Privacy Policy

Controller

The controller responsible for data processing on this website is:

Dawid Aleksander Walczak
ul. Wielkopolska 298/28
81-531 Gdynia
Poland
Email: contact (at) dawid-aleksander-walczak (dot) com

Overview

This website is a static publication and collects as little data as possible: its own pages set no tracking cookies, run no analytics, and display no advertisements, and its contact page only opens a new message in your own email program. The one exception is the newsletter, which beehiiv provides: the sign-up form on this website's newsletter page and at the end of each article loads from beehiiv's servers, and the newsletter's own website at newsletter.dawid-aleksander-walczak.com is operated by beehiiv; both set cookies of beehiiv's services, as described below. The processing that does take place — delivery through a content delivery network, hosting server logs, a locally stored theme preference, the handling of any email you choose to send me, and the newsletter — is described below, together with its purpose and legal basis, followed by the advertising disclosures that will apply once advertising is enabled on this website.

Hosting and Server Log Files

This website is hosted on the Microsoft Azure platform. When the website is visited, the hosting provider may automatically collect certain technical data, such as the IP address of the accessing device, the date and time of access, and other technical data required to ensure the operation of the website. This data is used solely to ensure trouble-free operation and for error analysis, and is not merged with other data sources. The legal basis for this processing is Article 6(1)(f) GDPR: my legitimate interest in the secure and reliable operation of this website. Further detailed information about the data collected by the hosting provider, including its retention, can be found in the Microsoft privacy statement(opens in a new tab).

Content Delivery Network (Cloudflare)

Requests to this website do not reach the hosting platform directly. They are routed through the content delivery and security network operated by Cloudflare, Inc., 101 Townsend Street, San Francisco, California 94107, USA ("Cloudflare"), which terminates the encrypted connection at the location nearest to you. Cloudflare therefore processes the IP address of the accessing device, the requested address, the user agent, and the time of the request, in order to deliver this website, cache files at the edge, and protect it against attack and abuse. Your browser is additionally instructed to report failed connections — not successful ones — to Cloudflare's network error logging endpoint. No cookies are set for any of this. The legal basis is Article 6(1)(f) GDPR: my legitimate interest in the secure, reliable, and fast delivery of this website. Cloudflare may process this data on servers in the United States; Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework and, where a certification does not apply, relies on the European Commission's standard contractual clauses. Further information can be found in the Cloudflare privacy policy(opens in a new tab).

Theme Preference (Local Storage)

If you switch between the light and dark theme, your choice is stored in your browser's local storage under the key theme. This value never leaves your device, contains no personal data, and is used exclusively to apply the preference you explicitly set. You can remove it at any time by clearing this site's browsing data, after which the site follows your operating system's colour-scheme preference again.

Contact by Email

You can write to me at the email address given in the Controller section, either directly or by using the button on this website's contact page. The button only opens a new message in the email program on your own device, with my address and a subject line filled in: this website neither receives nor transmits anything you write, and the button stores nothing on your device. If your browser passes email links to a web-based email service, that service opens the message instead, as your email provider.

When you write to me, I process the personal data your message contains — your email address, your name if you give it, the content of your message, and any attachments — together with the technical information your email provider adds to it, such as the time of sending and the mail servers the message passed through. I use this data solely to read and answer your enquiry and any follow-up questions, and it is not merged with other data sources. Writing to me is voluntary, but without this data I cannot reply.

Where you write on your own behalf about a possible contract with me — for example, to propose a collaboration — the legal basis is Article 6(1)(b) GDPR: steps taken at your request prior to entering into a contract. In all other cases, including when you write on behalf of a company or another organisation, the legal basis is Article 6(1)(f) GDPR: my legitimate interest in answering the messages sent to me. Where your email is a request to exercise the rights described below, I process it to comply with my legal obligation to answer that request (Article 6(1)(c) GDPR).

Email sent to this website's domain is received by Cloudflare's email routing service, which checks the sender's authentication, screens the message for spam, and forwards it to my mailbox. Cloudflare does not store the body or the attachments of your message; it keeps a delivery record — the sender's name and address as they appear in the message, the recipient address, the subject line, the message identifier, the time, the results of its authentication and spam checks, and the delivery status — for 31 days, and it may process this data in the United States under the safeguards described in the Content Delivery Network section above. My mailbox is a Gmail account provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google stores your message and my replies to it, processes them under its own terms of service and the Google Privacy Policy(opens in a new tab), and may process them on servers in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework. I do not pass your message on to anyone else unless you ask me to or I am legally required to. Email is not end-to-end encrypted, so please do not send me sensitive information, such as health data, by email.

