Privacy Policy

Last updated: 2026-10-11

This policy explains what personal data is processed when you visit lbajsarowicz.me, use its contact form, or book a meeting through it, and what rights you have. I run this site from Poland, so the EU General Data Protection Regulation (GDPR) applies to processing carried out in connection with it, wherever you are. I offer the rights described here to every visitor, and additional local rights apply where your own law covers this processing.

1. Controller

The controller of your personal data is:

• @lbajsarowicz Łukasz Bajsarowicz, a sole trader registered in CEIDG (Central Register and Information on Economic Activity, Poland)
• NIP (tax ID): 9111960653, REGON: 021046365
• Address for correspondence: ul. Hoża 86, lok. 410, 00-682 Warszawa, Poland
• Email: lukasz@lbajsarowicz.me

I have not appointed a data protection officer, as the law does not require one for this site. Write to the email address above about anything in this policy.

2. Summary

• Without your consent, the site sets no analytics or advertising cookies and loads no Google Analytics, YouTube or Google Calendar content.
• Data you send through the contact form reaches me by email through Brevo.
• The whole site is delivered through Cloudflare, which processes technical data such as your IP address for every request.
• I do not sell your data, use it for advertising, or make automated decisions about you.

3. What I process, why, and on what legal basis

3.1 Visiting the site (hosting, delivery and security)

Every page is served by Cloudflare (see section 5). For each request, Cloudflare processes your IP address, the requested URL, date and time, browser type (user agent), referring page and similar technical data. This is needed to deliver the page, keep it fast and protect it against attacks and abuse.

• Legal basis: Article 6(1)(f) GDPR, my legitimate interest in running a secure, working website.
• Retention: I do not keep access logs. In the Cloudflare dashboard I see only aggregated traffic statistics. Cloudflare keeps its own security and operational logs under its privacy policy. Error messages from the form endpoints contain no form content.

To pre-select your country in the phone number field of the contact form, the site asks its own endpoint (/api/geolocation) for the country code that Cloudflare derives from your IP address. Only the two-letter country code is returned to your browser, and it is not stored.

3.2 Fonts

The site’s typeface (Outfit, an open-source font) is served from this site’s own domain together with the rest of the page. No external font service is contacted, so no data is sent to a font provider.

3.3 Contact form

When you send the contact form, I process your email address and, if you give them, your name and phone number. The form is delivered to my mailbox as an email sent through Brevo, and I reply from my email account hosted on Google Workspace.

• Purpose: answering your enquiry and, if you ask for it, taking steps before entering into a contract.
• Legal basis: Article 6(1)(b) GDPR where your enquiry concerns a possible contract, otherwise Article 6(1)(f) GDPR, my legitimate interest in responding to people who contact me.
• Retention: I delete ordinary enquiries within 12 months after the conversation ends. If the conversation leads to a contract, the related correspondence is kept until the limitation period for claims under that contract expires (Articles 118 and 120 of the Polish Civil Code), and invoices and other accounting records for the periods required by tax and accounting law.
• Providing the data is voluntary. I need your email address to reply; your name and phone number are optional, and I use the phone number only if you prefer a call.

The incident request form on the hacked-store emergency page also asks for the store URL, what you see on the store, the platform and version, when the problem was noticed and, optionally, anything else you want to add. There the phone number is required, because an incident may need a quick call. The same purpose, legal basis and retention apply.

3.4 Spam protection on the contact form (Cloudflare Turnstile)

The contact form is protected by Cloudflare Turnstile, which loads only when you start using it. To tell people from bots, Turnstile processes your IP address, TLS fingerprint, browser user agent and the site key and origin of the form. Turnstile itself does not use cookies for this check. After a successful check, Cloudflare may set the cf_clearance cookie so that you are not challenged again on this site for a while (see section 6).

• Cloudflare processes these signals on my behalf to protect the forms. It also uses them for its own purpose of improving Turnstile’s bot detection, and for that purpose Cloudflare is a separate controller under its Turnstile Privacy Addendum.
• Legal basis: Article 6(1)(f) GDPR, my legitimate interest in protecting the form and my mailbox against spam and abuse. Reading this information from your device is strictly necessary to provide the form you have chosen to use (Article 399(3) of the Polish Electronic Communications Act).
• A submission without a successful Turnstile check is rejected. If the check does not work for you, email me directly.

3.5 Booking a meeting (Google Calendar)

The booking page (/calendar/) uses Google Calendar appointment scheduling, displayed in a frame from calendar.google.com. The frame is not loaded until you click to load it or have allowed YouTube and Google Calendar in cookie settings. You can instead open the booking page directly on Google.

When the frame loads, Google receives your IP address and technical data, may store or read information on your device, and runs Google reCAPTCHA inside the booking form to protect it against abuse. If you book a meeting, Google processes the name, email address and any other information you enter; the booking is added to my Google Workspace calendar and Google may send you a confirmation email.

• Legal basis: your consent to loading the external content, Article 6(1)(a) GDPR. For handling the booking itself, Article 6(1)(b) GDPR (steps you asked for before a possible contract) or Article 6(1)(f) GDPR (organising a meeting you asked for).
• Retention: I delete bookings and related notes within 12 months after the meeting, unless the meeting leads to a contract (then the rules in section 3.3 apply).
• Roles: I and Google are jointly responsible for collecting your data through the frame and transmitting it to Google. Google is solely responsible for what it does with that data afterwards, under its own privacy policy, in particular if you are signed in to a Google account.

3.6 YouTube videos

Some blog posts include videos hosted on YouTube. They are shown through YouTube’s privacy-enhanced mode (youtube-nocookie.com) and are not loaded until you click to load a video or have allowed YouTube and Google Calendar in cookie settings. Each video also has a direct link to YouTube.

