Privacy and cookie policy
Hello!
If you are reading this, you value your privacy. I understand that completely, so here is one document with all the rules on personal data and on cookies and other tracking technologies used on patrykwojtal.pl.
First, the formal part: the website is run by me, Patryk Wojtal, trading as Patryk Wojtal Marketing (Tax ID/NIP: 5492459970), ul. Zgody 21, 32-640 Laskowa, Poland.
The policy is written as questions and answers, so you can quickly find what you need. If anything is unclear, write to me at kontakt@patrykwojtal.pl.
# 1: Who controls your personal data?
I do: Patryk Wojtal, trading as Patryk Wojtal Marketing (Tax ID/NIP: 5492459970), ul. Zgody 21, 32-640 Laskowa, Poland.
# 2: Who can you contact about your personal data?
I have not appointed a data protection officer, as this is not required in my case. For anything related to personal data and privacy, write to me at kontakt@patrykwojtal.pl.
# 3: What information do I hold about you?
Depending on the purpose, I may process:
- full name,
- phone number,
- email address,
- your company Tax ID and website, if you provide them,
- call topic and the content of your messages to me,
- invoicing details, if you buy a service or workshop from me,
- IP address,
- your newsletter activity, such as opens and link clicks,
- browser, system and visit details recorded in server logs,
- visit data sent to Meta, only if you consent to marketing cookies.
The exact scope for each purpose is described under question 6.
# 4: Where do I get your personal data from?
In most cases you give it to me when you:
- ask for a call back in the “Shall I call you back?” window,
- book a free call using the form,
- subscribe to the newsletter,
- sign up for an online workshop,
- contact me by email or phone.
Some information is collected automatically by the tools I use:
- the web server records your IP address and technical data in logs,
- the newsletter system records your IP address, email opens and link clicks,
- Meta Pixel collects visit data, but only after you consent in the cookie banner.
# 5: Is your data safe?
I take care of your data. I have assessed the risks and put appropriate safeguards in place: the website uses an encrypted HTTPS connection, passwords and service keys are kept outside the public part of the server, and the form is protected against spam and limits the number of submissions. I regularly review my tools and make improvements.
# 6: Why do I process your personal data?
There are several purposes. First a list with legal bases, then the details.
- calling you back and the free call: Art. 6(1)(b) GDPR,
- performing a contract or workshop: Art. 6(1)(b) GDPR,
- invoices and accounting: Art. 6(1)(c) GDPR,
- sending the newsletter: Art. 6(1)(a) GDPR,
- handling correspondence: Art. 6(1)(f) GDPR,
- archive and legal claims: Art. 6(1)(f) GDPR,
- protecting the form against abuse: Art. 6(1)(f) GDPR,
- own marketing and ad measurement: Art. 6(1)(a) GDPR.
Call back and free call: details
In the “Shall I call you back?” window you give your first name and phone number. In the booking form you give your full name, phone, email, call topic and, optionally, Tax ID and website. Calls take place on Google Meet. Providing data is voluntary, but without it I cannot call you back or book a call.
I process this data because you asked me to, before a possible contract (Art. 6(1)(b) GDPR). I keep it for up to 12 months from the last contact, unless we sign a contract.
Contract and online workshop: details
If you become a client or sign up for an online workshop, I process the data needed to perform the contract: name, email, phone and invoicing details (Art. 6(1)(b) GDPR). Invoices and accounting records are kept for 5 years from the end of the year in which the tax payment was due (Art. 6(1)(c) GDPR). Other data is kept for the duration of the contract and then until legal claims become time-barred.
Newsletter: details
When you subscribe, you give me your first name and email address. This is voluntary but required to subscribe. My newsletter system (MailerLite) also records your IP address, approximate location and email client, and which emails you open and which links you click.
Subscription data is processed on the basis of your consent (Art. 6(1)(a) GDPR). I analyse the automatically collected information to improve my emails, which is my legitimate interest (Art. 6(1)(f) GDPR).
You can unsubscribe at any time using the link in every email or by writing to me. After you unsubscribe, I keep a record of when you gave and withdrew consent, so I can prove it, until legal claims become time-barred (Art. 6(1)(f) GDPR).
Correspondence: details
When you write to me, you share the data in your message, usually your name and email address. I process it to reply, which is my legitimate interest (Art. 6(1)(f) GDPR). I keep correspondence for up to 12 months from the last contact, or as long as client data if it relates to a contract.
Archive and legal claims: details
I keep some data longer to be able to reconstruct our cooperation, prove certain facts and establish, pursue or defend legal claims. This is my legitimate interest (Art. 6(1)(f) GDPR). Retention periods are given for each purpose.
Form protection: details
When you submit the form, I store your IP address in hashed form for 1 hour to limit the number of submissions from one address and protect the website against spam (Art. 6(1)(f) GDPR).
Own marketing and ad measurement: details
If you consent to marketing cookies in the banner, Meta Pixel sends information about your visit to Meta. This lets me see how many people arrive from ads and send an enquiry, and lets Meta show my ads to people who visited the website. The legal basis is your consent (Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law). You can withdraw it at any time.
I currently do not use Google Analytics, HotJar or any other analytics tools on this website.
# 7: How long do I keep your personal data?
Retention periods are described for each purpose under question 6. In short:
- form enquiries and correspondence without a contract: up to 12 months from the last contact,
- client and workshop participant data: for the duration of the contract, then until claims become time-barred,
- invoices: 5 years from the end of the year in which the tax payment was due,
- newsletter: until you unsubscribe, and proof of consent until claims become time-barred,
- IP address for form protection: 1 hour,
- data processed on the basis of consent: until you withdraw it,
- server logs: for the period set by the hosting provider.
