Privacy policy

Who processes your data

The controller of your personal data is Radosław Jedynak, a sole trader registered at ul. gen. Emila Fieldorfa „Nila” 7, 32-050 Skawina, Poland, VAT ID (NIP) 6642089507, business register no. (REGON) 260711343.

For anything concerning your data, write to radekjedynak@icloud.com — or simply reply to any message you have received from me.

Contact form

When you send the form you give me: your name, e-mail address, optionally a phone number, the project type, optionally a budget and timeline, and your message. They land in my mailbox and stay there.

The basis is my legitimate interest in replying to your enquiry (Art. 6(1)(f) GDPR) and, where the conversation concerns a specific commission, steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

Providing the data is voluntary, but without an e-mail address I have no way to reply.

I keep correspondence for 24 months from the last message in the thread, then delete it. If the conversation turns into a commission, I keep the accounting records for 5 years from the end of the tax year in which the tax became payable, and the correspondence itself until claims under the contract become time-barred.

Protecting the form

So the form does not become a gateway for spam, the server checks how fast submissions arrive. In process memory — never in a database, never in a file — it holds your IP address and a hash of the message for a few minutes, purely so the same enquiry is not sent twice.

The basis is my legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). This data is gone by the time the server restarts, at the latest.

Analytics and session recordings

Analytics run only with your consent (Art. 6(1)(a) GDPR), collected through the bar shown on your first visit. Until you click “Accept”, none of these scripts load.

You can withdraw consent at any time — the “Cookie settings” link in the footer reopens the same bar. Withdrawal applies going forward and does not undo what was already collected.

Retention is set by the providers themselves: Google Analytics deletes user-level data after the period configured in the property, no longer than 14 months. Clarity deletes session recordings after 30 days, and aggregated data — heatmaps and labelled sessions — after 9 months.

• Google Analytics 4 (Google Ireland Limited) — traffic, referral sources, clicks on contact and social links.
• Microsoft Clarity (Microsoft Ireland Operations Limited) — click maps and session recordings, meaning a record of cursor movement, scrolling and clicks. Clarity masks whatever you type into form fields.
• Vercel Analytics (Vercel Inc.) — page-view counters with no cookies and no identifiers that could recognise you; it runs regardless of consent.

Who else processes your data

I use external providers who process data on my behalf under data processing agreements:

Some of them process data outside the European Economic Area, including in the USA. Vercel and Resend are certified under the EU-U.S. Data Privacy Framework. Google and Microsoft provide these services through their Irish entities, and onward transfers to their US parents rest on the Data Privacy Framework or on standard contractual clauses — as does the mailbox provider.

• Vercel Inc. — site hosting and page-view counters.
• Resend (Plus Five Five, Inc.) — delivery of messages from the form.
• Apple Inc. — the mailbox that receives enquiries.
• Google Ireland Limited — Google Analytics 4 (only after consent).
• Microsoft Ireland Operations Limited — Clarity (only after consent).

Your rights

You have the right to access your data, to rectify it, to have it erased, to restrict processing and to data portability.

Where processing rests on legitimate interest — correspondence and form protection — you have the right to object (Art. 21 GDPR). Just write to me; after an objection I delete the correspondence unless I have compelling legitimate grounds to keep it.

You can withdraw consent to analytics at any time, without giving a reason, and without affecting the lawfulness of processing before withdrawal.

You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.

Cookies and browser storage

The site stores the following in your browser:

There are no marketing or advertising cookies here at all.

• locale — a cookie holding your chosen language, valid for a year. Necessary for the language switcher to work.
• consent.v1 — your decision about analytics, kept in the browser's local storage. Without it the bar would ask on every visit.
• intro-seen marker — session storage, cleared when you close the tab.
• Google Analytics and Clarity cookies — set only after consent, under those providers' own policies.

Automated decisions

I do not profile you and I make no automated decisions about you that would produce legal effects or similarly significantly affect you.

Changes

When I change tools or the scope of what is collected, I update this page and the date at the top. A change that requires fresh consent means the bar appears again.