Privacy policy
Updated:
Who processes your data, why, for how long and what rights you have. Written in plain language.
1. Controller
The controller of your personal data is Maciej Dębowski (“I”, “the Controller”). For anything related to personal data, write to maciejdebowskisoftware@gmail.com.
I have not appointed a data protection officer, as I am not required to.
2. What data I process
| Source | Data |
|---|---|
| Contact form | full name, e-mail address, company name (optional), topic and message |
| E-mail correspondence | your e-mail address and anything you choose to include |
| Server logs | IP address truncated by its last segment, date and time of the request, requested page, browser type (user agent) |
| Analytics (only with consent) | pseudonymous browser identifier, approximate location (country, city), pages visited, visit duration |
| Booking calendar (only with consent) | the details you enter in the third-party calendar: name, e-mail, chosen time slot |
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Replying to your form message and further correspondence | Art. 6(1)(a) (your consent); where the message concerns entering into a contract, also Art. 6(1)(b) (pre-contractual steps) |
| Scheduling and holding a meeting | Art. 6(1)(b), and Art. 6(1)(a) for the embedded calendar |
| Security and proper operation of the site (server logs) | Art. 6(1)(f) (my legitimate interest in preventing abuse and attacks) |
| Visit statistics (Google Analytics 4) | Art. 6(1)(a) and Art. 399(1) of the Polish Electronic Communications Law (consent to cookies) |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) (my legitimate interest) |
4. How long I keep data
- Messages and correspondence: for the duration of the correspondence and then up to 12 months after the last message, unless you withdraw consent earlier. If the correspondence leads to a contract, for the duration of the contract and the limitation period for claims.
- Server logs: up to 30 days, then deleted automatically.
- Analytics data: up to 2 months (the retention setting in Google Analytics).
- Cookie consent: your choice is stored in your browser for 12 months, after which I will ask again.
5. Who receives data
I do not sell data or share it for marketing. Data may only reach parties that help me run the site and correspondence, under data processing agreements or as separate controllers:
- the server (VPS) provider hosting the site and the contact form handler;
- Google Ireland Ltd., the e-mail provider (Gmail) where messages arrive;
- Google Ireland Ltd., the provider of Google Analytics 4, only after you consent to analytics cookies;
- the booking calendar provider (Calendly LLC or Cal.com, Inc.), only if you load the calendar yourself;
- public authorities where required by law.
6. Transfers outside the EEA
Google and the calendar providers may process data in the United States. Such transfers rely on the European Commission’s adequacy decision (EU-US Data Privacy Framework) for certified companies and, otherwise, on standard contractual clauses approved by the European Commission. You can request a copy of the safeguards at maciejdebowskisoftware@gmail.com.
7. Your rights
You have the right to:
- access your data and receive a copy (Art. 15 GDPR);
- rectification (Art. 16);
- erasure (Art. 17);
- restriction of processing (Art. 18);
- data portability (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)). Withdraw cookie consent with the “Cookie settings” button in the footer, and correspondence consent with a single e-mail;
- lodge a complaint with the Polish data protection authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or the authority in your country of residence.
To exercise your rights, write to maciejdebowskisoftware@gmail.com. I will reply without undue delay and within one month at the latest.
8. Voluntary provision
Providing data in the form is voluntary, but without your name, e-mail address and message I cannot reply.
9. Profiling
I do not make decisions about you based solely on automated processing, including profiling.
10. Cookies
Details on cookies and similar technologies are in a separate cookie policy.
11. Security
The site runs over encrypted HTTPS only, loads no tracking scripts without your consent, and the form sends data to my own server only. I am the only person with access to the data.
12. Changes
If the way I process data changes, I will update this document and the date at the top. If a change affects consent, I will ask for it again.