runtime status: Google Analytics: active. When analytics is configured, the gateway displays its own privacy settings before any Google Analytics request is made. Choosing essential storage only does not load Google Analytics. Consent can be changed later through the Privacy settings control in the footer. Withdrawing analytics consent sends a denied consent update, removes accessible Google Analytics cookies and reloads the page.
The FormByForm stream uses host-only cookies. It does not configure cross-domain measurement or decorate the outbound Poland link with a Google linker parameter. Google Tag Manager, Google AdSense, Google Signals, advertising personalization and user-provided data are not used by the gateway.
If an edge protection feature is enabled, the network security provider may set a strictly necessary, short-lived cookie to complete an anti-abuse challenge or remember that the challenge succeeded. Such a cookie is not used by the FormByForm application for analytics or advertising. Its provider, key, purpose and lifetime must be verified and added to this policy before the feature is enabled.
5. Choosing a country and leaving the gateway
The visitor chooses a country manually. The gateway does not infer a country from an IP address, browser language or device location, and it does not redirect automatically.
An available country card is an outbound link. For example, choosing Poland opens wniosek-wzor.pl, which is a separate country service with its own privacy policy, terms, storage choices and processing activities. The link is configured not to send a referrer, but the destination and its infrastructure will receive the connection data needed to answer the new request. Review the destination's privacy policy before using its features.
Cards marked as planned are not links and do not send a request to a country service.
6. Recipients and international transfers
Technical connection data may be processed by the infrastructure providers needed to host, route and protect the gateway, and by public authorities where disclosure is required by law.
After analytics consent only, Google Ireland Limited receives the measurement described below for the separate FormByForm Google Analytics stream. Google may also process an IP address, device and browser information and the analytics cookie identifiers needed to provide the service. Google is not an analytics recipient before that consent and never receives form-field values because the gateway has no form input.
Google or an infrastructure provider may process data outside the European Economic Area. Where applicable, the Operator relies on an adequacy decision, an approved certification framework or Standard Contractual Clauses. Contact the Operator for current provider and safeguard information. Google's current privacy information is available at policies.google.com/privacy.
7. Analytics data and legal basis
After consent under GDPR Article 6(1)(a), the gateway sends a sanitized page view and aggregate Web Vitals. The page view contains the FormByForm origin, pathname without a query string or fragment, page title and a sanitized referrer. An external referrer is reduced to its origin. Web Vitals contain performance metric names, values, ratings and navigation type together with the same sanitized origin, pathname and page title; their referrer field is empty.
When a consenting visitor chooses an available country, the gateway also sends one hub_country_select event with only the destination market identifier and destination country code. It does not send the destination URL, a cross-domain linker, form data, contact details or an advertising identifier. Refusing analytics does not prevent the country link from working.
Google Analytics user and event data is configured for no more than 14 months. Analytics cookies expire after no more than 180 days and are not renewed by the application. The necessary consent record expires after no more than 180 days. The visitor may refuse or withdraw consent without losing access to the gateway or country links.
8. Retention
The FormByForm application does not store country selections in its own database and does not retain form data, drafts or accounts. After analytics consent, Google Analytics retains the limited country selection event described in section 7 under the stated analytics retention. Privacy-minimal operational logs are size-rotated and retained only as needed for reliability, security and incident investigation. Analytics and consent retention is described in sections 4 and 7. If an edge security cookie is enabled, its retention is limited to the provider lifetime disclosed under section 4. Data required for a legal obligation or claim may be retained for the applicable period.
9. Your rights
Depending on the circumstances, you may request access, a copy, correction, erasure or restriction of personal data, object to processing based on legitimate interest and lodge a complaint with a supervisory authority.
Send a request to [email protected]. We may request only the information needed to verify identity. The FormByForm application does not create its own account or application-level visitor identifier, and its application logs omit IP addresses. After analytics consent, Google Analytics creates the browser identifiers described in section 4. Outside that consented measurement, the Operator may be unable to link an anonymous page request to a particular person.
You may lodge a complaint with the President of the Polish Personal Data Protection Office, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, uodo.gov.pl, or with the competent authority in your EEA country.
10. Security and changes
The Operator uses transport encryption, restricted operational access, request filtering and privacy-minimal logging. No system is absolutely secure.
The current version is available at /privacy. A change to the gateway's purpose, storage, recipients or external services will be reflected here before or when the change takes effect. Questions can be sent to [email protected].