When a video loads, Google receives your IP address and technical data, and may store or read information on your device (cookies or browser storage), especially once you play the video.

• Legal basis: your consent, Article 6(1)(a) GDPR.
• Roles: the same joint responsibility as in section 3.5 applies to loading the video.
• Withdrawal: if you withdraw consent in cookie settings, the page reloads and every video goes back to a placeholder. Withdrawal cannot erase what Google has already received or cookies stored on Google’s own domains; you can delete those in your browser.

3.7 Analytics (Google Analytics 4)

If you allow analytics, the site loads Google Tag Manager and Google Analytics 4. They record which pages you view, how you reach the site, approximate location (derived from your IP address, which Google Analytics 4 does not store), device and browser type, and interactions with the pages. Google Analytics sets the cookies listed in section 6.

I use this only to understand which content is read and to improve the site. Google Analytics is not linked to any Google Ads account, Google signals is switched off, sharing of Analytics data with Google for its other products and services is switched off, and the data is not used for advertising.

• Legal basis: your consent, Article 6(1)(a) GDPR, given in the cookie banner.
• Retention: user-level and event-level data is kept in Google Analytics for 2 months; the period restarts each time you return to the site. Aggregated, non-identifying reports are not affected by this setting. The cookies expire as listed in section 6.
• Withdrawal: open “Cookie settings” in the footer at any time. When you withdraw consent, the site deletes the Google Analytics cookies and reloads without Google Tag Manager.

4. Cookies and similar technologies

Storing information on your device, or reading it from there, is only done with your consent, unless it is strictly necessary to provide the service you have asked for (Article 399 of the Polish Electronic Communications Act, implementing the EU ePrivacy Directive).

The first time you visit, a banner lets you accept all, reject all, or choose categories. Rejecting is as easy as accepting, and the site works fully without consent. You can change your choice at any time with the “Cookie settings” link in the footer; a change is also applied to any other open tab of this site as soon as you return to it.

Your choice is stored in the lb_consent cookie on your device, together with the time you made it and the version of this banner. I do not keep a separate copy on a server. When the categories or providers change, the version changes and the banner asks you again.

You can also block or delete cookies in your browser settings.

5. Recipients of your data

The providers below act as processors (Article 28 GDPR) for the services they provide on my instructions, under their data processing terms. Where a provider also uses data for its own purposes, it does so as a separate controller, as stated in the table.

Data may also be disclosed to public authorities where the law requires it, and to my accounting office where a conversation leads to a contract.

6. Cookies in detail

Which Google cookies appear depends on your browser, whether you are signed in to Google and what you do in the frame, so I cannot give a fixed list for them. They are only possible after you load the external content.

Cloudflare may set security cookies when it needs to tell people from bots: __cf_bm (30 minutes), cf_clearance after a successful challenge or Turnstile check, and cf_chl_* while a challenge is shown (for the challenge validity period, by default 30 minutes). They are strictly necessary for security and are not used to track you across sites.

7. Transfers outside the European Economic Area

Cloudflare and Google process data in the USA or through group companies and sub-processors there. Brevo processes contact form messages in the European Union; where Brevo’s own sub-processors are outside the EEA, Brevo’s data processing agreement applies the Standard Contractual Clauses. For transfers to US companies certified under the EU-U.S. Data Privacy Framework, the provider relies on the European Commission’s adequacy decision for it. Other transfers rely on the safeguards in the relevant provider’s data processing or transfer terms, in particular the European Commission’s Standard Contractual Clauses. The terms are published by the providers: Cloudflare data processing addendum, Google data processing terms, Brevo terms of use including its data processing agreement, and the Data Privacy Framework list of certified US companies. You can ask me which mechanism applies to your data and for a copy of the relevant safeguards, using the contact details in section 1.

8. Your rights

Under the GDPR you have the right to:

• access your data and receive a copy (Article 15)
• have inaccurate data corrected (Article 16)
• have your data erased (Article 17)
• restrict processing (Article 18)
• receive your data in a portable format, where processing is based on consent or a contract (Article 20)
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Article 7(3))

Right to object. Where I process your data on the basis of my legitimate interest (sections 3.1, 3.3, 3.4 and 3.5), you can object at any time for reasons relating to your particular situation (Article 21(1)). I will then stop unless I can show compelling legitimate grounds. You can object to direct marketing at any time and without giving reasons (Article 21(2)).

To use these rights, email lukasz@lbajsarowicz.me. I reply within one month. If a request is complex and I need more time (up to two more months), I will tell you why within that first month. I ask for extra information to confirm your identity only if I have reasonable doubts about it.

You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl). If you live or work in another EU country, you can also complain to the authority there.

9. Visitors outside the European Union

The rights in section 8 are available to everyone, wherever you live. If UK data protection law applies to you, you can also complain to the Information Commissioner’s Office (ico.org.uk). Wherever you are, I do not sell personal information, do not share it for cross-context behavioural advertising, and do not use sensitive personal information to infer characteristics about you.

10. Automated decision-making and profiling

I do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.

11. Children

This site is aimed at professionals and is not directed at children under 16. I do not knowingly collect their data.

12. Security

The site is served only over HTTPS. Form data is sent over encrypted connections, form submissions are checked against spam before they are accepted, access to my accounts with the providers above is protected with strong authentication, and I limit what is collected to what each purpose needs.

13. Changes to this policy

When the site starts using a new provider or a new kind of processing, I will update this policy and change the date at the top. Earlier versions are kept in the site’s version history and are available on request. If the change affects what you have consented to, the cookie banner will ask you again.