Privacy policy

The controller of your personal data is Paweł Sobczak, who runs sobczakai.com.

The business is currently being registered. Once that is done, I will add the full company name, address and VAT ID here. Until then the controller remains the person named above, and every right described below applies to you in exactly the same way.

For matters concerning personal data, write to pawel@sobczakai.com.

• Contact form. Two fields are required: your name and phone number. The company and a short description of your situation are optional. Purpose: calling you back and preparing a proposal. Basis: Article 6(1)(b) GDPR - steps taken prior to entering a contract, and Article 6(1)(f) - my legitimate interest in handling the enquiry.
• Where the enquiry goes. The form is handled by a script on my own server and sent to my mailbox as an email. The site and the mailbox sit with the same provider (lh.pl), so the data passes through no external form service and no company outside that infrastructure.
• Form protection. So that nobody can flood it with a bot, the server keeps a hash of the IP address - not the address itself - for one hour. After that the record is gone. Basis: Article 6(1)(f) - legitimate interest in preventing abuse.
• Email messages. If you write to me directly, I process the data in the message: email address, name and whatever you include in the body. Purpose and basis as above.
• Server logs. The hosting company (lh.pl) records standard access logs: IP address, date and time of the request, the page requested, browser type. Purpose: keeping the site running and secure. Basis: legitimate interest.
• Visit statistics. I use Google Analytics 4, but only after you agree. What is collected: which pages you opened, approximate location (country and city derived from the IP address, which Google does not store), device and browser type, where you arrived from, and interactions with the page - scrolling, clicking an outbound link, downloading a file. There is no advertising purpose here: I want to know which texts get read. Basis: Article 6(1)(a) GDPR - your consent. You may decline and nothing on the site stops working.

On your first visit you will see a question about visit statistics at the bottom of the screen. Until you answer it, the site sets no cookie at all and loads no external script. Refusing is as easy as agreeing and limits nothing on the site.

If you agree, the Google Analytics script loads and sets two cookies: `_ga` and `_ga_` followed by the stream identifier. They tell repeat visits apart, so the same person coming back is not counted as new every time. Google states a lifetime of up to two years for them.

If you refuse, nothing happens: the Google script does not load, no cookies are created, no data leaves this server.

Your choice itself is remembered by your browser local storage, not by a cookie. The entry is never sent to the server and holds no data about you - only "yes" or "no".

To change your mind, clear this site data in your browser settings. The question will appear again, and any Google cookies set earlier disappear along with the rest of the data.

Typefaces are hosted directly on this server rather than fetched from an external service. Opening the page therefore triggers no request to third-party servers.

Data reaches only the party that runs the infrastructure: the hosting company lh.pl, whose servers host both the site and the mailbox. It operates under a data processing agreement.

Once you consent to statistics, visit data goes to Google Ireland Limited and, within its infrastructure, also to Google LLC in the United States. This is a transfer outside the European Economic Area. The basis is the European Commission adequacy decision (EU-US Data Privacy Framework), which Google has joined, together with the data processing agreement I have with Google.

I use no external form services and no advertising tools. I do not sell data and do not share it for marketing purposes. Without consent to statistics no data reaches Google - the script does not load at all.

If we start working together, billing data will additionally reach my accounting office - I will tell you about that when we sign the contract.

• Form enquiries and correspondence - 12 months from the last contact if no cooperation follows. If it does - for its duration and the period required by tax law and limitation periods.
• The hashed IP address from form protection - one hour. Then the record is deleted.
• Server logs - in line with lh.pl's policy, usually no longer than a few weeks.
• Data in Google Analytics - 14 months from the last visit. Google then deletes it automatically.
• Your remembered consent choice - until you clear this site data in your browser. The entry lives only on your device.

You have the right to access your data, to rectify, erase or restrict its processing, as well as the right to object to processing and the right to data portability.

To exercise them, a message to pawel@sobczakai.com is enough. I respond without undue delay, within one month at the latest.

If you believe I process data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.

Providing data is voluntary. Without a name and phone number you cannot submit the form, because without them I have no way to call you back. The company and the description are optional - they exist only so that I can prepare for the call.

I make no automated decisions and do not profile visitors.