I delete your correspondence once your enquiry has been dealt with, and no later than twenty-four months after your last message or my last reply, whichever is later, unless a longer period applies: correspondence that leads to a contract is kept until claims arising from that contract are time-barred, because I may need it to establish, exercise, or defend them; correspondence about a data protection request is kept until the end of the third calendar year after the request was concluded, so that I can demonstrate how I handled it.

You can subscribe to my newsletter on this website's newsletter page, at the end of each article, or on the newsletter's own website. The sign-up form, that website and the newsletter are provided by beehiiv Inc., 228 Park Avenue S #2329976, New York, NY 10003, USA ("beehiiv"), which processes subscriber data on my behalf under a data processing agreement (Article 28 GDPR).

The sign-up form is not part of this website: it is a page served by beehiiv and shown in a frame, which your browser loads from beehiiv's servers — on the newsletter page as it opens or as you scroll towards the form, depending on your browser, and on an article as you scroll towards its end. When it loads, beehiiv receives your IP address, your browser's user agent, the time of the request, the address of the page you are reading, and — where you reached this page through a link carrying campaign parameters (utm_source, utm_medium, utm_campaign) or from another website — those parameters or that website's host name, so that I can see which pages and sources bring subscribers. The form page in turn loads services beehiiv uses, each of which receives your IP address when your browser requests it: bot and fraud protection by HUMAN Security, Inc., 841 Broadway, New York, NY 10003, USA, which also receives the form page's address (and with it the details above), characteristics of your browser and device, and a visitor identifier; web fonts and Google Tag Manager from Google; and a program library from the JSPM content delivery network. To protect the form against automated sign-ups, HUMAN Security and Cloudflare (beehiiv's content delivery network) store cookies and identifiers in your browser under beehiiv's domain: two identifiers, _pxvid and cf_clearance, that last one year, the short-lived cookies _px3, pxcts and __cf_bm, and further entries in the frame's local and session storage. This website itself sets no cookie and stores nothing for the newsletter. The legal basis for showing the form is Article 6(1)(f) GDPR: my legitimate interest in offering readers a way to subscribe — on the page dedicated to the newsletter, and at the point where they finish reading an article.

The newsletter's own website at newsletter.dawid-aleksander-walczak.com is operated by beehiiv. When you open it, beehiiv's bot protection sets the same cookies for the whole dawid-aleksander-walczak.com domain — _pxvid and cf_clearance for one year, _px3 and pxcts briefly — so your browser also sends them to this website, which neither reads nor uses them. That website also sets beehiiv's own cookies and storage, for example for your language and your visit, and loads further services beehiiv uses to run it; the beehiiv privacy policy linked below describes beehiiv's processing.

If you subscribe, beehiiv processes the email address you enter, the time of your sign-up, and the details described above, and sends you an email asking you to confirm your subscription. With each newsletter, beehiiv records whether you open it and which links you click, and I use this to see which topics are useful to readers. The legal basis is your consent under Article 6(1)(a) GDPR. You can withdraw it at any time with effect for the future, through the unsubscribe link in every newsletter or by writing to me. Your address and the records of your opens and clicks are kept for as long as you are subscribed. After you unsubscribe, beehiiv keeps only your address, marked as unsubscribed, so that you receive no further newsletters; the legal basis for this record is Article 6(1)(f) GDPR, my legitimate interest in honouring your withdrawal, and I delete it entirely when you ask me to.

beehiiv and HUMAN Security process data in the United States, as may the operator of the JSPM content delivery network. beehiiv is not certified under the EU-U.S. Data Privacy Framework; its transfers rely on the European Commission's standard contractual clauses, which form part of its data processing agreement. HUMAN Security is not currently certified under the EU-U.S. Data Privacy Framework. Google may process data in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework. Further information can be found in the beehiiv privacy policy(opens in a new tab).

