Privacy policy.

01 Data controller

The controller of the personal data collected by this site is:

I have not appointed a data protection officer. For anything concerning your personal data, write directly to me at the address above.

02 What data I collect

The site collects data in two situations.

When you submit the contact form — your name, email address and the message itself. Optionally also a phone number, company name, the type of service, an approximate budget and any files you attach.

When you simply browse the site — technical data recorded by the server and the analytics tools: a truncated IP address, browser and device type, the page you visited and where you arrived from.

03 Purposes and legal bases

• Replying to your inquiry and preparing a quote — based on steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• Phone and email contact about your inquiry — my legitimate interest, namely handling the request (Art. 6(1)(f) GDPR).
• Visit statistics — only with your consent (Art. 6(1)(a) GDPR).
• Invoicing and tax obligations, if we end up working together — a legal obligation (Art. 6(1)(c) GDPR).

Providing your data is voluntary, but without a name, an email address and the message itself I can't reply to your inquiry.

04 Contact form

A message sent through the form lands in my mailbox and is processed solely to answer it. I never use form data for commercial mailings and never pass it to anyone for marketing purposes.

The form contains a hidden field used to recognize bots. Filling it in only flags the message as suspicious — the content still reaches me and I review it personally.

05 Attachments

Files attached to the form go straight to secured cloud storage on Amazon Web Services, in a data center inside the European Union. Only I can access them, through links that expire after seven days.

Attachments are deleted automatically after ninety days. You can ask for earlier deletion at any time.

06 Who I entrust data to

I use providers who process data on my behalf, under data processing agreements:

• Amazon Web Services — site hosting, attachment storage and delivery of form messages. Data processed within the European Union.
• Google Ireland Limited — visit statistics, only with your consent.
• An accounting office — if we work together and an invoice is issued.

I never sell your data and never share it with anyone beyond the parties listed above, except where the law requires it.

07 How long I keep the data

• Form correspondence — up to three years from the last contact, i.e. the limitation period for claims.
• Attachments — ninety days.
• Accounting documents — five years from the end of the tax year, as required by law.
• Statistical data — up to fourteen months.

08 Your rights

With regard to your data, you have the right to:

• access the data and receive a copy
• correct inaccurate data
• have the data erased
• restrict processing
• data portability
• object to processing
• withdraw consent at any time
• lodge a complaint with the President of Poland's Personal Data Protection Office (UODO)

To exercise any of these rights, a message to kontakt@karol-leszczynski.pl is enough. I respond within thirty days at the latest, usually much sooner.

09 Cookies

The site stores one technical piece of information in your browser: the theme you picked, light or dark. When you come back, the page looks the way you left it. That information stays on your device and is never sent anywhere.

Statistical and marketing cookies are stored only if you consent to them in the window shown on your first visit. I remember your choice for one hundred and eighty days.

You can change your mind at any time: open the cookie settings. You can also delete all of the site's data in your browser settings.

10 Analytics

I count visits with Google Analytics running in consent mode. Until you agree to statistics, the tool stores no identifiers and sends only anonymous, cookieless signals. The IP address is truncated, and I never combine the data with anything that could identify you.

11 Security

The site runs exclusively over an encrypted connection. Form data travels through an encrypted channel, and server access is protected with keys and two-factor authentication. Backups run daily and are encrypted as well.

12 Changes to this policy

If I change the way data is processed, I will update this document and change the date at the top. The binding version is always the one published at this address.

Have a question this document doesn't answer? Write to kontakt@karol-leszczynski.pl — I usually reply the same day.