Privacy policy

General provisions

This Privacy Policy sets out the rules for collecting, processing and protecting personal data provided by Users in connection with their use of the website available at mrebacz.pl (the “Website”).

The Controller takes particular care to protect the interests of data subjects and, in particular, ensures that the data collected is processed lawfully, collected for specified and legitimate purposes, and not further processed in a manner incompatible with those purposes.

The legal basis for processing is Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (the “GDPR”), together with the Polish Personal Data Protection Act of 10 May 2018.

Data controller

The controller of personal data collected via the Website is Marcin Rębacz, a natural person not conducting business activity, who owns the Website (the “Controller”).

The Controller can be contacted on any matter concerning the processing of personal data at: kontakt@mrebacz.pl.

The Controller has not appointed a Data Protection Officer. The nature, scope and scale of the processing do not give rise to such an obligation under Art. 37 GDPR. All data protection matters should be addressed directly to the Controller.

Definitions

• User — a natural person visiting the Website or using the features made available on it, in particular the contact form.
• Personal data — information relating to an identified or identifiable natural person, within the meaning of Art. 4(1) GDPR.
• Processing — an operation or set of operations performed on personal data, within the meaning of Art. 4(2) GDPR.
• Website — the website available at mrebacz.pl together with all its subpages.

Scope and source of data

The Controller processes only data provided voluntarily by the User and data collected automatically to the extent described below. The Controller does not obtain personal data from external sources.

Through the contact form, the User provides:

• first name,
• email address,
• phone number — if the User selects the phone as the preferred contact method,
• company or brand name — optional,
• project type and preferred timing,
• the content of the message together with any other data the User chooses to include in it.

Automatically, and only after prior consent to analytics cookies, statistical data about how the Website is used is collected: pages viewed, visit duration, approximate city-level location, and device and browser type. IP addresses are anonymised.

The Controller does not process special categories of personal data referred to in Art. 9 GDPR, nor data relating to criminal convictions and offences.

Purposes and legal bases

Personal data is processed for the following purposes and on the following legal bases:

• replying to an enquiry sent via the contact form and conducting further correspondence — Art. 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract) and Art. 6(1)(f) GDPR (legitimate interest of the Controller in communicating with people interested in working together);
• statistics and improvement of the Website using Google Analytics — Art. 6(1)(a) GDPR (voluntary consent given in the consent banner);
• ensuring the security of the Website and protecting the contact form against automated spam and abuse using Google reCAPTCHA — Art. 6(1)(f) GDPR (legitimate interest of the Controller in securing the Website);
• establishing, pursuing or defending against potential claims — Art. 6(1)(f) GDPR (legitimate interest of the Controller).

Retention period

Personal data is stored no longer than is necessary to achieve the purposes for which it was collected:

• correspondence conducted via the contact form — for up to 24 months from the date of last contact, and where a collaboration is entered into, for its duration and until any claims become time-barred;
• statistical data collected by Google Analytics — for up to 14 months from the date of collection;
• the record of cookie consent — for up to 12 months or until it is withdrawn earlier.

After these periods the data is permanently deleted or anonymised.

Data recipients

Personal data may be entrusted to or shared only with entities whose involvement is necessary for the operation of the Website and for correspondence:

• hosting and email provider — WEBD.pl, for storing the Website and email messages;
• Google Ireland Limited — for Google Analytics and Google reCAPTCHA;
• legal or accounting service providers — only to the extent necessary and only if such a need actually arises;
• public authorities entitled to receive data under applicable law.

The Controller does not sell, rent or share Users' personal data with third parties for marketing purposes.

Transfers outside the EEA

In connection with the use of tools provided by Google, personal data may be transferred outside the European Economic Area, in particular to the United States.

Such transfers take place on the basis of a European Commission implementing decision confirming an adequate level of data protection (EU–US Data Privacy Framework) and on the basis of Standard Contractual Clauses approved by the European Commission, in accordance with Art. 45 and 46 GDPR.

Rights of the data subject

Every User has the following rights:

• the right of access to their data and to obtain a copy of it — Art. 15 GDPR;
• the right to rectification of data — Art. 16 GDPR;
• the right to erasure, the “right to be forgotten” — Art. 17 GDPR;
• the right to restriction of processing — Art. 18 GDPR;
• the right to data portability — Art. 20 GDPR;
• the right to object to processing based on the Controller's legitimate interest — Art. 21 GDPR;
• the right to withdraw consent at any time, whereby withdrawal does not affect the lawfulness of processing carried out before it — Art. 7(3) GDPR.

To exercise these rights, contact the Controller at kontakt@mrebacz.pl. The Controller responds without undue delay and no later than one month from receiving the request. In justified cases this period may be extended by a further two months, of which the User will be informed in advance.

Right to lodge a complaint

A User who considers that the processing of their personal data infringes the GDPR has the right to lodge a complaint with a supervisory authority.

The competent supervisory authority in Poland is the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw.

Voluntary provision of data

Providing personal data is entirely voluntary. However, providing a first name, email address and message content is a necessary condition for replying to an enquiry — without them the request cannot be handled.

Consent to analytics cookies is voluntary, and refusing it does not restrict access to any part of the Website or affect how it works.

Profiling and automated decisions

Users' personal data is not used for automated decision-making producing legal effects or similarly significantly affecting the User, within the meaning of Art. 22 GDPR.

The Controller does not carry out profiling for marketing purposes. Google reCAPTCHA performs an automated risk assessment solely to distinguish a human from an automated program and is not used to evaluate personal characteristics of the User.

Data security

The Controller applies technical and organisational measures appropriate to the risk to the rights and freedoms of data subjects, in accordance with Art. 32 GDPR.

The Website operates over an encrypted HTTPS connection. Access to the mailbox and hosting panel is protected by individual passwords. Data submitted through the contact form is delivered directly to the Controller's mailbox and is not stored in a Website database.

Cookies

The Website uses cookies. Detailed information about their types, purposes and how to manage consent is set out in a separate document — the Cookie Policy, available from the Website footer and from the link at the end of this document.

Final provisions

The Controller reserves the right to amend this Privacy Policy, in particular where applicable law or the scope of tools used changes.

The current version of the document is always published at this address together with the date of the last update.

Matters not covered by this Policy are governed by the GDPR and the Personal Data Protection Act. Any questions should be sent to kontakt@mrebacz.pl.