Privacy policy

Data controller

The controller of personal data processed in connection with bartoszszymanski.pl is Bartosz Szymański, who works remotely. For any matter concerning personal data, write to kontakt@bartoszszymanski.pl.

What data we process

The site processes two groups of data:

• Visit data — when you enter the site, the server records: your IP address; an approximate location derived from it (country, region, city) and the name of your internet provider; the date and time of the visit; the referrer, i.e. the address of the page you came from (without its parameters), and UTM campaign parameters from the link (e.g. that the link came from an Instagram profile); the browser identifier (user agent) and the device type, system, browser and in-app browser derived from it; the page you landed on; the page language and your browser language.
• Contact form data — your name, email address, optional company name, project type, stage and message, if you choose to send them. You can also write directly to kontakt@bartoszszymanski.pl.

We do not collect special categories of data (e.g. health, beliefs or origin). The location is approximate — usually the country and the city of the internet provider, never an exact address.

Purposes and legal bases

• Visit statistics (how many people visit, where from and on which devices) and protecting the site against abuse — based on the controller’s legitimate interest (Art. 6(1)(f) GDPR): improving the site, measuring how published links perform and keeping the site secure.
• Replying to a message sent through the form or by email and, where relevant, preparing an offer — based on steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and the legitimate interest in handling correspondence (Art. 6(1)(f) GDPR).
• Protecting the form and the owner panel against spam and break-in attempts — based on legitimate interest (Art. 6(1)(f) GDPR).

How visit data is collected

Our server records the visit when your browser requests the page, using information browsers send with every request anyway. No cookies are set and nothing is stored in your browser for this purpose, and no external analytics tools are used. Repeat visits from the same IP address and browser within 30 minutes count as one. The approximate location is determined on our own server using a local IP database (DB-IP Lite) — your IP address is not sent to anyone for this.

We store the IP address in full, because it lets us tell visits apart and recognise abuse (e.g. automated traffic). The site has a built-in option to shorten IP addresses (removing the last part of an IPv4 address and the end of an IPv6 address); if it is switched on, this document will be updated.

If your browser sends a Global Privacy Control or Do Not Track signal, the visit is not recorded. Automated traffic (search engines, bots) is not recorded either.

How long we keep data

• Visit data — 12 months (365 days). Older entries are deleted automatically.
• Correspondence — while it lasts and then up to 2 years after the last message, unless we start working together; then for the duration of the work and any period required by law (e.g. tax law).
• Counters protecting the form and the panel against abuse — stored as hashes of IP addresses, for no longer than 24 hours.
• Technical server logs are kept by the hosting provider under its own rules (usually for a few weeks).

Who receives data

• The hosting provider whose servers run the site and store visit data — processes data on our behalf under a data processing agreement.
• IP geolocation runs locally from a DB-IP Lite database stored on our server. The database provider (db-ip.com) receives no data. IP Geolocation by DB-IP (CC BY 4.0).
• Form messages are delivered by email through Resend (Resend, Inc., USA). This means form data is transferred outside the European Economic Area, based on the safeguards in Chapter V GDPR, such as standard contractual clauses. If you prefer not to use the form, write directly to kontakt@bartoszszymanski.pl.

Visit data is not transferred outside the European Economic Area unless the hosting provider’s servers are located there — and then only under the safeguards in Chapter V GDPR.

Profiling and sale of data

We do not profile visitors, make automated decisions about them, combine visit data with other sources, show advertising, or sell or share data for marketing.

Your rights

You have the right to:

• access your data and receive a copy (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• portability of data you provided for an offer or contract (Art. 20 GDPR),
• object to processing based on legitimate interest, including visit statistics (Art. 21 GDPR).

To exercise your rights, write to kontakt@bartoszszymanski.pl. For visit data, include your IP address and the approximate time of the visit — without them we cannot tell which entries are yours. We will reply without undue delay, at the latest within one month.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl) or the supervisory authority in your country.

Voluntary provision

Providing data in the form is voluntary, but without an email address we cannot reply. Visit data is recorded automatically; you can prevent it by enabling Global Privacy Control or Do Not Track in your browser.

Cookies

Details on cookies and browser storage are in the cookie policy.

Changes to this document

If the way the site works changes, we will update this document and the date at its top.

This document is not legal advice; it is worth having it reviewed by a lawyer.