Roman & Masza | Legal Documents

Cookie Policy

Last updated: 24 August 2026

This Policy explains how RM Sp. z o.o. uses cookies and similar technologies on romanmasza.com.

1. Website operator and Data Controller

RM Sp. z o.o.
ul. Rakowicka 10B/4, 31-511 Kraków, Poland
NIP (Tax ID): 6751824957
Email: masza.pro123@gmail.com
Telephone: +48 883 042 151
Coordinator for data subject and deletion requests: Roman Protsenko

2. What cookies are

Cookies are small files or records stored on or read from a user’s device when visiting a website. They may be necessary for website operation, preference storage, security and usage analytics.

Similar technologies include local storage, pixels, tags and consent identifiers. In this Policy, “cookies” also refers to those technologies where appropriate.

3. Categories of cookies

3.1. Strictly necessary cookies

Used for basic operation, navigation, security, session management, preserving the user’s choice and preventing abuse. Consent is not required where they are genuinely necessary to provide a service requested by the user.

3.2. Functional cookies

May remember language, interface settings and other preferences. Where not strictly necessary, they are used only after consent.

3.3. Analytics cookies

Help us understand page views and interactions with links, buttons and forms. They are used only after prior consent.

3.4. Marketing cookies

If advertising or retargeting tools are added, their cookies will be used only after separate consent and reflected in the banner, consent settings and current Policy.

4. Tools and consent model

4.1. Google Analytics 4

Google Analytics 4 may be used to analyse website traffic and interactions. User-level and event-level data retention is set to no more than 14 months. Resetting the retention period upon a new event is disabled.

4.2. Google Tag Manager

Google Tag Manager is used to manage tags. It serves as a configuration container, while tools connected through it may set cookies or transmit data.

4.3. Basic Consent Mode

Under the configuration declared in this Policy, optional Google tags are blocked until the user makes a choice. Before analytics or marketing consent, the corresponding tags must not send data to Google. Consent signals are updated after the user selects their preferences.

5. Legal basis

Strictly necessary cookies are used for website operation and security. Functional, analytics and marketing cookies that are not strictly necessary are used only on the basis of the user’s freely given, specific, informed and unambiguous consent. Refusal does not prevent access to the core website content.

6. Indicative technology list

Provider / technology	Example name	Purpose	Maximum period
RM Sp. z o.o. / CMP	consent_preferences or equivalent	Store choices and evidence of consent	Up to 14 months or until changed/withdrawn
RM Sp. z o.o. / website	session / security cookies	Session, security and form protection	Session or a shorter technically necessary period
RM Sp. z o.o. / website	language / preferences	Language and interface preferences	Up to 14 months
Google Analytics 4	_ga	Distinguish browsers for usage statistics	Up to 14 months
Google Analytics 4	_ga_<container-id>	Session state and statistics for a data stream	Up to 14 months

The table is indicative. The current exact list of cookies, domains, providers, purposes and periods must be displayed in the consent settings and confirmed through an actual website scan. The list is updated before new optional technologies are activated.

7. Retention periods

cookies and identifiers controlled by RM Sp. z o.o.: no more than 14 months from placement unless deleted earlier by the user;
session cookies: until the session ends or the browser closes;
GA4 user and event data: 14 months;
GA4 reset of user-data retention upon new activity: disabled;
consent record: up to 14 months or longer only in the minimum scope needed to demonstrate compliance or defend legal claims.

After expiry, cookies are deleted, overwritten or no longer used to identify the user. Withdrawal applies to future processing and must block further operation of optional categories.

8. Consent management

the banner provides equally accessible “Accept all”, “Reject optional” and “Manage settings” actions;
optional categories are not pre-enabled;
the user can reopen the settings and change their choice at any time;
withdrawing consent is as easy as giving it;
the user may also delete or block cookies in browser settings.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

9. Providers and international transfers

Analytics and technical data may be transferred to relevant providers only to the extent necessary for the service and in accordance with the user’s choice. This may include Google when Google Analytics 4 and Google Tag Manager are used. Lawful safeguards apply to transfers outside the EEA.

10. Personal data and user rights

Some cookies and technical identifiers may constitute personal data. The Privacy Policy explains purposes, legal bases, rights and how to submit a request.

11. Changes to this Policy

This Policy is updated when the website, CMP, tags, providers or legislation change. The current version is published with an update date. The technical configuration must at all times match the published text.