Privacy policy

1. Data controller

The controller of your personal data is Paweł Bednarz, running a sole proprietorship registered at Buszkowiczki 207, 37-710 Buszkowiczki, Poland; Polish Tax ID (NIP): 795-251-43-07 (hereinafter: the "Controller").

You can contact the Controller about anything related to personal data:

• by email: kontakt@pawelbednarz.pl,
• by phone: +48 730 097 071.

No Data Protection Officer has been appointed. All data protection matters can be addressed directly to the Controller.

2. What data we process and why

2.1. Contact form

When you use the contact form on the website, you provide the Controller with the following data: full name, email address, optionally phone number, the topic of your inquiry and the message itself.

This data is processed in order to respond to your inquiry, get in touch with you and continue the correspondence related to your request.

2.2. Data collected automatically

While you use the website, certain data about your visit is collected automatically — including: IP address, browser type, operating system, referrer, time of visit and pages viewed. This data is collected via analytics tools (Google Analytics 4) only after you give consent in the cookie banner.

Technical data (including IP address) is also processed to keep the website secure and protect it from abuse — for example via the anti-bot verification on the contact form.

3. Legal basis for processing

Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR):

Purpose of processing	Legal basis
Answering inquiries sent via the contact form and ongoing correspondence	Art. 6(1)(f) GDPR — legitimate interest of the Controller (handling inquiries and business contact)
Pre-contractual steps and contract performance (where the inquiry leads to a service engagement)	Art. 6(1)(b) GDPR — necessary to take steps prior to entering into a contract
Analytics and statistics (Google Analytics 4)	Art. 6(1)(a) GDPR — voluntary consent given via the cookie banner
Website security and protection against abuse	Art. 6(1)(f) GDPR — legitimate interest of the Controller
Establishing, exercising or defending legal claims	Art. 6(1)(f) GDPR — legitimate interest of the Controller

Providing your data is voluntary, but necessary to use the contact form — without it, the Controller cannot respond to your inquiry.

4. How long we keep your data

• Contact form data is kept for the time necessary to handle the inquiry and then until the limitation period for any potential claims related to the contact or engagement expires.
• Analytics data is kept for the period configured in Google Analytics 4 and for the lifetime of the relevant cookies — no longer than until you withdraw consent.
• Data processed on the basis of consent — until consent is withdrawn.

5. Recipients of the data

To run the website the Controller uses external providers who may process personal data as data processors or independent controllers:

Provider	Scope
Cloudflare, Inc.	Website hosting, content delivery network (CDN) and anti-bot verification for the contact form (Cloudflare Turnstile)
FormSubmit (formsubmit.co)	Processing and forwarding of messages sent via the contact form
Google Ireland Ltd. / Google LLC	Google Analytics 4 and Google Tag Manager (analytics), Google Workspace (email)
Usercentrics A/S (Cookiebot)	Cookie consent management (Consent Management Platform)

Data may also be disclosed to entities authorized by law.

6. Transfers outside the European Economic Area

Some of the providers (in particular Google and Cloudflare) may process data outside the European Economic Area, including in the United States. Where this happens, transfers are protected by safeguards required by the GDPR — in particular Standard Contractual Clauses approved by the European Commission and/or an adequacy decision (the EU-U.S. Data Privacy Framework).

7. Your rights

In connection with the processing of your personal data you have the right to:

• access your data and obtain a copy of it,
• have inaccurate data corrected (rectification),
• have your data erased ("right to be forgotten"),
• restrict processing of your data,
• data portability,
• object to processing based on legitimate interest,
• withdraw consent at any time — without affecting the lawfulness of processing carried out before withdrawal,
• lodge a complaint with a supervisory authority. In Poland: the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw). In other EU/EEA countries: your local data protection authority.

To exercise any of these rights, contact the Controller at kontakt@pawelbednarz.pl.

8. Cookies

The website uses cookies — small text files stored on your device. The following categories are used:

• Necessary — required for the website to work correctly, including remembering your consent choices. No consent required.
• Statistics — used to analyze traffic (Google Analytics 4). Only loaded after you give consent.
• Marketing / preferences — if used, only loaded after you give consent.

Cookie consents are managed via the consent banner (Cookiebot). You can change or withdraw your choice at any time — through the consent settings on the website or in your browser settings. The website uses Google Consent Mode v2, so Google tools behave in line with your choices.

9. Data security

The Controller applies technical and organizational measures appropriate to the risks and the categories of data being processed. The website uses encrypted connections (HTTPS), and only authorized people have access to the data submitted via the form.

10. Changes to this policy

This privacy policy may be updated from time to time — in particular when the law, the tools used on the site or the scope of the services change. The current version is always available on this page, with the date of the last update shown at the top.

11. Contact

If you have any questions about this privacy policy or about how personal data is processed, please get in touch: kontakt@pawelbednarz.pl.