This policy explains what personal data we process when you visit chris-wozniczek.dev, send us an enquiry or work with us, why we do it, and what rights you have. We keep it short because we collect very little: no cookies, no analytics, no ads, no tracking.
1. Who we are
The controller of your personal data is Krzysztof Woźniczek - IT services, a sole trader registered in Poland and trading as Chris Wozniczek Studio, ul. Graniczna 2ea/19, 54-610 Wrocław, Poland, NIP (tax ID) 6391914982.
For anything about your data, write to [email protected]. We have not appointed a data protection officer; Chris handles these requests personally.
2. What we process and why
Visiting the website. The site is hosted on Cloudflare. To deliver pages and protect the site from attacks, Cloudflare processes technical data such as your IP address, browser and device type, the page requested and the time. We don't use this data to identify you. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
- Browser storage. We store one flag in your browser's session storage so the intro animation plays only once per visit. It contains no personal data and is deleted when you close the tab. We use no cookies.
Enquiries and the quote form. When you send the quote form, or email us directly, we receive your name, email address, company or website, what you need, budget, timeline and whatever you tell us about the project. The form sends your message to our studio inbox by email (through OpenMail), with a copy to the mailbox our AI assistant uses, and sends you an automatic confirmation to the address you gave. Before sending, Cloudflare Turnstile checks that the request comes from a person and not a bot; to do that, Cloudflare processes technical data about your browser and device. We use your enquiry to reply, prepare a quote and talk about the work. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and, where you write on behalf of a company, our legitimate interest in replying to business enquiries (Art. 6(1)(f) GDPR).
Client projects. If we work together, we process the contact details of the people we deal with at your company, project correspondence, and billing details. Legal bases: performance of the contract (Art. 6(1)(b) GDPR), legal obligations under Polish tax and accounting law (Art. 6(1)(c) GDPR), and legitimate interest in managing the business relationship and handling any claims (Art. 6(1)(f) GDPR).
Our AI assistant. The studio works with an AI assistant (Devin, by Cognition). It may read enquiries and project correspondence in order to draft replies, quotes and code. Every message that goes out is reviewed by Chris, and emails drafted by the assistant say so. We make no decisions about you based solely on automated processing.
3. Who receives your data
We use a small number of service providers who process data on our behalf and under our instructions:
- Cloudflare, Inc.: website hosting, content delivery, security and spam protection for the quote form (Turnstile).
- Google: email for [email protected].
- Cognition AI, Inc.: the Devin AI assistant.
- OpenMail (UAB All Systems Operational, Lithuania): delivery of quote-form messages and confirmations, and the mailbox our AI assistant uses for studio correspondence.
- GitHub, Inc.: private repositories for project code and internal project notes.
- For clients only: inFakt (Polish invoicing and the national e-invoicing system KSeF), Stripe (card payments), Revolut Business (banking), and our accountant.
We may also disclose data where the law requires it, for example to tax authorities. We never sell personal data and never share it for advertising.
4. Transfers outside the EEA
Some of these providers are based in, or use servers in, the United States and other countries outside the European Economic Area. Where that happens, the transfer relies on the EU–US Data Privacy Framework for certified providers, or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.
5. How long we keep it
- Enquiries that don't become a project: up to 12 months after our last contact, then deleted.
- Project correspondence and contact details: for the duration of the work and up to 3 years afterwards, which is the general limitation period for business claims under Polish law.
- Invoices and accounting records: 5 years from the end of the year in which the related tax became due, as Polish tax law requires.
- Cloudflare and Google technical logs: according to their own retention periods, which are short and outside our control.
6. Your rights
You have the right to access your data, correct it, have it deleted, restrict or object to its processing, and receive it in a portable format, under the conditions in the GDPR (and the UK GDPR, if you are in the UK). To use any of these rights, write to [email protected]. We reply within one month.
You can also complain to a data protection authority. In Poland that is the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl). In the UK it is the Information Commissioner's Office (ico.org.uk). You can also contact the authority where you live or work.
Giving us your data is voluntary, but without an email address we can't reply to an enquiry, and without billing details we can't work together.
7. Changes
If the way we handle data changes, we'll update this page and the date at the top.