Privacy policy

1. Data controller

The controller of your personal data is Mateusz Mazur, running a sole proprietorship under the business name webstroke.pl Mateusz Mazur, Strzyżowska 42/7, 35-505 Rzeszów, EU VAT ID PL8151560250.

For any matter concerning personal data, write to hello@mateuszmazur.dev. I have not appointed a data protection officer, as the law does not require one in my case.

2. E-mail contact

When you e-mail me, I process your e-mail address, your name if you provide it, and any information included in the message, such as a company name or a website address.

I do this to reply to your message and, if you ask for it, to prepare a quote. The legal basis is my legitimate interest in handling correspondence (Art. 6(1)(f) GDPR) and, when we discuss working together, taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR).

I keep the correspondence for as long as it is ongoing and then for no longer than 2 years, unless we start working together. In that case I keep data related to the contract and invoicing for as long as tax and accounting laws require, usually 5 years from the end of the year in which the invoice was issued, and until any claims become time-barred.

Providing data is voluntary, but without an e-mail address I cannot reply.

3. Server logs

On every visit, the server automatically records technical information about the request in its logs, namely the IP address, date and time, the requested page, the response code and information about the browser and operating system (the User-Agent header).

This data is used only to keep the site running and secure and to diagnose errors. The legal basis is my legitimate interest (Art. 6(1)(f) GDPR). Logs are deleted automatically after a short time and I do not combine them with any other data.

4. Cloudflare

Traffic to the site passes through the Cloudflare network, which makes it load faster and protects it from attacks. In doing so, Cloudflare processes the IP address and technical request data. Based on the country derived from the IP address, it also sends visitors of the site's root address to the Polish or the English version. This decision stores nothing in your browser.

The legal basis is my legitimate interest in keeping the site fast and secure (Art. 6(1)(f) GDPR).

5. Visitor statistics

I measure traffic with Cloudflare Web Analytics. It stores no cookies or other data in your browser, builds no user profiles and does not track you across websites. It collects aggregated information such as page views, the referring site, browser and device type, country and page load times. According to Cloudflare, IP addresses are not stored in the process.

These statistics tell me which content people read and whether the site is fast for real visitors. The legal basis is my legitimate interest (Art. 6(1)(f) GDPR). If you do not want your visits counted, you can block the static.cloudflareinsights.com script in your browser settings or with a blocking extension.

6. Cookies

The site itself stores no cookies and no data in local storage in your browser, which is why it shows no consent banner.

Cloudflare may set technical security cookies such as __cf_bm or cf_clearance. They are used only to tell humans from bots and to protect the site from attacks, are necessary for its secure operation and expire after a short time. They are not used for analytics or advertising.

7. Recipients and transfers outside the EEA

I do not sell data or share it for marketing purposes. Data may only be passed to service providers who process it on my behalf under data processing agreements.

• Cloudflare, Inc. (USA): content delivery network, site protection and visitor statistics.
• Hostinger: the server that runs the site.
• Fastmail Pty Ltd (Australia): e-mail for the mateuszmazur.dev domain.
• Accounting office: data related to invoicing, if we work together.

Some of these providers process data outside the European Economic Area. Cloudflare participates in the EU-U.S. Data Privacy Framework, under which the European Commission has recognised an adequate level of data protection. Transfers to other providers outside the EEA are based on standard contractual clauses approved by the European Commission.

8. Links to other services

The site links to my LinkedIn profile. When you follow the link, you go to a service where LinkedIn is the data controller and its own privacy policy applies. The site does not embed LinkedIn or any other social network plugins.

9. Your rights

In connection with the processing of your data, you have the right to:

• access your data and receive a copy of it,
• have your data rectified,
• have your data erased,
• restrict processing,
• data portability, to the extent I process data under a contract,
• object to processing based on my legitimate interest,
• lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

To exercise these rights, write to hello@mateuszmazur.dev. I will reply without undue delay and within one month at the latest. I do not make automated decisions about you and do not use profiling.

10. Changes to this policy

This policy may change when I start using new services, such as a contact form. The current version is always available at this address, and the date of the latest change is shown at the top of the document.