Privacy policy

This document explains how personal data of visitors to dawidrylko.com is processed. The cookies themselves, with their names and retention periods, are listed in the separate Cookie policy. Polish version of this document: Polityka prywatności.

The site is operated from Poland, so it follows the GDPR together with the Polish Prawo komunikacji elektronicznej, which requires prior consent for anything stored on your device and grants analytics no exemption.

Data controller

The controller is Dawid Ryłko. For anything concerning personal data, write to hello@dawid.dev.

No data protection officer has been appointed, as none of the conditions in art. 37 GDPR apply.

What is processed

The site has no forms, no accounts, no comments and no newsletter. Three categories of data are involved.

Server log data, including your IP address, browser type and request time, recorded by the hosting provider to deliver and protect the site. Legal basis: legitimate interest, art. 6(1)(f) GDPR.
Usage data, meaning the pages you open and the page performance metrics, processed in Google Analytics 4 only after you consent. Legal basis: consent, art. 6(1)(a) GDPR and art. 399(1) of the Prawo komunikacji elektronicznej.
Correspondence, if you write to the address above. The scope is whatever your message contains. Legal basis: legitimate interest in handling correspondence, art. 6(1)(f) GDPR, or steps before entering a contract where the exchange is about working together, art. 6(1)(b) GDPR.

Providing data is voluntary. Refusing analytics limits nothing on the site.

Recipients

GitHub, Inc. as the provider of GitHub Pages hosting. It processes the log data described above regardless of consent, because without it the page cannot be delivered to your browser.
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as the provider of Google Analytics 4. It receives data only from visitors who consented to analytics. Without consent the Google script is not loaded at all and your browser sends Google no request.

Data is never sold or shared for marketing. The site loads no advertising scripts.

Transfers outside the European Economic Area

Both recipients belong to United States groups, so data may be transferred to the USA. Transfers rely on the European Commission implementing decision of 10 July 2023 on the adequate level of protection under the Data Privacy Framework, and, where that decision does not apply, on the standard contractual clauses approved by the Commission.

United States law gives its authorities broader access to data than European Union law does. Without consent to analytics, no data reaches Google.

Retention

Analytics cookies: 13 months from the moment they are written to your device.
The record of your consent decision: 13 months, after which the site asks again.
Event data in Google Analytics 4: as configured by the property data retention setting, no longer than 14 months, which is the maximum for standard Google Analytics.
Server logs: according to the hosting provider policy.
Email correspondence: until the matter is closed, then for the limitation period of any related claims.

Your rights

You have the right to:

access your data and obtain a copy of it, art. 15 GDPR,
have it corrected, art. 16 GDPR,
have it erased, art. 17 GDPR,
restrict processing, art. 18 GDPR,
data portability for data processed on consent, art. 20 GDPR,
object to processing based on legitimate interest, art. 21 GDPR,
withdraw consent at any time, art. 7(3) GDPR. The Cookie settings button in the footer of every page does exactly that. Withdrawal does not affect the lawfulness of processing carried out beforehand.

You may also lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.

Profiling and automated decisions

Data is not used for profiling or for decisions based solely on automated processing within the meaning of art. 22 GDPR. Google Signals and ad personalisation are switched off in Google Analytics 4.

Changes

This document is updated whenever the tools change. A test run on every change to the dawidrylko.com repository keeps the cookie list in step with the code.