Data controller
The controller of your personal data is Paweł Zagroba, running a sole proprietorship under the name Marshall&Zaza Paweł Zagroba, ul. Mazowiecka 37a, 06-300 Przasnysz, Poland, tax ID (NIP): 761 148 14 69 (the “Controller”, “I”).
Controller details
Marshall&Zaza Paweł Zagroba
ul. Mazowiecka 37a, 06-300 Przasnysz, Poland
NIP: 761 148 14 69
Contact regarding personal data
Email: kontakt@pawelzagroba.com
Phone: +48 792 317 011
I have not appointed a Data Protection Officer, as I am not required to. You can contact me directly about any data-related matter.
What data I process
I only process data you provide to me yourself, plus basic technical data needed for the website to work:
- Contact form — your full name, email address, message content and a record of your consent.
- Email or phone contact — your email address or phone number and any data you share in correspondence or conversation.
- Technical data — IP address, browser and operating system type, date and time of the visit and the address of the page visited, recorded automatically in server logs.
- Statistical data (Google Analytics) — only if you consent: cookie identifier, pages visited, visit duration, traffic source (e.g. a search engine, LinkedIn), approximate location (country, city), device, browser and operating system type, and clicks and other interactions with the website. I do not use this to identify who you are.
Downloading the CV as a PDF (in Polish or English) does not require any data.
Please do not send special categories of data (e.g. health data) in your messages — I don’t need them to reply.
Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Replying to a message sent through the contact form | Your consent — Art. 6(1)(a) |
| Email correspondence and phone calls, including about job offers and cooperation | My legitimate interest in communicating with people who contact me — Art. 6(1)(f) |
| Preparing an offer or entering into a contract, if you ask me to | Steps prior to entering into a contract and its performance — Art. 6(1)(b) |
| Issuing invoices and bookkeeping (if we work together) | Legal obligation — Art. 6(1)(c) |
| Website visit statistics (Google Analytics 4) — traffic analysis and content improvement | Your consent — Art. 6(1)(a) GDPR in conjunction with Art. 399 of the Polish Electronic Communications Law |
| Keeping the website secure and working properly (server logs) | Legitimate interest — Art. 6(1)(f) |
| Establishing, pursuing or defending legal claims | Legitimate interest — Art. 6(1)(f) |
Providing data is voluntary, but without an email address or phone number I won’t be able to reply to you.
I do not make automated decisions about you. I do not profile you for marketing or advertising purposes. Google Analytics only produces aggregated website traffic statistics.
How long I keep data
- Messages and correspondence — up to 12 months from the last contact, or until you withdraw consent or successfully object, if that happens earlier.
- Contract-related data — for the duration of the cooperation, and then until the limitation period for claims expires (generally 6 years, counted to the end of the calendar year).
- Accounting documents — 5 years from the end of the year in which the tax payment deadline passed.
- Google Analytics data — 2 months, after which it is deleted automatically. Google Analytics cookies expire after 2 years unless you delete them earlier or withdraw consent.
- Server logs — according to the hosting provider’s settings, usually no longer than 30 days.
Data recipients
I do not sell your data or share it for marketing purposes. Only entities providing technical services to me may have access to it, under data processing agreements:
- website hosting provider — Dhosting.pl Sp. z o.o. (dhosting.pl),
- email provider — Dhosting.pl Sp. z o.o. (dhosting.pl),
- contact form handling — a PHP script running on the website’s hosting server (messages go directly to my mailbox),
- accounting office — only if we work together and an invoice is issued.
Google Analytics. If you consent, statistical data is sent to Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland), which processes it on my behalf as the provider of Google Analytics 4. GA4 does not store full IP addresses of users in the EU. More: how Google Analytics protects privacy.
I may also disclose data to competent public authorities where required by law.
Transfers outside the EEA
Some providers — in particular Google (Google Analytics) — may also process data in the USA, on Google LLC servers. This is based on the European Commission’s adequacy decision (EU–US Data Privacy Framework) or on standard contractual clauses approved by the European Commission. You can get a copy of these safeguards by writing to me.
Your rights
In connection with the processing of your data, you have the right to:
- access your data and receive a copy,
- have inaccurate data corrected,
- have your data erased (the “right to be forgotten”),
- restrict processing,
- data portability,
- object to processing based on legitimate interest,
- withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
To exercise these rights, write to kontakt@pawelzagroba.com. I will reply without undue delay, and no later than within one month.
If you believe I am processing your data unlawfully, you can lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl, or with the supervisory authority in your EU country of residence.
External links
This website contains links to other services, e.g. LinkedIn and my clients’ websites. Once you follow a link, that service’s privacy rules apply — I am not responsible for how it processes data.
Security
I use appropriate technical and organisational measures to protect your data: an encrypted connection (HTTPS), password-protected accounts with two-factor authentication, and access to data on my side only.
Changes to this privacy policy
I may update this policy, e.g. after changes in the law or when new website features are added. The current version is always available on this page, and the date of the last change is shown at the top.