Privacy policy

Last updated: 11 September 2026. This notice covers turkowiakguitars.com and enquiries sent through this website. Individual offers, purchases and other Turkowiak services may carry additional information relevant to that service.

Who is responsible for your data?

Turkowiak Guitars Sp. z o.o., ul. Lipowa 2, 64-117 Gołanice, Poland, tax identification number (NIP) 6972316260, is the data controller. For privacy questions and requests, contact [email protected] or write to this address.

Enquiries and correspondence

We use the name, contact details, message, instrument preferences and any photographs you choose to submit to answer you and prepare an individual offer. Required fields are identified in the form; without them we may be unable to respond. Optional information is your choice. Photographs submitted with an archive enquiry are not automatically published in the Museum.

Requests for an offer and steps towards an order are processed under Article 6(1)(b) GDPR. Other correspondence and protection against misuse rely on our legitimate interests in responding to enquiries and operating a secure website, under Article 6(1)(f). Records required by law are processed under Article 6(1)(c).

Sending an enquiry does not subscribe you to marketing. Where you separately choose marketing contact or share additional visit context, we rely on your consent under Article 6(1)(a). You may withdraw it at any time without affecting the lawfulness of earlier processing.

Technical information and security

Hosting and security services process connection information, including IP address, requested pages, time, browser information and security events. The enquiry email includes basic technical information and the page from which you contacted us. Referring websites, campaign parameters and additional visit context accompany the enquiry only when you select that optional setting.

Cloudflare protects the website, and Cloudflare Turnstile helps distinguish genuine enquiries from automated abuse. Security processing is separate from optional analytics. See Cloudflare's privacy policy.

Optional analytics and external videos

Google Analytics is loaded only after you accept analytics. It measures visits, campaign sources and successful enquiries; form contents, contact details and uploaded photographs are not sent as analytics events. A successful enquiry has a randomly generated reference, which is included in the enquiry email and, with analytics acceptance, its analytics event. Advertising personalisation and Google signals are disabled in this website's analytics configuration. Rejecting analytics does not prevent you from browsing or contacting us.

If you separately select the optional visit-context setting in an enquiry, its email may include public page paths, referring website origins and campaign labels. Earlier campaign context is available only from the current browser session after analytics acceptance. Without that acceptance, the optional form setting shares only the current page context. Advertising click identifiers and complete URL query strings are not included in this campaign record.

Cookie settings lets you accept, reject or withdraw your choice. Read the cookies and storage notice for details. Google processes data under its privacy policy.

Separate, optional Google advertising measurement

A separate, unchecked choice in Cookie settings lets this browser tab remember a Google ad-click identifier from the current page. We do not capture or store these identifiers for advertising measurement before that choice. This does not enable Google advertising tags and does not change your analytics preference. The record expires after 30 minutes without recorded activity or at most 24 hours; expired records are discarded on the next access. Closing the tab normally clears this session storage. You can untick the choice in Cookie settings to clear it earlier.

A separate, unchecked choice in the enquiry form allows us to attach an available Google click identifier and the recorded consent to the private enquiry email. Without prior storage consent, this can use only an identifier still present on the current page at submission. It cannot recover an earlier, unconsented visit. Declining either choice does not prevent an enquiry or affect your offer.

If you choose this form option, we may later send Google the click identifier, a pseudonymous enquiry reference, the time and the fact that staff assessed it as a qualified sales enquiry. We do not send your message, photographs, name, email address or telephone number through this measurement process, and it does not authorise personalised advertising. Analytics acceptance, visit-context consent and marketing follow-up are separate choices and do not replace this consent. We rely on your consent under Article 6(1)(a) GDPR for this optional measurement.

Before an import, staff must confirm the qualification, current consent, applicable import window and absence of an earlier import. A form submission is not automatically qualified and is not a sale. The original enquiry and its consent record remain in our private correspondence records; the browser expiry does not delete the email. We stop using the identifier for new imports after our 90-day operational window. To withdraw consent for an already submitted enquiry, contact [email protected], preferably with its enquiry reference. Clearing browser storage does not withdraw an earlier submitted enquiry's consent. Withdrawal stops future imports; requests concerning an earlier import are handled separately.

Our own hosted videos do not load YouTube. An external YouTube player loads only when you choose to watch that performance and may then process device and connection information. Links to social networks take you to separate services with their own policies.

Who receives the information?

Authorised workshop staff and service providers supporting hosting, website security, email and IT receive information needed for their roles. Google receives analytics data only after analytics acceptance, and the limited advertising measurement data described above only under its separate consent. We do not publish your contact details in the Museum. An enquiry does not create a public account or place an online order.

Some providers may process information outside the European Economic Area. International transfers require applicable safeguards, such as an adequacy decision or standard contractual clauses. Contact us for information about the safeguards applicable to your data.

How long is it kept?

We retain correspondence for as long as needed to handle the enquiry, agreed follow-up and any resulting contractual relationship. Relevant records may be retained longer to meet legal obligations or establish, exercise or defend claims, within the applicable limitation periods. Security logs are retained for operational security needs. Optional consent preferences expire after 180 days; you can withdraw them earlier.

Your rights

Subject to the conditions in the GDPR, you may request access, correction, deletion, restriction or portability of your data, object to processing based on legitimate interests, and withdraw consent. We do not make solely automated decisions that produce legal or similarly significant effects on you.

You may complain to the President of the Polish Personal Data Protection Office (UODO) or your relevant supervisory authority. Contacting us first is not a condition of exercising this right.