Privacy policy

This policy explains how I process personal data when you send a project inquiry or take part in a project call. The data controller is Andrzej Kobyliński. You can contact me at andrzej.kobylinski.it@gmail.com about your data or this policy.

Data submitted through the project form

The form asks for your name, email address, and a project description. You can include your business and audience, the website’s goal and current problem, links, examples, required features, timeline, or budget in the description. The name, email address, project description, and acknowledgment that you have read this policy are required. Providing this information is not a statutory obligation. Without the required fields I cannot handle an inquiry through the form, but you can still use the email address shown as the fallback contact route.

I use this information to answer your inquiry, understand the proposed project, and prepare a scope and quote. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). The required checkbox only confirms that you have read this policy. It is not consent to marketing, call recording, or any unrelated use of your data.

The form is delivered by Web3Forms, operated by Web3Creative as my processor. It processes the submitted fields and relevant technical metadata such as the IP address and submission timestamp, and may use spam-prevention subprocessors where applicable. Web3Creative operates from India and may process data there or in other third countries under Standard Contractual Clauses. Its processor copy has a maximum three-year time-to-live and may be deleted earlier. See the current Web3Forms Data Processing Agreement and Privacy Policy. Providers needed to operate the website, form, and email may also process only the data necessary to provide those services. Data may also be disclosed to professional advisers or public authorities where this is necessary and permitted or required by law.

Project calls, recordings, and notes

I record a call only after asking for your explicit consent before recording begins. If you consent, the recording may be transcribed automatically and used to prepare project notes and documentation. The legal basis for the recording and transcription is your consent (Article 6(1)(a) GDPR). You may refuse or withdraw consent without any adverse effect on whether we can discuss or carry out the project; I will take notes manually instead. Withdrawing consent does not affect processing that took place before it was withdrawn.

I do not currently name a recording or transcription provider because none has been selected for this process. Before using such a provider, I will identify it, explain any relevant data-transfer safeguards, and update this policy. Only data needed to prepare the agreed notes and documentation will be shared.

I delete a call recording after the project specification has been accepted, unless a different lawful and disclosed reason requires it to be kept longer. Project notes and accepted documentation may be retained for the periods described below.

How long I keep data

I delete inquiries that do not lead to a project 12 months after the last contact. If a project is accepted, I retain correspondence and project records for as long as needed to perform and document the contract (Article 6(1)(b) GDPR), meet applicable legal and accounting obligations (Article 6(1)(c) GDPR), and establish, pursue, or defend legal claims where my legitimate interests justify this (Article 6(1)(f) GDPR). Data that is no longer needed for those purposes is deleted.

Your rights

Depending on the legal basis and circumstances, you may request access to your personal data, its correction or deletion, restriction of processing, or data portability. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw that consent at any time.

To exercise a right, email andrzej.kobylinski.it@gmail.com. I may ask for information needed to confirm your identity. If you believe your data has been processed contrary to the GDPR, you may lodge a complaint with the President of the Personal Data Protection Office (UODO), Poland’s supervisory authority.