Skip to content

// legal

Privacy Policy

Last updated: 5 October 2026

Data controller: [Nombre legal registrado], trading as Null Marketing · [Calle y número, código postal, ciudad], Poland · NIP [NIP] · REGON [REGON] · abarreto@null418.com

1. Who we are and what this policy covers

This policy explains how we process the personal data of people who visit null418.com, write to us, book a call, subscribe to the Null Brief newsletter or download our resources. We comply with Regulation (EU) 2016/679 (GDPR) and Polish data protection law.

Null Marketing is a B2B marketing agency. Data from the projects we carry out for our clients is governed by the contract and the data processing agreement signed with each client, not by this policy.

2. Data controller

  • Legal name: [Nombre legal registrado] (trading name: Null Marketing)
  • Address: [Calle y número, código postal, ciudad], Poland
  • Registry: [CEIDG o KRS] · NIP: [NIP] · REGON: [REGON]
  • Email: abarreto@null418.com

We are not required to appoint a data protection officer. For any privacy matter, write to us at the email address above.

3. What data we process

3.1 Data you give us

  • Contact and resource forms: name, work email, company, job title, company size, phone number (if you provide it) and the content of your message.
  • Newsletter: your email address, language and the record of your consent (which text you accepted, on which page and when).
  • Call booking: the data you enter in the scheduling tool (name, email, company and answers to the booking form) and what you tell us during the call.
  • Email communication: the data you include in your messages.

3.2 Data generated while you browse

  • Always (necessary): IP address and technical connection data logged by the hosting provider, and technical signals the anti-spam system uses to tell people from bots. To limit abusive submissions, we store an encrypted fingerprint of the IP address and email for no more than 24 hours, never the IP address in plain text.
  • Only if you accept cookies: pages visited, time on each page, where the visit came from, device and browser type, and approximate location (Google Analytics); and your visit to our pages linked to your LinkedIn account, if you have one (LinkedIn Insight Tag).

We do not ask for sensitive data, and we ask you not to include it in your messages. The site is not directed at anyone under 18.

  • Answering your enquiry, preparing and holding the call and, where appropriate, sending you a proposal: pre-contractual steps taken at your request (Article 6(1)(b) GDPR).
  • Providing the services you have contracted and managing the client relationship: performance of a contract (Article 6(1)(b)).
  • Sending you the newsletter and delivering downloadable resources: your consent (Article 6(1)(a)), which you can withdraw at any time.
  • Measuring use of the site (Google Analytics) and measuring campaigns and showing ads on LinkedIn to people who visited the site: your consent through the cookie banner (Article 6(1)(a)).
  • Reasonable commercial follow-up on an enquiry you made, in the context of your company: legitimate interest (Article 6(1)(f)). You can object at any time.
  • Protecting the site against spam, abuse and attacks, and keeping it running: legitimate interest (Article 6(1)(f)).
  • Establishing, exercising or defending legal claims: legitimate interest (Article 6(1)(f)).
  • Complying with accounting and tax obligations: legal obligation (Article 6(1)(c)).

Providing your data is voluntary, but without the data marked as required on each form we cannot answer you or send you what you ask for. We do not make automated decisions that produce legal effects concerning you or similarly significantly affect you.

5. Who we share the data with

We do not sell personal data. We share it only with the providers we need to operate, each under a data processing agreement or, where they act as independent controllers, under their own policy:

  • Vercel Inc. (USA): site hosting and file storage.
  • Neon Inc. (USA): database that stores contacts and site content.
  • Cloudflare Inc. (USA): anti-spam verification for forms (Turnstile).
  • Sendinblue SAS – Brevo (France, EU): sending the newsletter and confirmation emails.
  • Resend Inc. (USA): sending internal notifications when someone writes to us.
  • Google Ireland Ltd. and Google LLC: Google Analytics (only with consent). Google Search Console only gives us aggregated search data and receives no visitor data from the site.
  • LinkedIn Ireland Unlimited Company: LinkedIn Insight Tag (only with consent). For this measurement we are joint controllers with LinkedIn under the terms of its joint controller agreement.
  • Scheduling tool provider: manages call bookings and calendar invitations.
  • Specialists on our team and collaborators: when they need the data to work on your project, bound by confidentiality and acting on our instructions.
  • Accountants, lawyers and authorities: when required by law or necessary to defend our rights.

6. Transfers outside the European Economic Area

Some providers are based in the United States or may access data from there. In those cases the transfer relies on the EU-U.S. Data Privacy Framework, where the provider is certified, or on the European Commission's standard contractual clauses. You can ask us for more information about these safeguards.

7. How long we keep it

  • Enquiries and business contacts: up to 3 years from our last contact, unless you become a client.
  • Clients: for the duration of the contract and afterwards for the limitation period for claims and the period required by accounting law (5 years from the end of the financial year).
  • Newsletter: until you unsubscribe. We then keep the record of your consent for as long as needed to prove it in the event of a claim.
  • Google Analytics: 14 months.
  • LinkedIn Insight Tag: in accordance with LinkedIn's policy (its cookies last up to 1 year).
  • Anti-spam records: no more than 24 hours.
  • Hosting technical logs: the limited period set by the provider.

8. Your rights

You can ask us for access to your data, rectification, erasure, restriction of processing and portability, and you can object to processing based on legitimate interest, including direct marketing. Where we process your data based on your consent, you can withdraw it whenever you like without affecting earlier processing: every newsletter includes an unsubscribe link, and the "Cookie settings" link at the bottom of every page lets you change your cookie choice.

Write to us at abarreto@null418.com. We reply within one month at the latest. If you believe we are processing your data incorrectly, you can lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or with the authority in your country of residence.

9. Security

We use HTTPS encryption across the whole site, restricted and password-protected access to the database and the admin panel, providers with recognised security certifications and signed download links that expire. No system is infallible: if a breach occurs that poses a risk to you, we will notify the authority and, where applicable, you.

10. Cookies

Details of the cookies and similar technologies we use are in the Cookie policy.

11. Changes to this policy

If we change this policy, we will publish the new version on this page with its date. If the change is significant and we have your email, we will let you know.