Privacy policy

Last updated: 15 October 2026. This notice covers turkowiakguitars.com and enquiries sent through this website. Individual offers, purchases and other Turkowiak services may carry additional information relevant to that service.

Who is responsible for your data?

Turkowiak Guitars Sp. z o.o., ul. Lipowa 2, 64-117 Gołanice, Poland, tax identification number (NIP) 6972316260, is the data controller. For privacy questions and requests, contact [email protected] or write to this address.

Enquiries and correspondence

We use the name, contact details, message, instrument preferences and any photographs you choose to submit to answer you and prepare an individual offer. Required fields are identified in the form; without them we may be unable to respond. Optional information is your choice. Photographs submitted with an archive enquiry are not automatically published in the Museum.

Requests for an offer and steps towards an order are processed under Article 6(1)(b) GDPR. Other correspondence and protection against misuse rely on our legitimate interests in responding to enquiries and operating a secure website, under Article 6(1)(f). Records required by law are processed under Article 6(1)(c).

Sending an enquiry does not subscribe you to marketing. Where you separately choose marketing contact or share additional visit context, we rely on your consent under Article 6(1)(a). You may withdraw it at any time without affecting the lawfulness of earlier processing.

Technical information and security

Hosting and security services process connection information, including IP address, requested pages, time, browser information and security events. The enquiry email includes basic technical information and the page from which you contacted us. Available referring websites, campaign parameters and additional visit context accompany the enquiry unless you have selected Necessary only in Cookie settings.

Cloudflare protects the website, and Cloudflare Turnstile helps distinguish genuine enquiries from automated abuse. Security processing is separate from optional analytics. See Cloudflare's privacy policy.

Optional analytics and external videos

Google Analytics is loaded after the combined cookie setting is accepted, either by clicking Accept or automatically 60 seconds after the first arrival when no earlier choice is saved. It measures visits, campaign sources and successful enquiries; form contents, contact details and uploaded photographs are not sent as analytics events. A successful enquiry has a randomly generated reference, which is included in the enquiry email and, with analytics acceptance, its analytics event. Advertising personalisation and Google signals are disabled in this website's analytics configuration. Rejecting analytics does not prevent you from browsing or contacting us.

Available campaign labels, public page paths, referring website origins and device context accompany your enquiry without a separate form checkbox. First-party campaign context is retained in this tab from arrival so that navigating to the contact page does not lose the original source. Choosing Necessary only clears this context. Contact details and form contents remain outside browser analytics.

Cookie settings lets you accept, reject or withdraw your choice. Read the cookies and storage notice for details. Google processes data under its privacy policy.

Separate, optional Google advertising measurement

The single Accept action in Cookie settings covers analytics, first-party campaign context and Google ad-click measurement with enquiries. With no saved choice, acceptance is recorded automatically after 60 seconds from the first arrival across reloads and page navigation. Automatic acceptance is recorded separately from a user click. Necessary only stops optional measurement.

The enquiry form uses the combined cookie preference to attach an available Google click identifier and its acceptance source to the private enquiry email. No second form choice is required. The ad-click session expires after 30 minutes without recorded activity or at most 24 hours. Declining optional measurement does not prevent an enquiry.

When the combined measurement setting is accepted, we may later send Google the click identifier, a pseudonymous enquiry reference, the time and the fact that staff assessed it as a qualified sales enquiry. We do not send your message, photographs, name, email address or telephone number through this measurement process, and it does not authorise personalised advertising. Marketing follow-up remains a separate optional choice. We rely on your consent under Article 6(1)(a) GDPR for this optional measurement.

Before an import, staff must confirm the qualification, current consent, applicable import window and absence of an earlier import. A form submission is not automatically qualified and is not a sale. The original enquiry and its consent record remain in our private correspondence records; the browser expiry does not delete the email. We stop using the identifier for new imports after our 90-day operational window. To withdraw consent for an already submitted enquiry, contact [email protected], preferably with its enquiry reference. Clearing browser storage does not withdraw an earlier submitted enquiry's consent. Withdrawal stops future imports; requests concerning an earlier import are handled separately.

Our own hosted videos do not load YouTube. An external YouTube player loads only when you choose to watch that performance and may then process device and connection information. Links to social networks take you to separate services with their own policies.

Meta advertising measurement

Meta measurement is enabled only after a new manual click on Accept under the Google and Meta notice. An earlier Google-only choice, automatic acceptance or Necessary only does not enable Meta. You can review the new notice through Cookie settings. Google timing and saved choices remain separate from this additional Meta permission.

The Meta pixel measures public page views, views of individual Available or Certified Pre-Owned instruments, and successfully accepted enquiry forms. An enquiry is recorded as a raw Contact, not a qualified lead or sale. This website does not send Purchase events. We send public product identifiers, event type, a random event reference and the notice version; we do not send form fields, message text or uploaded photographs. The Meta library also receives technical browser and connection information and the current page address. Automatic event detection and automatic configuration are disabled by this implementation.

Choosing Necessary only stops further Meta measurement and removes accessible first-party Meta cookies. Withdrawing does not retract data already transmitted. Meta processes information under its privacy policy; see its cookie information.

Who receives the information?

Authorised workshop staff and service providers supporting hosting, website security, email and IT receive information needed for their roles. Google receives analytics data only after analytics acceptance, and the limited advertising measurement data described above under the combined measurement preference. We do not publish your contact details in the Museum. An enquiry does not create a public account or place an online order.

Some providers may process information outside the European Economic Area. International transfers require applicable safeguards, such as an adequacy decision or standard contractual clauses. Contact us for information about the safeguards applicable to your data.

How long is it kept?

We retain correspondence for as long as needed to handle the enquiry, agreed follow-up and any resulting contractual relationship. Relevant records may be retained longer to meet legal obligations or establish, exercise or defend claims, within the applicable limitation periods. Security logs are retained for operational security needs. Optional consent preferences expire after 180 days; you can withdraw them earlier.

Your rights

Subject to the conditions in the GDPR, you may request access, correction, deletion, restriction or portability of your data, object to processing based on legitimate interests, and withdraw consent. We do not make solely automated decisions that produce legal or similarly significant effects on you.

You may complain to the President of the Polish Personal Data Protection Office (UODO) or your relevant supervisory authority. Contacting us first is not a condition of exercising this right.