Privacy policy

The controller of your personal data — the person who decides what happens to it — is:

• Paweł Zaic Digital Solutions
• ul. Przykładowa 1, 50-000 Wrocław, Poland
• NIP 000-000-00-00

There is no data protection officer and no team. This is a one-person business, so anything you write about your data comes to me and is answered by me.

Two things only: what you choose to type into the contact form, and the minimum the server needs so the form cannot be abused.

From the form:

• your name
• your email address, if you give one
• your phone number, if you give one
• the message itself
• the fact that you ticked the consent box
• which language version and which page you sent it from, and — if your browser passed them along — the site you arrived from and any campaign tags in the link

Automatically, to keep spam out:

• a one-way hash of your IP address, salted with a secret the server keeps. It is used only to count how many messages arrive from one place within an hour. The IP address itself is never written to disk.

There are no accounts, no payment details and no special-category data. Please do not put health, financial or other sensitive information in the message field — the form is not the place for it.

Each purpose has its own basis under the GDPR:

• To answer your enquiry and talk about whether I can help — Article 6(1)(b), steps taken at your request before a possible contract.
• To keep a record of what was asked and agreed, and to defend myself if a dispute ever arises — Article 6(1)(f), my legitimate interest.
• To stop the form being used for spam or abuse — Article 6(1)(f), my legitimate interest in a website that works.
• To keep invoices and accounting records, if we end up working together — Article 6(1)(c), Polish tax law.

The tickbox on the form confirms that you want a reply. It is not consent to marketing, and there is no marketing list to join.

• I do not sell your data, and I never will.
• I do not add you to a newsletter and I do not send marketing emails or texts.
• I do not profile you and make no automated decisions about you.
• I do not use your details for anything other than replying to you and, if we work together, running that work.

This site sets no cookies of its own. There is no analytics, no advertising pixel, no session tracking and no consent banner, because there is nothing to consent to. Your language choice travels in the address of the page, not in your browser's storage.

One exception worth naming: the typefaces load from Google Fonts, so Google's servers see your IP address and browser details when a page opens. Google is a separate controller for that. Nothing else on the page reaches a third party.

Your enquiry is stored on the server that runs this site and emailed to my own mailbox. Two providers are therefore involved, both acting on my instructions under a written processing agreement:

• Hostinger — the hosting company whose server holds the site, the enquiry file and the mailbox.
• Google, for Google Fonts — see the section above. This one sees page requests, never your enquiry.

Nobody else has a login. No data is sold, shared for marketing, or transferred outside the European Economic Area on my initiative.

If a public authority asks for data and has the legal right to it, I have to comply. I will tell you when that happens, unless the law forbids it.

• Enquiries: 24 months from our last contact, then deleted.
• Spam counters: the hashed IP lives for at most one hour — the length of the rate-limit window — and is then overwritten.
• Invoices and accounting records, if we work together: five years from the end of the tax year, because tax law says so.

You can ask me to delete an enquiry sooner than that, and unless I need it for an invoice or a live dispute, I will.

Under the GDPR you can ask me to:

• tell you what I hold about you, and give you a copy
• correct anything that is wrong
• delete it
• restrict what I do with it
• hand it over in a portable format
• stop processing it where I rely on legitimate interest — you can object to that at any time
• and, wherever anything does rest on consent, let you withdraw that consent

Write to the address below. I reply within a month and it costs you nothing.

If you think I have handled your data badly, you can complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa.

• The site is served only over HTTPS.
• The enquiry file sits above the public web root, so it cannot be reached from a browser.
• Your raw IP address is never stored — only a salted, one-way hash of it.
• The mailbox and the hosting account are protected by a unique password and two-factor authentication.

No website is perfectly secure and I will not claim otherwise. If something ever goes wrong in a way that puts you at risk, I will tell you and notify the authority within 72 hours, as the GDPR requires.

Where this site links somewhere else — a Google listing, a client's website — that place has its own privacy policy and I have no control over it. This policy covers only what happens here.

If this policy changes, the date at the top changes with it. A change never applies backwards to an enquiry you have already sent — what was true when you sent it is what governs it.

Anything at all about your data, including the awkward questions, goes to: