Last updated: August 29, 2026
Who is responsible for your data
The controller of personal data collected through this site is Paweł Neścior ("we", "us", "the operator").
For anything to do with personal data, write to kontakt@pawelnescior.pl.
This policy covers pawelnescior.pl and nothing else. There is no shop, there is no account to create, and you need give us nothing at all in order to read the site.
What we collect
We ask you for nothing. Some information comes into being by itself the moment your browser fetches a page:
- Technical data recorded by the server: your IP address, the date and time of the request, the page requested, the referring page, and your browser name and version.
- Visit statistics — only with your consent: which pages are read and for how long, from which country and kind of device. Google stores a random identifier in your browser to do it.
- Your answer to the cookie question: the decision itself, when you gave it, and which version of the question it answered. It stays in your browser’s local storage and is never sent anywhere.
- The content of any message you send us, together with the email address or phone number it came from.
We build no profiles, we make no automated decisions about you, and we sell your data to nobody.
Why we hold it, and on what basis
Each of the purposes above has its own legal basis under the GDPR:
- Serving the site and keeping it secure — our legitimate interest (Art. 6(1)(f) GDPR) in running a working site that resists abuse.
- Visit statistics — your consent (Art. 6(1)(a) GDPR). Without it Google’s script is never even fetched.
- Replying to your message — our legitimate interest (Art. 6(1)(f) GDPR), and where your enquiry concerns an offer, steps taken before entering into a contract (Art. 6(1)(b) GDPR).
You can withdraw consent at any time, without giving a reason. Withdrawal does not undo what happened before it, but from that moment nothing further is collected.
Who else sees it
We neither sell nor trade data. We do use services that process it on our behalf:
- Google Ireland Limited (and Google LLC) — hosting, database and files: Firebase Hosting, Cloud Firestore, Cloud Storage. Server logs go there, and so do the photographs.
- Google Ireland Limited (and Google LLC) — Google Analytics 4, only with your consent.
Google may process data outside the European Economic Area, including in the United States. Such transfers rest on the European Commission’s adequacy decision (the EU–US Data Privacy Framework) and on standard contractual clauses.
There are no adverts and no ad networks on this site. Google’s advertising consent signals are held denied for every visitor and there is no way to turn them on.
How long we keep it
- Server logs — up to 30 days, per Google Cloud’s defaults.
- Google Analytics data — at most 14 months from your last visit.
- The record of your consent — 12 months, after which we ask again. You can remove it sooner by clearing this site’s data in your browser.
- Correspondence — as long as it takes to deal with the matter, and afterwards until any related claims are time-barred.
Your rights
In respect of your data you have the right:
- to see it and to receive a copy,
- to have anything inaccurate or incomplete corrected,
- to have it erased (the "right to be forgotten"),
- to ask us to restrict how it is processed,
- to have it moved to another controller,
- to object to processing based on our legitimate interest,
- to withdraw consent at any time, as easily as you were asked for it.
To exercise any of them, simply write to us. We answer within a month; if the request turns out to be a complicated one we will tell you so, and it may take up to three.
If you believe we are handling your data unlawfully, you may lodge a complaint with the supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa.
Children
This site is not directed at children and we do not knowingly collect data from anyone under 16. If you are a parent or guardian and believe your child has given us their data, write to us and we will delete it.
Security
The site is served over HTTPS only and hosted on Google Cloud infrastructure. Its public half has no login and no forms, so there is no account here for anyone to take over. The panel where its content is edited is a separate application, open only to named accounts.
Links to other sites
You will find links here to sites we do not run — social networks, industry associations, our partners. This policy stops applying the moment you follow one. We are not responsible for what happens on the other side, and it is worth reading their privacy policy too.
California residents
If you live in California, the CCPA (as amended by the CPRA) gives you these further rights:
- to know which categories of data we collect, for what purpose, from which sources, and with whom we share them,
- to access the specific pieces of data we hold about you,
- to request their deletion,
- to request their correction,
- to equal service — exercising any of these rights costs you nothing here.
We do not sell personal information, and we do not share it for cross-context behavioural advertising within the meaning of the CCPA. We never have.
We honour the Global Privacy Control signal. If your browser sends it we treat it as a refusal and analytics never starts — wherever in the world you are. You can override it with an explicit choice in the cookie settings.
We respond to CCPA requests within 45 days.
Changes to this policy
If what the site does changes, this policy changes with it — the date at the top always says when it last did. Where the change touches what the cookie banner asks, we will ask you again: an answer to the old question is not an answer to the new one.
Contact
A question about any of the above, or want to exercise one of your rights? Write or call — you will reach the same person who runs the business.