plBook a call

Privacy policy

This document describes what happens to personal data when you use the website or contact us.

Document version: 2026-10-08

  1. §1

    Data controller

    The controller is ARTCODE ARTUR KLUZ, a sole proprietorship entered in the Polish CEIDG register, ul. Victorii 33, 05-500 Józefosław, Poland, VAT ID 8133261241, REGON 386299008. For anything concerning personal data write to [email protected] or call +48 609 059 995.

  2. §2

    Data protection officer

    No data protection officer has been appointed. None of the conditions for mandatory appointment under Art. 37(1) GDPR applies: the controller is not a public authority, its core activities do not consist of processing operations requiring regular and systematic monitoring of data subjects on a large scale, nor of large-scale processing of special categories of data. Data protection matters are handled directly by the controller, at the address in §1.

  3. §3

    What data, and where it comes from

    The free diagnostic on this website consists of five choices and calculates the result in your browser. It does not require your name, address, phone number or email address; the responses are not sent to the server. Three categories of data are processed. First, the technical data your browser sends to the server with every request: IP address, date and time, the requested address, browser type and operating system. Second, whatever you choose to write if you use the email or telephone link, in which case the data reaches the controller's mailbox and not this site. Third, only if you agree to visit statistics: the data collected by Google Analytics 4, that is a random browser identifier stored in a cookie, the pages you visit and the duration of the visit, the page you came from, device, browser and operating system type, language and an approximate location (country, region, city) derived from the IP address. According to Google, the IP address itself is not stored in Google Analytics 4.

  4. §4

    Purposes and legal bases

    Serving the site and keeping it secure - Art. 6(1)(f) GDPR, the legitimate interest in the site working and in being able to detect abuse or attack. Remembering your chosen language - Art. 6(1)(f) GDPR, the legitimate interest in showing you the site in the language you picked. Visit statistics - Art. 6(1)(a) GDPR, your consent given in the banner on this site; the same consent covers storing Google Analytics cookies on your device and reading them from it (Art. 399 of the Polish Electronic Communications Law). The purpose is to know which pages are read and where readers come from, as aggregate reports, not to assess you. Remembering your consent decision - Art. 6(1)(f) GDPR, the legitimate interest in not asking the same question on every page. Replying to a message you send - Art. 6(1)(b) GDPR where it concerns steps prior to entering into a contract, or Art. 6(1)(f) for ordinary business correspondence. No special categories of data under Art. 9 GDPR are processed.

  5. §5

    Cookies and browser storage

    The site sets one session cookie: NEXT_LOCALE, which remembers the language you chose. It expires when you close the browser. Your answer in the consent banner is kept in browser storage (localStorage) under the key artcode_consent: it holds only the choice (consent or refusal), its date and the version of the question. That entry is not a cookie and is not sent to the server with any request. If your browser blocks that storage, the decision holds only in the current tab and is not stored anywhere. The language cookie and the consent entry are strictly necessary to provide the service you asked for, so they need no consent. Google Analytics 4 cookies are set only after you consent: _ga (a random identifier telling browsers apart) and _ga_43Y3MY7PTL (the state of the current session). Without consent the Google script is not downloaded at all, so none of its cookies is created and no request goes to Google. When you withdraw consent, the site deletes these cookies and switches measurement off. There are no advertising cookies and no tracking pixels: Google's consent signals for storing and using data for advertising always stay denied.

  6. §6

    Recipients

    There is no ad network, no embedded video, map or widget. Typefaces are served from the same server as the page, so your browser never connects to Google Fonts or any other font provider. The content delivery network: the site is served through Cloudflare, Inc., which sits in front of every request and is the first to receive your IP address. The network error reporting policy it sets may cause your browser to send it a report when a connection fails; without consent to statistics, that is the only request to an external server this site can trigger. Cloudflare processes this data under its Data Processing Addendum, which forms part of its terms of service; the account is on Cloudflare's free plan, and Cloudflare publishes the current list of its sub-processors on its site. The server infrastructure: OVH Sp. z o.o., with the server in a data centre in Frankfurt, Germany, under a data processing agreement. OVH uses sub-processors to maintain and secure that infrastructure; the current list is published by OVH, and a change is notified to the controller thirty days in advance for entities in the European Union or in a country covered by an adequacy decision, ninety days otherwise, with a right to object. Visit statistics, only with your consent: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, the provider of Google Analytics 4, which processes the data as a processor under the data processing terms accepted by the controller in the service settings. Google Signals and ad personalisation are switched off in this site's configuration, so the data is neither linked to your Google account nor used for advertising. Data is not sold and is not shared for marketing. Correspondence: when you email us, we use Google Workspace for company email. Our contracting provider is Google Cloud Poland Sp. z o.o., which processes data under the Cloud Data Processing Addendum. This is separate from Google Analytics and does not depend on consent to visit statistics.

