Privacy policy

1. Data controller

The controller of your personal data is AKM — Architekt Kamil Mazur, sole proprietorship registered in Poland.

Tax ID (NIP): 6332225347

Statistical ID (REGON): 364531853

Address: ul. Folwarecka 82D, 44-240 Żory, Poland

Contact: [email protected]

For matters related to personal data processing, contact the Controller directly at the email above. No Data Protection Officer has been appointed — it is not required given the scale and nature of operations.

2. Purpose and legal basis of processing

The data you provide via the contact form (name, email, optional phone number, message content, inquiry type) is processed to:

a) reply to your inquiry and conduct correspondence — legal basis: Article 6(1)(f) GDPR (legitimate interest of the Controller in handling inquiries received via the website);

b) take steps prior to entering a potential consulting services agreement — legal basis: Article 6(1)(b) GDPR;

c) send an automated confirmation that your message has been received (autoresponder) — legal basis: Article 6(1)(f) GDPR.

The „phone” field is optional. The „name”, „email”, „inquiry type” and „message” fields are required for the Controller to respond — without them, contact is not possible.

3. Recipients of data

Your data may be transferred to the following data processors:

• Resend, Inc. (USA) — transactional email delivery service; transfer basis: Standard Contractual Clauses (SCC) approved by the European Commission and a Data Processing Agreement (DPA);

• Cloudflare, Inc. (USA) — operator of Turnstile (form anti-bot protection) and network infrastructure (DNS, edge cache); transfer basis: SCC + DPA;

• VPS infrastructure host (European operator, EEA) — runs the application and stores technical logs.

Data is not sold, shared with third parties for marketing purposes, or used for profiling.

4. International data transfers

Some service providers (Resend, Cloudflare) are located in the United States. Transfers are based on Standard Contractual Clauses (SCC) approved by the European Commission decision 2021/914, supplemented by a transfer impact assessment (TIA) per the Schrems II guidelines.

Resend and Cloudflare are participants in the EU–US Data Privacy Framework, providing an additional legal basis for the transfer.

You may request a copy of the safeguards used by writing to [email protected].

5. Storage period

Email correspondence resulting from the contact form is retained until the matter is resolved and for a maximum of 12 months from the last contact — then deleted from the mail system.

Server access logs (IP address, user-agent, request time) are rotated after 7 days. Basis: Article 6(1)(f) GDPR (legitimate interest — system security).

Email delivery logs at Resend are retained per Resend's policy (typically 30 days).

If correspondence leads to a contract, data will be processed for the duration necessary to perform and settle the contract and until the limitation periods for claims expire (typically 6 years per Polish tax and civil law).

6. Your rights

Under the GDPR, you have the following rights:

• right of access (Art. 15) — obtain a copy of your data;

• right to rectification (Art. 16) — request correction of inaccurate data;

• right to erasure („right to be forgotten”, Art. 17) — request deletion in cases provided by the GDPR;

• right to restriction of processing (Art. 18);

• right to object to processing based on legitimate interest (Art. 21);

• right to data portability (Art. 20);

• right to withdraw consent at any time (where processing was based on consent) — without affecting the lawfulness of processing prior to withdrawal.

To exercise rights: write to [email protected]. I will respond within 30 days.

7. Complaint to the supervisory authority

If you believe processing of your data violates the GDPR, you have the right to lodge a complaint with the President of the Personal Data Protection Office:

Urząd Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland — www.uodo.gov.pl

8. Cookies and server logs

akm-dev.pl does not use analytics, marketing, or tracking cookies. There is no Google Analytics, Meta Pixel, Hotjar, or similar tools.

Cloudflare Turnstile (form anti-bot protection) may use a technical browser fingerprinting mechanism in some scenarios — without storing marketing cookies. This is necessary for the security feature to function.

Cloudflare, as DNS and CDN operator, processes technical traffic information (IP address, browser type) on its own legitimate interest basis (security and content delivery performance).

9. Data security

Data submitted via the contact form is protected by TLS (HTTPS) with a Let's Encrypt certificate. Communication with Resend and Cloudflare uses encrypted channels.

The Controller applies organizational and technical security measures proportionate to the risk, including: limited mailbox access, multi-factor authentication, regular software updates, infrastructure isolation.

10. Policy changes

This policy may be updated. Each change is published on this page with the current effective date (shown at the top of the document). Previous versions are available on request.