Privacy policy

Data controller

The controller of your personal data is Sergiusz Rozycki. For anything related to your personal data, write to hello@sergiuszrozycki.com.

What data I collect

The contact form collects the data you enter:

• your name,
• your email address,
• your company name (optional),
• the timeline and a rough budget (optional),
• the topic and content of your message.

Together with your message I store the page language, the address of the page it was sent from and the date it was sent. I do not store your IP address or browser details.

The website scan (sergiuszrozycki.com/en/scan/) stores the scanned address, the scan result, the language and the date. To limit the number of scans it also stores a hash of your IP address (transformed one way with a secret key), never the address itself. When you ask for the full result, I store your email address and, if you give them, your name and company. The scanned address is sent to Google PageSpeed Insights, which measures its speed.

Purpose and legal basis

I process your data to reply to your message and continue the conversation (Art. 6(1)(f) GDPR — legitimate interest). If we discuss working together, I also process it to take steps at your request before entering into a contract (Art. 6(1)(b) GDPR).

After you send the form, I email you a short confirmation that it arrived (at most one a day). Your address is not added to any mailing list.

When you ask for the full scan result, I email you a link to it. Only once you open the link does the result reach my audit panel as an enquiry, and I may get in touch once about the fixes (Art. 6(1)(f) GDPR). Unless you open the link, the address is not used for anything else.

How long I keep data

I keep messages for 12 months after our last contact. If we start working together, I keep the data for the duration of the collaboration and as long as the law requires.

I delete scans without an email address after 30 days, and scans with one 12 months after the last change.

Who processes data on my behalf

I use service providers that process data on my behalf:

• Cloudflare, Inc. — website hosting, form delivery, storage of form messages and scan results (database in the European Union), running the scan, bot protection (Turnstile) and emails,
• OVH SAS — the email inbox that receives form messages,
• Sanity Inc. — delivery of images on the website (processes your browser's IP address when they load).

These providers may process data outside the European Economic Area, including in the USA. Transfers are based on the Standard Contractual Clauses approved by the European Commission and, where applicable, the EU-US Data Privacy Framework.

Your rights

You have the right to access, rectify and erase your data, to restrict its processing, to data portability and to object to processing. To exercise these rights, write to the address above. You can also lodge a complaint with the Polish data protection authority (uodo.gov.pl).

Providing your data is voluntary, but without your name, email address and message I cannot reply.

Cookies

This website only uses strictly necessary cookies:

• lang — remembers your language choice. Valid for 6 months, created only when you use the language switch.

The website uses no analytics or advertising cookies and does not track visitors.

Technical data

When you view the website, Cloudflare processes technical connection data, including your IP address, to deliver the site and protect it from abuse, for example by limiting form submissions.

On the scan page, Cloudflare Turnstile checks that a person, not a bot, starts the scan. It processes browser data and your IP address for this, without tracking cookies.

Changes to this policy

If the way I process data changes, I will update this page. The date of the last change is shown at the top.