Privacypolicy.

The controller of your personal data is Aleksander Pietrzak, a sole trader operating as SoraWeb Studio Aleksander Pietrzak, NIP (tax ID) 5581887495, REGON 54140968700000, address: ul. Notecka 2, 89-203 Rynarzewo, Poland.

Contact for matters related to personal data: sorawebstudio@gmail.com.

Through the contact form I collect only the data you provide yourself: your name, email address, optionally a phone number and project type, and the content of your message.

In addition, to protect against abuse (rate limiting), I temporarily store your IP address, only for the duration of the limit window (60 seconds). After that, the IP is automatically removed from the server's memory.

For anonymous visit statistics I use Vercel Web Analytics, a cookieless tool that does not store your IP address or any data that could identify you (it relies on a daily, anonymous hash discarded within 24 hours). Only aggregated data is collected: page views, country, device and browser type, and referral source.

Without your explicit consent I do not use tracking cookies, Google Analytics, or any other profiling systems. Cookies and consent are covered in section 07.

I process your data solely in order to respond to your enquiry and to potentially begin working together.

Legal basis: Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and Article 6(1)(f) GDPR (legitimate interest, protecting the site against abuse and keeping anonymous, aggregated visit statistics).

For analytics cookies, if you consent to them, the basis is Article 6(1)(a) GDPR (consent) together with Articles 173–174 of the Polish Electronic Communications Law. You can withdraw consent at any time.

The content of the contact form reaches my inbox via Resend (resend.com), a transactional email service based in the USA, covered by Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework (DPF) in line with GDPR requirements.

The site is hosted on Vercel (vercel.com), Vercel Inc., USA (under SCCs); Vercel also provides the cookieless visit analytics mentioned above (Vercel Web Analytics).

If you consent to analytics cookies, traffic statistics are also processed by Google (Google Ireland Limited, and for transfers to the USA, Google LLC) on the basis of the DPF and SCC. Without your consent, Google Analytics is not loaded.

I do not sell or share your data with any other parties for marketing purposes.

I keep messages from the contact form in my email inbox for as long as needed to carry on the correspondence and for the period required to settle any work undertaken (up to 5 years, in line with accounting requirements).

If our conversation does not lead to working together, you can ask at any time to have your message and my reply removed from my inbox, I will do so within 30 days.

You have the right to: access your data, rectify it, erase it, restrict its processing, port it, and object to its processing.

To exercise these rights, write to sorawebstudio@gmail.com. I respond within 30 days.

You also have the right to lodge a complaint with the supervisory authority, the President of the Personal Data Protection Office (uodo.gov.pl).

In its basic form the site runs without cookies, language selection and abuse protection do not require them, and visit analytics (Vercel Web Analytics) is cookieless and needs no consent.

Google Analytics 4 analytics cookies (including `_ga`, `_ga_<ID>`, valid for up to 13 months; provider: Google Ireland Limited) are loaded only after you give consent in the cookie banner. The default consent state (Google Consent Mode v2) is “denied”, without your consent no analytics cookies are stored.

You can withdraw or change your consent at any time, through the cookie settings on the site or by clearing cookies in your browser. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Once you consent, statistical data may be transferred to the USA (Google LLC) on the basis of the EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCC). Details of Google's processing: policies.google.com/privacy.

I publish any changes to this policy on this page, together with the update date shown at the top of the document. I additionally communicate material changes by email to the people with whom I am in active correspondence.