Advertising (Google AdSense)

This website is prepared for monetisation through Google AdSense, an advertising service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). No advertisements are served at present, and no advertising cookies are set. Once advertising is enabled on this website, the following applies:

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. In the course of ad serving, third parties may also place and read cookies in your browser, or use web beacons or IP addresses to collect information.
Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet.
You may opt out of personalised advertising by visiting Google's Ads Settings(opens in a new tab). Alternatively, you can opt out of some third-party vendors' use of cookies for personalised advertising by visiting www.aboutads.info/choices(opens in a new tab) or, for readers in the European Union, www.youronlinechoices.eu(opens in a new tab).
How Google uses the data it collects on this website is described in How Google uses information from sites or apps that use our services(opens in a new tab) and in the Google Privacy Policy(opens in a new tab).

If you are located in the European Economic Area, the United Kingdom, or Switzerland, advertising that stores or accesses information on your device or processes your personal data will only be served if you have given prior affirmative consent. A consent banner (a Google-certified consent management platform integrated with the IAB Europe Transparency and Consent Framework) will be presented to you before any advertising scripts or processing that access your device or process personal data for advertising are initiated. If you refuse or withhold consent, no cookies or local storage requiring consent will be stored on or read from your device, and personalised advertising will not be served.

The legal basis for storing or accessing information on your terminal device — including cookies and device identifiers used by Google and third-party vendors for ad serving, reporting, and frequency capping (which applies to non-personalised advertising as well) — is your consent under Article 399(1)(2) of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej, implementing Article 5(3) of Directive 2002/58/EC). The legal basis for processing your personal data for personalised advertising (profiling and targeting based on your browsing activity across websites) is your consent under Article 6(1)(a) GDPR. You will be able to change or withdraw your consent at any time with effect for the future through the consent preferences on this site, with withdrawal being as easy as giving consent. Google may transfer data to servers in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework.

Your Rights

Under the GDPR you have the right of access to the personal data concerning you (Article 15 GDPR), and the rights to rectification (Article 16), erasure (Article 17), and restriction of processing (Article 18). Where processing is based on your consent, you may withdraw that consent at any time with effect for the future; the lawfulness of the processing carried out before the withdrawal is unaffected.

The right to data portability (Article 20) covers the personal data you have provided yourself, and applies only where the processing is based on your consent or on a contract and is carried out by automated means. It therefore does not extend to the hosting and content delivery network log data described above, which is processed on the basis of my legitimate interest rather than consent or a contract. Of the email correspondence described above, it covers the messages you sent me on your own behalf about a possible contract with me, but not correspondence I handle on the basis of my legitimate interest or a legal obligation. It does cover your newsletter subscription — the data you provided when signing up and the records of your use of the newsletter — processed on the basis of your consent.

Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you that is based on my legitimate interest under Article 6(1)(f) GDPR (Article 21(1) GDPR). On this website that is the hosting and server log processing, the content delivery network processing, the loading of the newsletter sign-up form from beehiiv's servers, and the handling of email correspondence where it rests on my legitimate interest, all described above. The right does not reach your newsletter subscription or the advertising processing described above, whose legal basis is your consent rather than a legitimate interest — there, the equivalent step is the withdrawal of consent: the unsubscribe link in every newsletter, and the consent preferences described in the advertising section.

Describe the particular situation you are relying on, so that it can be weighed against the grounds for the processing. Following an objection I will no longer process the personal data concerned, unless I can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or unless the processing is necessary for the establishment, exercise, or defence of legal claims. Because the log data described above exists to keep this website secure and available, such grounds can apply to part of it; where they do, I will tell you which grounds and why, and where they do not, the processing of your data stops. An objection to the handling of your email correspondence ends it: I will delete that correspondence unless I need it for the establishment, exercise, or defence of legal claims.

How to Exercise These Rights

Address any request or objection to me as the controller — by email to contact (at) dawid-aleksander-walczak (dot) com or by post to the address given in the Controller section at the top of this page. No particular form or wording is required. I will respond without undue delay and in any event within one month of receiving your request. Where a request is complex or where you have made a number of requests, that period may be extended by up to two further months; if an extension is necessary, I will inform you of it, and of the reasons for it, within one month of receiving your request.

You also have the right to lodge a complaint with a supervisory authority; in Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych(opens in a new tab)).

Changes to This Privacy Policy

I update this privacy policy whenever the website's data processing changes — for example, when new features or legal requirements make it necessary. The current version is always available on this page, and the date it was last changed is shown beneath the heading above.