# 8: Who receives your personal data?
No modern business can work without services from other companies. I use them too, and some of them involve processing your data:
- Hostinger International Ltd. (Cyprus): website hosting and email,
- Telegram: notifies me about new enquiries, so it receives enquiry data (name, phone, email, Tax ID, website and topic),
- Google Ireland Limited (Ireland): Google Meet, calendar, email and work documents,
- MailerLite: newsletter system, if you are a subscriber,
- Cybot A/S (Denmark), provider of Cookiebot: cookie banner and record of your choices,
- Meta Platforms Ireland Limited (Ireland): visit data, only with your consent,
- accounting office: as needed for accounting,
- law firm: where legal support is needed,
- technical support providers: where their work concerns places where data is stored.
Your data may also be shared with the tax office for tax purposes and with courts, police or prosecutors where required by law.
# 9: Do I transfer your data to third countries or international organisations?
Yes, some tools may process data outside the European Economic Area:
- Google, Meta and MailerLite may process data in the USA. Transfers are based on the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission.
- Telegram processes data on servers that may be located outside the European Economic Area, including in countries for which the European Commission has not found an adequate level of data protection. The notification is used only so that I can call you back quickly.
# 10: Do I use profiling or automated decision-making?
I do not make decisions about you based solely on automated processing, including profiling, that would have legal or similarly significant effects on you.
If you consent to marketing cookies, Meta may show you my ads based on your visit to this website. This is known as behavioural advertising. It does not affect the terms of working with me. You can learn more at youronlinechoices.com.
# 11: What are your rights?
Under the GDPR you have the right to:
- access your data and receive a copy,
- have your data corrected,
- have your data erased where there are no grounds to process it,
- restrict processing if you believe the data is wrong or processed without grounds,
- object to processing based on legitimate interest; I will stop unless I show compelling grounds or need the data for legal claims,
- data portability for data provided under a contract or consent,
- withdraw consent at any time, without affecting the lawfulness of earlier processing,
- lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, or with the supervisory authority in your country.
These rights are set out in Articles 15 to 22 GDPR. Not every right applies to every purpose, but you can always lodge a complaint.
To exercise your rights or ask what data I hold about you, write to kontakt@patrykwojtal.pl. I will reply within one month.
# 12: Do I use cookies, and what are they?
Yes, but only a few. Cookies are small text files stored on your device that can be read by my website (first-party cookies) or by other companies’ services (third-party cookies).
Some cookies disappear when you close the browser (session cookies), while others stay longer and let a website recognise your browser on the next visit (persistent cookies).
# 13: On what basis do I use cookies?
Cookies necessary for the website to work are used without consent. All others, meaning marketing cookies, are set only after you consent in the banner shown on your first visit (Art. 399 of the Polish Electronic Communications Law and Art. 6(1)(a) GDPR).
Without this consent the website works the same, including the form and the call back window.
# 14: Can you turn cookies off?
Yes. The easiest way is the “Cookie settings” link in the footer, where you can change or withdraw consent at any time.
You can also block and delete cookies in your browser settings, use incognito mode or extensions such as Ghostery. You can manage behavioural advertising settings at youronlinechoices.com.
Blocking all cookies may make many websites harder to use.
# 15: What do I use first-party cookies for?
- CookieConsent (Cookiebot): remembers your choice in the banner for 12 months,
- light or dark mode: stored in browser storage until you clear your browser data.
Both are necessary for the website to work according to your settings.
# 16: Which third-party cookies are used?
Only one tool on this website sets third-party cookies, and only with your consent:
Meta Pixel: details
Meta Pixel, provided by Meta Platforms Ireland Limited, sets the _fbp and _fbc cookies, usually for 90 days. It shows how many people arrive from Facebook and Instagram ads and send an enquiry, and lets me show ads to people who visited the website.
Meta may combine this information with data from your account and use it for its own purposes, as described in the Meta privacy policy. You can change your ad settings in ad preferences.
This website does not use Google Analytics, HotJar or other analytics tools.
# 17: Do I track what you do on my website?
Only if you agree. In that case Meta Pixel collects information about your visit, as described under question 16. Without consent, I do not track your behaviour on the website.
# 18: Do I show you targeted ads?
Yes. I run ads on Facebook and Instagram aimed at groups chosen by criteria such as industry, interests or age. If you consent to marketing cookies, I may also show ads to people who visited this website.
# 19: How can you manage your privacy?
For your convenience, here are all the options in one place:
- the “Cookie settings” link in the footer,
- cookie settings and incognito mode in your browser,
- browser extensions such as Ghostery,
- behavioural advertising settings at youronlinechoices.com,
- ad preferences in your Facebook account,
- the unsubscribe link in every newsletter email,
- a message to me at kontakt@patrykwojtal.pl.
# 20: What are server logs?
Every visit sends requests to the server, which are recorded in logs. Logs include your IP address, date and time, page address and browser and system details.
Logs are used only to maintain and secure the website. I do not link them to specific people or to form data, and only those who administer the server can see them.
# 21: Is there anything else you should know?
Privacy is a complex topic, so I have tried to explain everything as simply as possible. If I change how I process data, I will update this document and the date at the top.
If anything is unclear, you want to know more or just want to talk about your privacy, write to me at kontakt@patrykwojtal.pl.