Privacy
policy.
This site collects little data: what you type into the form or send me by email, and visit statistics if you agree to them. Below I explain who processes that data, why, for how long, and what you can do about it.
Last updated:
01Who the data controller is
The controller of your personal data is me, Kacper Rafalski, a sole trader registered in CEIDG, the Polish business register, NIP (Polish tax ID) 6711773834, REGON 321520917. My full registration details are public there – search by NIP.
For anything related to your data, email kontakt@rafalski.pl. I have not appointed a data protection officer – at this scale of processing, one is not required.
02What data I process
Contact form
- your name, work email, website, and message
- if you choose them: a rough budget and your answer to “How did you hear about me?”
- automatically: the path of the rafalski.pl page the form was opened from (without URL parameters) and the form language
The form sends this data as a single email to my inbox. I do not store it in any database. The script that handles the form does not write field values to its logs – if sending fails, it records only the error code.
If you write to kontakt@rafalski.pl directly, I process whatever the message contains – usually your name, email address, signature, and message.
Visit statistics – only with consent
Google Analytics 4 collects the pages you visit, the traffic source, your device and browser, your approximate location (country, city), and an identifier stored in a cookie. When you submit the form, it also receives a “generate_lead” event with the budget and the “How did you hear about me?” answer you picked – without your name, email, or message.
Technical data
Every request to this site passes through Cloudflare, which processes your IP address, browser type, the requested URL, and the request time to deliver the page and protect it from attacks.
The site has no user accounts, newsletter, payments, or social media plugins. Fonts load from rafalski.pl, so your browser does not connect to Google Fonts. The LinkedIn link is a plain link – LinkedIn receives data only when you click it.
03Why, on what legal basis, and for how long
Each purpose has its own legal basis under the GDPR and its own retention period. When that period ends, I delete the data.
Replying to your enquiry and preparing a proposal
- Data
- from the form or your email
- Legal basis
- Art. 6(1)(b) GDPR – steps taken at your request before entering into a contract; for correspondence unrelated to a proposal, Art. 6(1)(f) GDPR – my legitimate interest in replying to messages
- Retention
- 12 months after the last message if we do not sign a contract
Working together and invoicing
- Data
- contact and invoicing details
- Legal basis
- Art. 6(1)(b) GDPR – performance of a contract; Art. 6(1)(c) GDPR – tax and accounting obligations
- Retention
- for the duration of the contract; accounting records for five years from the end of the year in which the tax payment deadline passed
Defending against claims
- Data
- correspondence and project documents
- Legal basis
- Art. 6(1)(f) GDPR – establishing, pursuing, or defending legal claims
- Retention
- until claims become time-barred – as a rule, three years after the project ends
Visit statistics (Google Analytics 4)
- Data
- about your visit, as described above
- Legal basis
- Art. 6(1)(a) GDPR – your consent; the same consent covers storing analytics cookies under Polish electronic communications law
- Retention
- data in Google Analytics – 14 months; cookies – up to two years or until you withdraw consent
Running and securing the site
- Data
- technical: IP address, browser, URL, request time
- Legal basis
- Art. 6(1)(f) GDPR – my legitimate interest in delivering the site and protecting it from abuse
- Retention
- I keep no server logs of my own; Cloudflare sets no fixed period – it deletes technical data once it is no longer needed to deliver and protect the site (per its privacy policy)
04Who receives the data
I do not sell data or share it with anyone for marketing. The service providers I use have access to it only on my instructions and under data processing agreements:
- Cloudflare, Inc. – site hosting, attack protection, and delivery of form messages
- Google Ireland Limited and Google LLC – my mailbox (Google Workspace) and statistics (Google Analytics, only with consent)
- IFIRMA SA, Wrocław, Poland – invoicing and accounting, if we sign a contract
I may also disclose data to public authorities when the law requires it.
05Transfers outside the EEA
Cloudflare and Google may process data in the United States. Both companies participate in the EU-US Data Privacy Framework, which the European Commission has recognized as providing an adequate level of protection. They also use the Commission’s standard contractual clauses. You can request a copy of these safeguards at kontakt@rafalski.pl.
07Your rights
You have the right to:
- access your data and get a copy of it
- have inaccurate data corrected
- have your data deleted
- restrict processing
- receive the data I process under a contract or your consent in a portable format
- object to processing based on my legitimate interest
- withdraw consent at any time – without affecting the lawfulness of processing before you withdrew it
To use any of these rights, email kontakt@rafalski.pl. I will reply within one month, usually much sooner.
If you believe I process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).
08Do you have to provide data
No, providing data is voluntary. Without your name, email, website, and message the form will not send – you can email me instead. Without consent to statistics, the site works exactly the same.
I do not make decisions about you by automated means, including decisions based on profiling.
09Changes to this policy
When I change how I process data, I will update this page and the date at the top. For a significant change, I will add a short note here explaining what changed.