Privacy & CookiesPolicy

The controller of your personal data is KUANDO Dawid Maroszek, ul. Towarowa 23, 43-100 Tychy, Poland, NIP (tax ID): 6381833420, REGON: 369618151, hereinafter the “Controller”.

For matters related to privacy and data processing you can contact the Controller:

• by email: dawid@maroszek.design;
• by post: KUANDO Dawid Maroszek, ul. Towarowa 23, 43-100 Tychy, Poland.

This policy applies to the website available at https://maroszek.design, hereinafter the “Site”.

The Site is informational and presents the Controller’s work and portfolio. It does not allow creating an account, making a purchase, subscribing to a newsletter, or submitting data through a contact form.

While you use the Site, the following may be processed:

• the device IP address;
• the date and time of connection;
• information about the browser, operating system, and device type;
• approximate location determined from the IP address;
• information about how the Site is used, such as pages visited, time of visit, and referral source;
• identifiers stored in cookies;
• data contained in a message, if you voluntarily contact the Controller by email.

Ensuring the operation and security of the Site

Technical data, including the IP address and information recorded in server logs, may be processed in order to:

• display the Site correctly;
• ensure its security;
• detect errors and unauthorised access attempts;
• prevent abuse;
• establish, pursue, or defend claims.

The legal basis is Article 6(1)(f) GDPR — the legitimate interest of the Controller in ensuring the secure and correct operation of the Site and in protecting its rights.

Data recorded in server logs is stored for a period resulting from the hosting provider’s configuration and rules, and no longer than necessary to achieve the stated purposes.

Handling email correspondence

If you contact the Controller by email, the data contained in your message will be processed in order to reply and conduct correspondence.

The legal basis is:

• Article 6(1)(b) GDPR — where the contact is aimed at concluding or performing a contract;
• Article 6(1)(f) GDPR — in other cases, as a legitimate interest in conducting correspondence and handling enquiries.

Correspondence will be stored for the time needed to conclude the matter and may then be archived until the relevant limitation period for claims expires. Messages of no relevance to potential claims may be deleted earlier.

Providing data in a message is voluntary but may be necessary in order to receive a reply.

Visit analytics

The Site uses Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics helps obtain aggregate information about how the Site is used, including:

• the number of users and sessions;
• the pages visited;
• the approximate geographic area;
• the sources of entry to the Site;
• the device, operating system, and browser type;
• the time and manner of using the Site.

Google Analytics is activated only after consent to analytics cookies has been given. The basis for processing is Article 6(1)(a) GDPR, and access to information stored on the device takes place in accordance with Article 399 of the Electronic Communications Law.

A lack of consent to analytics does not limit your ability to use the Site.

User-level and event data in Google Analytics is retained for 2 months, in line with the service setting. This setting need not cover standard reports containing aggregated data, which do not allow the Controller to identify a user directly.

More information about how Google processes data can be found in Google’s privacy policy: https://policies.google.com/privacy?hl=en

Cookies are small pieces of information stored on your device while you use the Site.

The Site may use:

• essential cookies — needed for the correct operation of the Site, its security, or to store your cookie choice;
• analytics cookies — used by Google Analytics to build visit statistics.

Essential cookies may be used without consent where they are necessary to provide the service you request. Analytics cookies are activated only after prior consent has been given.

Google Analytics cookies

The final part of the second cookie’s name depends on the Google Analytics property identifier assigned to the Site.

In addition to the above, the Site may store a technical file or browser-storage entry used to remember your cookie decision. It is essential in order to honour the choice you made.

On your first visit to the Site you can:

• accept analytics cookies;
• reject analytics cookies;
• read information about the technologies used.

Optional cookies are neither pre-ticked nor activated by default. Closing the notice without making a choice does not mean consent.

Consent can be withdrawn or changed at any time via the “Cookie settings” link available in the Site’s footer. Withdrawing consent should be as easy as giving it.

Withdrawing consent does not affect the lawfulness of processing carried out before it was withdrawn.

Cookies can also be deleted or blocked in your browser settings. Blocking all cookies, including essential ones, may affect the correct operation of some parts of the Site.

The Site uses Open Graph tags. These are pieces of information placed in the Site’s code that define, among other things, the title, description, and image shown when a link is shared on social media or messengers.

The Open Graph tags themselves do not store cookies, do not track you, and do not cause your personal data to be transferred to the Controller.

Once a link to the Site is shared, the external service may fetch the indicated metadata and process your data in accordance with its own privacy policy. The Controller does not control the data-processing rules applied by such services.

Data may be transferred to entities that support the Controller in maintaining the Site, in particular:

• hosting and server infrastructure providers;
• email service providers;
• IT service providers;
• Google Ireland Limited — after consent to Google Analytics;
• law firms or other professional advisers, where necessary;
• public authorities, where the obligation to disclose data follows from the law.

Entities processing data on the Controller’s behalf act under appropriate agreements and in line with the instructions received, unless, to a defined extent, they are separate data controllers.

In connection with the use of Google Analytics, data may be processed by Google companies or infrastructure located outside the European Economic Area, in particular in the United States.

Google declares that it applies the mechanisms provided for by the GDPR, including the European Commission’s decision on the EU–US Data Privacy Framework for certified recipients, and the European Commission’s standard contractual clauses where required.

Information on the transfer mechanisms applied by Google can be found at: https://policies.google.com/privacy/frameworks?hl=en

Under the terms set out in the GDPR, you have the right to:

• access your data and obtain a copy of it;
• rectify inaccurate data;
• erase your data;
• restrict processing;
• data portability — where processing is based on consent or a contract and is carried out by automated means;
• withdraw consent at any time;
• object to processing based on the Controller’s legitimate interest.

These rights are not absolute. In certain cases the law may permit or require the Controller to continue processing part of the data.

To exercise your rights, send a message to dawid@maroszek.design or write to the Controller’s registered address.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) if you believe your data is being processed unlawfully. Detailed information is available at https://uodo.gov.pl.

The Controller does not make decisions about users based solely on automated processing that would produce legal effects or similarly significantly affect them.

The Controller does not use Google Analytics data to make such decisions.

The Controller applies technical and organisational measures appropriate to the nature of the data processed and the related risk. These include, in particular, encryption of the connection to the Site, access control, keeping software up to date, and securing administrative accounts.

The Site may contain links to external sites and services. Once you go to such a site, the privacy rules set by its operator apply. The Controller is not responsible for how external services process data.

The policy may be updated where the law, the way the Site operates, or the services used change.

The current version of the policy is published on the Site together with the date of the last update. If a change requires new consent, you will be asked to make a choice again.