Privacy policy

The controller of your personal data is Jakub Zając, operating a sole proprietorship under the name “Usługi informatyczne Jakub Zając”, which also trades as “JZ Technology”, ks. Jana Konopczyńskiego 1, 85-309 Bydgoszcz, Poland, NIP (tax ID): 9532802271, REGON: 527976138 (the “Controller”).

For any matter concerning personal data, you can contact us at kontakt@jakubzajac.eu.

No data protection officer has been appointed. That obligation arises from Article 37 GDPR and applies, among others, to public authorities and to organisations whose core activity involves large-scale monitoring of individuals or large-scale processing of special categories of data. A business of this size does not meet those conditions, so data protection matters are handled directly by the company's owner.

We collect only what is needed to handle enquiries and to run the website. The data comes from three sources.

The contact form. You provide your name, your email address and the content of your message, plus — optionally — a phone number, company name, the subject of the enquiry, an approximate timeline, how urgent it is and an approximate budget. Two further details about the submission itself are attached to that email without you typing them: the language the site was displayed in, and the address of the page the form was sent from — they let us reply in the same language and see which service the question is about. This reaches us as an email and is used solely to reply to you and to handle further correspondence about the matter.

Technical connection data. The hosting provider records standard server logs: IP address, date and time of the request, the page requested, browser and operating system. The IP address is additionally checked at the moment a form is submitted, to limit how many submissions come from one source; it is not included in the message we receive. The form also has simple anti-spam protection that discards automated submissions.

Visitor statistics. If you consent through the cookie banner, Google Analytics 4 is loaded. It collects data about how the site is used: which pages you open, where you arrived from, an approximate location derived from your IP address, device and browser type, and a pseudonymous identifier stored in a cookie. Without your consent the analytics script is never loaded and none of this data comes into existence.

Each purpose has its own legal basis:

• Article 6(1)(b) GDPR, where your enquiry aims at entering into a contract or concerns an existing one; this covers steps taken at your request before the contract is concluded, including preparing a quote,
• Article 6(1)(f) GDPR, our legitimate interest in handling correspondence that is not heading towards a contract,
• Article 6(1)(f) GDPR, our legitimate interest in keeping the site secure and preventing abuse: the form's anti-spam protection and the limit on submissions from a single address,
• Article 6(1)(f) GDPR, our legitimate interest in establishing, pursuing or defending legal claims,
• Article 6(1)(c) GDPR, obligations under tax and accounting law where the work ends in an invoice,
• Article 6(1)(a) GDPR, your consent, used only for analytics cookies and visitor statistics.

You can withdraw your analytics consent at any time through “Cookie settings” in the site footer. Withdrawal applies going forward and does not affect the lawfulness of processing carried out on the basis of consent before it was withdrawn.

We keep data no longer than the purpose it was collected for requires:

• correspondence about matters that led to work: for as long as the matter is live, and for three years after it closes — the limitation period under Polish law for claims connected with running a business,
• enquiries that did not lead to work: twelve months from the last message in the thread, after which they are deleted; where a matter could become the subject of a dispute, the correspondence is kept until the limitation period expires,
• accounting and tax records: for the statutory period, that is five years counted from the end of the tax year they relate to,
• server logs: for the limited period set by the hosting provider's configuration; they serve diagnostics and security only,
• analytics data: for the retention window configured in the analytics tool, after which detailed records are removed and only aggregate reports remain.

Once those periods pass, the data is deleted or stripped of anything that would tie it to a particular person.

We do not sell your data and we do not share it with anyone for marketing purposes. Access is limited to providers that process it on our behalf, only to the extent their service requires, under data processing agreements:

• Vercel Inc. — hosting and delivery of the website,
• OVH SAS (OVHcloud), France — domain registration, DNS, and hosting of the mailbox through which contact-form messages are sent and received,
• Google Ireland Limited — Google Analytics 4, only if you have given consent.

Beyond that, data may reach the accountants and advisers who support our business, to the extent it concerns billing, and public authorities where the law requires it.

Some of the providers listed above are US companies, or belong to groups that also process data outside the European Economic Area. This concerns Vercel and Google. Correspondence from the contact form stays in a mailbox hosted by OVHcloud, a company established in France.

Such transfers rely on the safeguards set out in Chapter V of the GDPR: Standard Contractual Clauses adopted by the European Commission, or the provider's certification under the EU-U.S. Data Privacy Framework. These are backed by supplementary measures, chiefly encryption in transit and keeping the transferred data to the minimum needed.

Where a provider offers processing in an EU region, that is the option we choose.

On request sent to the address given at the start of this document, we will tell you which safeguards a given provider relies on, or where you can review them.

In connection with the processing of your personal data, you have the following rights:

• the right of access and to obtain a copy of your data,
• the right to have inaccurate or incomplete data corrected,
• the right to erasure,
• the right to restriction of processing,
• the right to object to processing based on legitimate interest,
• the right to data portability,
• the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal,
• the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.

To exercise these rights, write to kontakt@jakubzajac.eu. We respond without undue delay, within the time limits set by the GDPR.

If you believe we process your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO), the supervisory authority for data protection in Poland, whose remit includes handling complaints from data subjects. Current contact details and the complaint procedure are published on the authority's official website.

Providing data in the contact form is not required by any law. It is voluntary, but necessary for contact to happen: without an email address we cannot reply, and without a message we have no idea what the matter is about. The remaining fields — phone, company, urgency, budget — are optional, and skipping them has no consequence other than a less specific first reply.

If a contract is concluded, providing identification and billing details becomes a statutory requirement under tax law: without them an invoice cannot be issued.

Analytics consent is entirely voluntary. Declining does not restrict access to any part of the site and does not change how it works.

No decisions concerning you are made solely by automated means, including profiling, that would produce legal effects or similarly significantly affect you. Messages from the contact form are read and handled by a person, not by an automated system.

The analytics tool organises traffic into statistical reports: session counts, traffic sources, which pages get read. The mechanism itself groups data automatically, but we do not use it to evaluate individual people or to make decisions about them.

The site is served over HTTPS only, so traffic between your browser and the server is encrypted. Server responses carry security headers that limit common classes of browser-side attack, and the contact form has anti-spam protection and a per-address submission limit.

Beyond that we apply data minimisation: we collect only what is needed and keep it only as long as necessary. Access to the correspondence is limited to the company's owner. The providers listed above can access data only to the extent their service technically requires.

We update this policy when the scope of services, the list of providers or the law changes. The current version is always published on this page together with its date. If a change affects the purposes or legal bases for data we already hold, we will inform the people concerned.