Privacy Policy and terms for using content

1. Data Controller

The controller of personal data processed in connection with the website www.surowiecki.org is Krzysztof Surowiecki. For privacy, personal data and cookie matters, contact via the contact form.

No Data Protection Officer has been appointed because there is no such obligation. The contact address above is the proper channel for requests related to GDPR rights.

2. What data may be processed

Depending on how you use the website, the following categories of data may be processed:

• contact data: email address, name, message content and information provided in forms,
• newsletter data: email address, subscription status, consent record and mailing activity,
• purchase data: email address, product, payment status, Stripe transaction identifiers and invoice details if requested,
• technical data: IP address, cookie identifiers, device type, browser, operating system, approximate location and server logs,
• analytics data: visited pages, traffic sources, events, website interactions and cookie consent settings,
• data entered into free tools or calculators if a given tool needs to process it to generate a result.

Do not enter sensitive data, third-party data or confidential information into forms, calculators or messages unless it is necessary for a specific matter.

3. Purposes, legal bases and voluntary provision of data

Providing data is voluntary, but in some cases necessary: without an email address it is not possible to reply to a message, send a newsletter, deliver a digital product or process a payment.

4. Cookies, Consent Mode and analytics

The website uses cookies and similar technologies. Some are necessary for the website to work, to remember consent settings and to maintain security. Other categories, especially analytics and marketing cookies, are activated according to your consent settings.

The website may use in particular: Google Tag Manager, Google Analytics 4, Google Consent Mode, Microsoft Clarity and tools required for email, forms, payments and digital products.

You can withdraw or change consent at any time in the cookie settings available in the website footer. You can also restrict cookies in your browser settings, although some website features may then work differently.

I do not use pre-ticked consent. Consent for non-essential cookies should be voluntary, informed and withdrawable.

5. Recipients and external tools

Data may be shared with providers that help operate the website and services, in particular:

• hosting, IT infrastructure, email and security providers,
• Brevo or other transactional email and newsletter providers,
• Stripe for payment processing of digital products,
• Google and Microsoft for analytics, tags, Consent Mode and website optimisation,
• accounting, legal or administrative providers where needed,
• authorised public authorities where required by law.

Transfers outside the EEA

Some providers, especially global technology providers, may process data outside the European Economic Area. If such transfer occurs, it is based on appropriate legal mechanisms, such as an adequacy decision, the provider's participation in the EU-US Data Privacy Framework or Standard Contractual Clauses approved by the European Commission.

6. How long data is stored

• contact data - for the time needed to handle the inquiry, then as needed to document correspondence or defend claims,
• contract or purchase data - for the duration of contract performance and the limitation period for claims,
• accounting and invoice data - for the period required by tax and accounting laws,
• newsletter data - until consent is withdrawn or you unsubscribe, and afterwards only as needed to prove prior consent,
• analytics and cookie data - according to the settings of a given tool or until consent is withdrawn where processing is based on consent,
• technical logs - for the time needed to maintain security and diagnose errors.

If the law requires longer storage, or data is needed to establish, pursue or defend legal claims, the retention period may be extended accordingly.

7. Your rights

You have the right to:

• access your data and obtain a copy,
• rectify your data,
• erase your data where GDPR conditions are met,
• restrict processing,
• data portability where processing is based on consent or contract and carried out by automated means,
• object to processing based on legitimate interest,
• withdraw consent at any time without affecting the lawfulness of processing before withdrawal,
• lodge a complaint with the President of the Polish Personal Data Protection Office.

Send requests using the contact form. A response will generally be provided within one month. If the request is complex or numerous, the deadline may be extended as provided by GDPR.

Supervisory authority: President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

8. Terms for using free content, guides and tools

Content published on the website, including articles, checklists, calculators, generators, tool comparisons and materials about analytics, AI, e-commerce, IT law, GDPR, cookies and data governance, is general informational and educational content.

Free content is not individual legal, tax, financial, investment, medical, accounting, technical or business advice. It does not create an advisory relationship, client-consultant relationship or any obligation to achieve a specific result.

You use the content and tools at your own responsibility. Before making a business, legal, financial, technical or organisational decision, you should verify the information in your own context, consider the current legal and technical state and, where needed, consult an appropriate specialist.

I make efforts to keep materials reliable and up to date, but I do not guarantee completeness, error-free operation, suitability for a specific purpose or applicability to every individual case. To the fullest extent permitted by law, the Controller is not liable for consequences of decisions made solely on the basis of free content available on the website.

If you need an assessment of a specific implementation, contract, cookie setup, AI system, analytics stack or data processing process, treat the website materials as a starting point, not as a final opinion.

9. Profiling and automated decisions

The website may use web analytics and statistical segmentation to understand which content is useful and how to improve the website. I do not make decisions about users based solely on automated processing that would produce legal effects or similarly significantly affect them.

10. Data security

I apply organisational and technical measures intended to protect data against unauthorised access, loss, alteration or disclosure. These include access limitation, software updates, secure email and payment services, and processing data only to the extent necessary for a given purpose.

11. Changes and contact

This document may be updated when the website scope, tools, legal requirements or processing methods change. The current version is always available at https://www.surowiecki.org/en/privacy-policy/.

For privacy, personal data, cookies or content-use matters, use the contact form.