Privacy policy

1. Data controller

The controller of your personal data is Mateusz Kafara, Golce 30, 78-600 Golce.

You can contact the controller regarding personal data at: kontakt@mateuszkafara.pl or by phone: 515 839 715.

No data protection officer has been appointed.

2. Data that may be processed

Depending on how you use the website, the following data may be processed:

• contact form data: name, e-mail address, phone number, enquiry type, subject, budget or project scope and message content,
• technical data: IP address, date and time of connection, visited URL, browser, operating system and diagnostic information,
• session or browser storage data needed for security, contact form operation, selected language or theme,
• data from further correspondence if you continue the conversation by e-mail or phone.

3. Purposes and legal bases

Data is processed only for specific purposes related to the website, contact and security.

• handling contact forms and replying to messages - Article 6(1)(b) GDPR or Article 6(1)(f) GDPR,
• preparing information about services, estimates or cooperation - Article 6(1)(b) GDPR,
• protecting the website against spam, abuse and attacks - Article 6(1)(f) GDPR,
• keeping documentation and handling possible claims - Article 6(1)(f) GDPR,
• fulfilling legal obligations if they arise - Article 6(1)(c) GDPR,
• consent-based processing, if an additional feature requiring consent is introduced - Article 6(1)(a) GDPR.

4. Contact form

Sending the form is voluntary, but required fields are necessary to reply to your message.

The form uses a CSRF token, an anti-spam honeypot and a submission rate limit. The stored form record replaces the IP address with a one-way technical hash.

Do not include sensitive data or information unnecessary for handling the enquiry.

5. Cookies, session and browser storage

The website may use necessary cookies and similar technologies for correct operation, security and contact form handling.

The website may store settings such as the selected light/dark theme or language in the browser.

External advertising materials, including LeadStar affiliate advertising or administrator-configured advertising code, are activated only after advertising consent. After consent, a provider may receive technical data required to display and account for the material, such as the IP address, browser information, visited page and click data. Consent can be changed in privacy settings.

6. Server logs and security

Hosting providers and the controller may process server logs to maintain the website, diagnose errors and protect against attacks. Logs may include IP address, date, URL, browser and server response code.

7. Recipients of data

Data may be disclosed only to entities that help maintain the website and handle communication.

• hosting and server infrastructure providers,
• e-mail and technical tool providers,
• IT and security service providers,
• advertising providers and partners when advertising is enabled,
• entities authorised by law.

8. Transfers outside the EEA

The controller does not intend to sell data or deliberately transfer data outside the EEA. If technical tools involving such transfers are used in the future, the transfer will take place in accordance with the GDPR.

9. Storage period

Data is stored no longer than necessary.

• contact messages and correspondence - for the time needed to reply and handle the matter, then up to 12 months after the end of contact unless longer storage is needed for claims,
• offer or cooperation-related data - for the duration of talks/cooperation and for the period required by law or claims protection,
• server logs - according to hosting and security settings,
• consent-based data - until consent is withdrawn, unless another legal basis applies.

10. Your rights

You have the rights provided by the GDPR, depending on the legal basis and circumstances.

• access to data,
• rectification,
• erasure,
• restriction of processing,
• data portability where applicable,
• objection to processing based on legitimate interest,
• withdrawal of consent where consent is the basis,
• lodging a complaint with the supervisory authority.

11. Voluntary provision of data

Providing data is voluntary, but required fields are necessary to handle the enquiry. Providing a phone number or budget information is optional.

12. Automated decisions and profiling

The website does not use personal data for automated decision-making producing legal effects or similarly significant effects.

13. External links

The website may link to external services. After leaving the website, the privacy rules of the external service apply.

14. Changes to this policy

This policy may be updated when the website, tools, data scope or law changes. The current version is always available on this page.