Privacy policy

Data controller

The data controller is Szymon Kądzielawa, trading as S5 Digital Szymon Kądzielawa, Medweckiego 87, 32-083 Balice, Poland, EU VAT ID: PL6751318817. For privacy enquiries, email hello@kadzielawa.com.

Enquiries and working together

When you send a message, I process your email address, the contact details you provide, and the contents of your message and attachments. I use them to reply, discuss potential work and manage correspondence. Providing data is voluntary, but I need a contact address and details of your enquiry to respond.

For general enquiries and communication with company representatives, the legal basis is my legitimate interest in communication and running my business (Article 6(1)(f) GDPR). If you contact me to enter into a contract on your own behalf, pre-contractual steps and performance of that contract rely on Article 6(1)(b) GDPR. Records required by law are processed under Article 6(1)(c) GDPR.

Website operation and security

This is a static website using Cloudflare infrastructure. When you visit, that infrastructure may process your IP address, request time, the requested page address, and technical browser and server response data. This supports website delivery, error diagnosis and protection against abuse. The legal basis is my legitimate interest in operating and securing the website (Article 6(1)(f) GDPR).

Service providers and international transfers

I use Cloudflare to serve and protect the website, and Gmail (Google) for correspondence. Messages sent to hello@kadzielawa.com are forwarded by Cloudflare Email Routing to my inbox in the free Gmail service (Google). Cloudflare also provides the website analytics described below. These providers may process technical and correspondence data as needed to provide their services. Data may also be disclosed to authorities where required by law.

These providers operate internationally, so data may be processed outside the European Economic Area, including in the USA. Their transfer mechanisms, including adequacy decisions and standard contractual clauses, and information on obtaining details of safeguards are explained in the Cloudflare privacy policy and Google privacy policy. You can also contact me.

Data retention

I keep correspondence until the matter it concerns is concluded. If it leads to a working relationship, necessary data is retained while the contract is performed. Afterwards, I retain only data needed to meet legal obligations or establish, exercise or defend legal claims, until the applicable statutory periods expire or a dispute is finally resolved. At least once a year, I review retained correspondence and delete data that is no longer needed for these purposes. If I identify unnecessary data earlier, I delete it without waiting for the next review.

Providers’ retention periods for technical data depend on the service, its configuration and the security or incident-handling purpose. Their policies linked above describe their practices. According to the current service documentation, the Cloudflare Web Analytics dashboard provides access to reports for the previous six months. This describes report availability, not the retention period of all Cloudflare infrastructure data. I do not maintain a separate database of individual visitors’ browsing history.

Your rights

Subject to the conditions in the GDPR, you may request access to, correction or erasure of your data, and restriction of processing. You may object to processing based on legitimate interests on grounds relating to your particular situation. Data portability applies where the GDPR conditions are met, particularly for automated processing based on a contract.

Send requests to hello@kadzielawa.com. You may also complain to the Polish supervisory authority, the President of the Personal Data Protection Office: uodo.gov.pl, or another competent supervisory authority. I do not make decisions about you based solely on automated processing, including profiling.

Cookies, analytics and external links

I use Cloudflare Web Analytics to measure page views, referral sources and website performance in aggregate. Reports may include visited pages, the referring page, country, device type, browser, loading times and performance metrics. Cloudflare automatically adds the measurement script. The enabled configuration excludes browser-based measurement for EU visitors according to Cloudflare’s regional exclusion mechanism.

Web Analytics does not use cookies or localStorage and does not fingerprint individuals to recognise them across visits. Connecting to the service requires technical data, including an IP address for network communication; I do not use this data to create individual visitor profiles. Measurement helps me assess and improve the website. To the extent personal data is involved in its technical operation, the legal basis is my legitimate interest in maintaining and improving the website (Article 6(1)(f) GDPR).

Separately, I use aggregate request statistics available through Cloudflare infrastructure. These also include EU traffic and requests from automated clients, so the number of requests is not the number of people visiting the website. More information: Cloudflare Web Analytics.

The website does not use advertising scripts. Its code does not save your language choice in browser storage. Fonts and images are served with the website. Cloudflare security services may use technical mechanisms necessary to protect the website, depending on the enabled protections.

Links to LinkedIn and other services take you away from this website. Those services process data under their own policies when you visit them. Clicking an email address opens your email application; this website has no contact form.