Privacy and cookies

What data is used and why

• Serving and protecting the website. The server and Cloudflare handle connection data, such as IP addresses, request times, page addresses, response codes and browser information. This helps deliver the website, diagnose errors and prevent abuse. The legal basis is my legitimate interest in keeping the website secure and operational (GDPR Article 6(1)(f)).
• Correspondence. If you contact me, I use the information you provide to respond and handle your enquiry. The legal basis is my legitimate interest in answering enquiries (GDPR Article 6(1)(f)); for enquiries about entering into a contract, Article 6(1)(b) also applies. Providing your details is voluntary, but I need contact details to reply.

Cookies and browser storage

Technical Cloudflare cookies

Cloudflare security features may set cookies needed to protect the website, such as __cf_bm (up to 30 minutes of inactivity) or cf_clearance after a security check. Their use and duration depend on the security feature applied. See Cloudflare’s cookie documentation.

The website does not set cookies for advertising or visitor measurement. The cookie notice is informational: “Got it” closes it and does not give consent to tracking. You can manage cookies in your browser settings; blocking technical cookies may prevent security checks from working.

When you close the notice, I save the preference pawlas.cookie-notice.dismissed.v1 in your browser’s localStorage. It only remembers that you closed the notice, contains no user identifier and is not sent to the server. It remains until you or your browser clear the site data.

Retention

• Server logs: weekly rotation with four archives retained, usually around five weeks including the current file. Records relating to a specific incident may be kept until it is resolved or for as long as needed to establish, exercise or defend legal claims.
• Correspondence: until the matter is resolved, and longer only where needed for a contract, legal obligations or establishing, exercising or defending claims within the applicable limitation period.

Recipients and international transfers

I use Mikr.us hosting (UW-TEAM.org Jakub Mrugalski), Cloudflare, Inc. infrastructure and security, and Gmail (Google) for correspondence. These providers and their subprocessors may process data as needed to provide their services. Data may also be disclosed to authorities when legally required.

Google and Cloudflare use global infrastructure, which may involve transfers outside the European Economic Area, including to the US. Transfer mechanisms include adequacy decisions, including the EU-US Data Privacy Framework for covered organisations, or standard contractual clauses. Safeguards are described in Google’s information about data transfers and Cloudflare data processing addendum. You can also contact me for information about these safeguards.

Links to LinkedIn, Credly and other services take you to separate websites with their own privacy rules. Further information: Google privacy policy, Cloudflare privacy policy and Mikr.us privacy policy.

Your rights

Subject to the conditions in the GDPR, you can request access, rectification, erasure and restriction of processing, and data portability where processing is automated and based on a contract. You can object to processing based on legitimate interests. You may lodge a complaint with the Polish data protection authority, the President of the Personal Data Protection Office, or another competent supervisory authority: uodo.gov.pl.

I do not use website data to make automated decisions that have legal or similarly significant effects on you.