Effective from 28 October 2026.
This policy explains what personal data we process when you use mg-group.ltd, why, on what legal basis and for how long, and what rights you have. It follows Regulation (EU) 2016/679 (GDPR).
1. Controller
The controller of your personal data is MG Group, ul. Mostowa 15/19, 61-853 Poznań, Poland, NIP (tax ID) 777 115 86 36, REGON 380477839.
For any data protection matter, write to info@mg-group.ltd or by post to the address above. We have not appointed a data protection officer.
2. What data we process, why and on what basis
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| Message via the contact form or e-mail | name, e-mail address, message and any data you choose to share | replying, preparing an offer, further correspondence | Art. 6(1)(f) GDPR (our legitimate interest in communicating with people who contact us); where the message concerns a contract: Art. 6(1)(b) GDPR |
| Protecting the form against spam | IP address, browser and device information sent to Cloudflare Turnstile | telling humans from bots and preventing abuse | Art. 6(1)(f) GDPR (website security) |
| Every visit to the website | IP address, date and time, requested page, browser information recorded in server logs | keeping the website running and secure, detecting attacks and errors | Art. 6(1)(f) GDPR |
| Protecting the website and admin panel | IP address and details of failed login attempts, firewall events | blocking attacks and intrusion attempts | Art. 6(1)(f) GDPR |
| Visitor statistics | a hash derived from the IP address and browser data, pages visited, referrer, device type, browser and OS, approximate location (country, city) | measuring traffic and improving the website; statistics work without cookies and are stored only on our server | Art. 6(1)(f) GDPR |
| Scanning a QR code that leads to our website | IP address, browser and device information, referrer, date and time of the scan, approximate location derived from the IP address (country, region, city, postcode, approximate coordinates) | measuring how well our QR codes perform | Art. 6(1)(f) GDPR (analysing the effectiveness of our materials) |
| Remembering your language and cookie choice | language identifier, record of consent given or refused | running the website according to your settings and demonstrating that consent was collected | Art. 6(1)(f) GDPR; for the consent record: Art. 6(1)(c) in conjunction with Art. 7(1) GDPR |
| Customers of the WP QR Tracker plugin | e-mail address, domain, licence key, plan, dates, IP address and software versions during licence and update checks | licence management, delivering updates, preventing abuse | Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR |
| Establishing, exercising or defending legal claims | data from the categories above, as necessary | protecting our rights | Art. 6(1)(f) GDPR |
Providing data in the form is voluntary, but without your name, e-mail address and message we cannot reply. We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
3. How long we keep data
- Correspondence: for as long as needed to handle the matter, then until any related claims become time-barred. If a contract is concluded, accounting documents are kept for the period required by tax law.
- Web server logs: 14 days, then deleted automatically.
- Security data (failed logins, firewall events): as long as needed to protect the website, no longer than 12 months.
- Visitor and QR scan statistics: no longer than 24 months.
- WP QR Tracker customer data: for the duration of the licence, then until claims become time-barred and for the period required by tax law.
- Cookies: for the periods listed in section 6.
4. Who receives the data
We do not sell personal data. Data may be disclosed only to service providers that help us run the website and act on our behalf (processors), or to authorities entitled to it by law:
- webh.pl: provider of the VPS server that hosts the website (Poland);
- home.pl S.A.: provider of the e-mail service we use to send and receive messages (Poland);
- Cloudflare, Inc.: provider of Turnstile, which protects the form against spam;
- ip-api.com: geolocation service that receives the IP address when a QR code is scanned, to determine the approximate location.
5. Transfers outside the European Economic Area
Using Cloudflare Turnstile may involve transferring data to the United States. Cloudflare, Inc. participates in the EU-U.S. Data Privacy Framework, under which the European Commission has found an adequate level of protection (Art. 45 GDPR). All other data is stored on servers in the European Union.
6. Cookies
We only use cookies that are necessary for the website to work and to remember your settings. We do not use advertising or tracking cookies, and visitor statistics work without cookies.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
cookieyes-consent | mg-group.ltd | remembers your cookie choice | 12 months |
pll_language | mg-group.ltd | remembers the language version you selected | 12 months |
| Turnstile cookies | Cloudflare | verifying that a human is filling in the form; set only with the contact form | according to Cloudflare’s rules, usually until the end of the session |
You can change your cookie settings at any time with the consent settings icon in the bottom-left corner of the page. You can also delete or block cookies in your browser settings, although blocking necessary cookies may affect how the website works.
7. Your rights
Within the limits set by the GDPR, you have the right to:
- access your data and receive a copy;
- rectify your data;
- have your data erased;
- restrict processing;
- data portability, where we process data on the basis of a contract and by automated means;
- object to processing based on our legitimate interest (Art. 6(1)(f) GDPR), on grounds relating to your particular situation;
- lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, or with the supervisory authority in your country of residence.
To exercise your rights, write to info@mg-group.ltd. We will reply without undue delay and in any event within one month.
8. Security
The website is served only over encrypted HTTPS. We use a firewall, login attack protection, regular updates and backups, and access to data is limited to people who need it.
9. Links to other websites
The website links to other sites, including eightbit.studio, winehunter.studio and meshpulse.app. Their own privacy policies apply once you visit them.
10. Changes to this policy
We update this policy when the law or the way the website works changes. The current version is always available on this page, and the date at the top shows when it took effect.