  7. §7

    Transfers outside the European Economic Area

    The server is in Germany, that is, within the European Economic Area. The data centre location is chosen when the service is ordered and the provider may not change it without the controller's consent. The processing agreement does however allow the provider and its authorised sub-processors to process content remotely where that is necessary to deliver the service, in particular for security management and for applying updates. Should such access amount to a transfer outside the European Economic Area, the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 apply, as annexed to that processing agreement. Separately: the content delivery network is established outside the European Economic Area and processes traffic at its edge nodes. The account does not include Cloudflare's Data Localization Suite (Regional Services and Customer Metadata Boundary), which is available only on higher plans, so requests may be handled at any Cloudflare edge node, including outside the European Economic Area; the transfer relies on the standard contractual clauses incorporated into Cloudflare's Data Processing Addendum. Separately, and only with your consent to statistics: Google Ireland Limited may transfer Google Analytics 4 data to Google LLC in the United States. The transfer relies on Commission Implementing Decision (EU) 2023/1795, which finds an adequate level of protection under the EU-US Data Privacy Framework, in which Google LLC participates. Separately, when handling correspondence: Google Workspace uses sub-processors also outside the EEA. According to Google, relevant transfers to the US rely on the EU-US Data Privacy Framework; other transfers requiring safeguards are governed by the CDPA, including standard contractual clauses. For information on safeguards and how to obtain a copy, contact [email protected]. Links to external services, such as the professional profile on LinkedIn, transfer nothing until you click them; once you do, that service's privacy policy applies, not this one.

  8. §8

    Retention

    Server logs - The origin server keeps no access log of visitor IP addresses: the application does not record requests, and traffic arrives through a tunnel that does not log them either. Operational technical logs (diagnostics, errors) are aggregated locally and deleted automatically after 7 days. The server's system logs, including administrative logins, are size-bounded and contain no visitor data. Visitor IP addresses are processed at the Cloudflare edge, which is covered in the CDN provider section.. Language cookie - until you close the browser. Consent entry - 12 months, after which the banner asks again; shorter if you clear your browser data first. Google Analytics cookies (_ga, _ga_43Y3MY7PTL) - 12 months from being set, not extended on later visits, or until you withdraw consent, when the site deletes them. Data in Google Analytics 4 - event-level and user-level data is deleted automatically after 2 months; aggregate statistical reports that contain no identifiers may be kept longer. Correspondence - for as long as the conversation is running and no longer than 3 years from the last contact, unless a contract is concluded, in which case statutory accounting and limitation periods apply.

  9. §9

    Your rights

    You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interest (Art. 21). You can withdraw consent to visit statistics at any time, as easily as you gave it: the “Cookie settings” button in the footer of every page opens the banner again. Withdrawal does not affect the lawfulness of processing carried out before it. To exercise any of these rights, write to [email protected]. We answer without undue delay and within one month at the latest.

  10. §10

    Complaint to the supervisory authority

    If you believe the processing of your data breaches the rules, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Moniuszki 1A, 00-014 Warsaw, Poland. You do not have to contact the controller first, although it is usually faster.

  11. §11

    Providing data is voluntary

    Providing any data is voluntary. The technical data in §3 is inherent to how HTTP works: without it the server has no way to send the page back to your browser. If you do not write, you provide no contact data and there is no consequence beyond the obvious one, that there is nothing to reply to. Consent to visit statistics is voluntary: if you do not give it, the site works exactly the same.

  12. §12

    Automated decisions and profiling

    No decisions are made by automated means, including profiling, within the meaning of Art. 22 GDPR. No system scores you on the basis of what you read on this site. Statistics from Google Analytics 4 serve aggregate reports on traffic to the site, not the assessment of individuals; Google Signals and ad personalisation are switched off.

  13. §13

    Changes

    Material changes are published on this page together with a new document version date. Earlier versions remain in the history of the repository this page is built from. Change history. Version of 30 September 2026: added visit statistics in Google Analytics 4, started only with your consent, a consent banner and a “Cookie settings” button in the footer (§3–§9, §11, §12). Version of 7 October 2026: clarified the description of the free browser-based diagnostic (§3) and updated the address of the Personal Data Protection Office (§10). Version of 8 October 2026: clarified recipients and transfers related to correspondence handled in Google Workspace (§6, §7).