Privacy policy

§ 01Who is the controller of your data

The controller of the personal data collected through jaceksultan.com is Jacek Labudda, who appears publicly under the name Jacek Sultan (“I” or “me”).

For anything related to personal data, write to: sultan.jacek@gmail.com.

§ 02What data I process, why and on what legal basis

• Messages (form, email): your name, email address, the content of your message and an optional link. Purpose: replying to you and corresponding with you. Legal basis: my legitimate interest (Art. 6(1)(f) GDPR) and, if you are asking about sessions, taking steps prior to entering into a contract (Art. 6(1)(b) GDPR).
• Booking a session (Google Calendar): your full name, email address, the selected time slot and the answers you give in the booking form. Purpose: scheduling and holding sessions. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Online sessions (Google Meet): your image and voice during the call and any materials you choose to share (e.g., your screen, code). Purpose: holding sessions. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Payments: data from the bank transfer confirmation and, if you request it, the details needed for a receipt or invoice. Purpose: settling payment for sessions and meeting tax obligations. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
• Form protection (Google reCAPTCHA): information about your device and how you use the form. Purpose: telling humans apart from bots and protecting against spam. Legal basis: my legitimate interest (Art. 6(1)(f) GDPR). reCAPTCHA loads only when you start filling in the form.
• Statistics and advertising (Google Analytics, Microsoft Clarity, Google Ads): how you use the site, approximate location, device type, identifiers stored in cookies. Purpose: improving the site and measuring ad performance. Legal basis: your consent given in the cookie banner (Art. 6(1)(a) GDPR in conjunction with Art. 399 of the Polish Electronic Communications Law, Prawo komunikacji elektronicznej).
• Server technical data (Amazon CloudFront): IP address, browser type, time and URL of the request. Purpose: delivering the site and keeping it secure. Legal basis: my legitimate interest (Art. 6(1)(f) GDPR).

§ 03Recording sessions

As a rule, I don’t record sessions. In exceptional cases I may record a session, but only if the participant gives explicit consent before the recording starts (Art. 6(1)(a) GDPR). The recording is used only by the participant and me to review the material. I don’t publish it.

You can withdraw your consent at any time, and I will then delete the recording. Unless consent is withdrawn, I keep recordings for no longer than 24 months.

§ 04Sessions with minors

I hold sessions with anyone under 18 only with the written consent of a parent or legal guardian. Scheduling and payment for the sessions are arranged with the parent or guardian.

For this purpose I also process the parent’s or guardian’s data: full name, email address and the content of the consent given (Art. 6(1)(b) and (c) GDPR). I keep the consent for the duration of the sessions and for 24 months after they end.

§ 05Participant reviews

I publish a review of my sessions on the site only with its author’s consent and in a form the author approves (e.g., first name only or initials). Legal basis: consent (Art. 6(1)(a) GDPR). If consent is withdrawn, the review is removed from the site.

§ 06How long I keep data

• Messages and correspondence: 24 months from the end of the correspondence.
• Bookings and session information: 24 months from the last session.
• Accounting documents: for the period required by tax law (5 years from the end of the year in which the tax obligation arose).
• Cookie data: for the periods listed in the table below, or until you withdraw consent.
• Data processed on the basis of consent: until consent is withdrawn.

§ 07Who I share data with

I entrust data only to the service providers I use to run the site and the sessions:

• Amazon Web Services EMEA SARL (Luxembourg): website hosting (Amazon S3), content delivery network (Amazon CloudFront) and delivering contact form messages to my inbox (AWS Lambda, Amazon SES).
• Google Ireland Limited (Ireland): Gmail, Google Calendar (bookings), Google Meet (sessions), reCAPTCHA (form protection), Google Analytics and Google Ads (with your consent).
• Microsoft Ireland Operations Limited (Ireland): Microsoft Clarity (with your consent).
• DOCK sp. z o.o. (Gdańsk, Poland): the DockAccess accessibility widget. Your widget settings are stored only in your browser’s storage. If you ask for an invoice issued by DOCK sp. z o.o., that company becomes a separate controller of the data needed for the invoice.

§ 08Transfers outside the European Economic Area

Google, Microsoft and Amazon may also process data in the United States. Such transfers are based on the European Commission’s adequacy decision on the EU–US Data Privacy Framework (these companies are certified under it) and on standard contractual clauses approved by the European Commission.

§ 09Your rights

You have the right to:

• access your data and receive a copy of it,
• have your data rectified,
• have your data erased (the “right to be forgotten”),
• restrict processing,
• data portability,
• object to processing based on legitimate interest,
• withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (you can change your cookie consent with the “Cookie settings” button in the site footer),
• lodge a complaint with the supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl.

To exercise your rights, write to sultan.jacek@gmail.com. I will reply within one month.

§ 10Do you have to provide your data

Providing your data is voluntary, but without an email address I can’t reply to your message, and without the details in the booking form we can’t schedule a session. I don’t make decisions about you based solely on automated processing. Google’s advertising tools may build profiles to tailor ads, but only if you consent to the “Marketing” category.

§ 11Cookies and similar technologies

On your first visit, I ask for your consent in the cookie banner. Necessary cookies always work; the others only with your consent. You can change your decision at any time with the “Cookie settings” button in the footer. When you withdraw consent, I delete the statistics and advertising cookies stored under the site’s domain.

§ 12Changes to this policy

When I change how I process data (e.g., by adding a new tool), I will update this policy and the date below. If the change concerns cookies that require consent, the cookie banner will ask you again.