Privacy Policy

1. Data controller

The controller is Damian Baran, acting as a private individual. Privacy contact: kontakt@damianbaran.com.

2. Data and purposes

• Data sent through the form or by e-mail, especially your name, e-mail address and message — to handle your enquiry and correspond with you.
• Technical data such as IP address, timestamps and device information — to secure the website, prevent abuse and diagnose errors.
• Website usage data — only after consent to Google Analytics and only once that service is configured.

3. Legal bases

• Article 6(1)(b) GDPR — steps taken at your request before a possible contract when your enquiry concerns a service.
• Article 6(1)(f) GDPR — legitimate interests in handling other correspondence, protecting the website and establishing, exercising or defending claims.
• Article 6(1)(a) GDPR — consent for optional Google Analytics measurement. Consent can be withdrawn at any time without affecting prior lawful processing.

4. Recipients

Data may be entrusted to hosting and security providers (Cloudflare), e-mail and form providers (Resend/Twilio), and — after consent — Google as the Analytics provider. They process data under their terms and applicable agreements. Data may also be disclosed to authorities where required by law.

5. Transfers outside the EEA

Some providers may process data outside the European Economic Area. Where this happens, transfers use safeguards provided by the GDPR, especially an adequacy decision or Standard Contractual Clauses.

6. Retention

Correspondence is kept only as long as needed to handle the enquiry and for no more than 12 months after contact ends, unless longer retention is needed for legal claims or required by law. Technical data follows the configured security-service retention. Analytics data follows the period configured in Google Analytics.

7. Your rights

• access, rectification and erasure;
• restriction and portability where applicable;
• objection to processing based on legitimate interests;
• withdrawal of Analytics consent at any time;
• a complaint to the President of the Polish Personal Data Protection Office (UODO) or another competent supervisory authority.

8. Is providing data required?

Providing form data is voluntary, but a reply may be impossible without your name, e-mail address and message. Analytics consent is entirely optional and refusing it does not restrict website access.

9. Automated decisions

Your data is not used for solely automated decisions that produce legal or similarly significant effects.