Privacy policy
Last updated:
This is an English translation provided for convenience. In case of any discrepancy, the Polish version prevails.
This document explains which personal data is processed when you use bit9.pl, for what purpose and on what legal basis, and what rights you have. I apply Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
1. Data controller
The controller of your personal data is BIT 9 Paweł Mirosławski, ul. Legionów 26/2, 43-300 Bielsko-Biała, Poland, tax ID (NIP) 9372436514, REGON 242891141.
For any matter concerning personal data, write to [email protected] or use the contact form.
2. What data I process and why
Contact form
When you send a message, I process the first name, last name, email address and message you provide, as well as your IP address and the time of sending. This data is used only to reply to your message and to continue the correspondence.
- Legal basis: my legitimate interest in answering enquiries sent to me (Art. 6(1)(f) GDPR) and, if the message concerns concluding a contract, also taking steps prior to entering into it (Art. 6(1)(b) GDPR).
- Retention period: until the matter is closed and then no longer than 3 years, i.e. the limitation period for possible claims.
- Voluntary: providing the data is voluntary, but without your name and email address I cannot reply to your message.
Spam protection (Cloudflare Turnstile)
The form is protected by Cloudflare Turnstile, which checks whether a message is sent by a human rather than a bot. For this purpose Cloudflare processes, among other things, your IP address and technical information about your browser. The legal basis is my legitimate interest in protecting the website and mailbox against abuse (Art. 6(1)(f) GDPR).
Visitor statistics (Google Analytics 4)
If you give consent in the cookie banner, I use Google Analytics 4 to know how many people visit the website and where they come from. Google then stores the _ga and _ga_* cookies in your browser. Without consent these cookies are not stored and Google receives only anonymous signals without identifiers (Consent Mode). I do not use Google advertising features.
- Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by clicking the “Cookies” link in the bottom left corner of the page. Withdrawal does not affect the lawfulness of processing before it.
- Retention period: according to the Google Analytics retention settings, no longer than 14 months.
Server logs
The server running the website automatically records technical information about requests in its logs (including IP address, date and time, the requested page and browser information). They are used only to keep the website secure and working properly (Art. 6(1)(f) GDPR) and are kept for a short time, usually up to 14 days.
3. Cookies and browser storage
| Name | Provider | Purpose | When |
|---|---|---|---|
_ga, _ga_* | visitor statistics, up to 2 years | only after consent | |
__cf_bm and similar | Cloudflare | protection against bots and attacks, usually up to 30 minutes | necessary |
theme (localStorage) | this website | remembering the selected light/dark theme | necessary, after using the switch |
consent (localStorage) | this website | remembering your cookie decision | necessary |
lang | this website | remembering the selected language, up to 1 year | necessary, after using the language switch |
You can also delete or block cookies in your browser settings.
4. Who receives the data
I do not sell data or share it for marketing purposes. Data may be received by providers of services I use:
- a hosting provider based in Germany: the server running the website and email;
- Cloudflare, Inc. (USA): content delivery network, attack protection and the Turnstile service;
- Google Ireland Limited (Ireland): Google Analytics 4, only after consent.
The providers process data on my behalf, under data processing agreements and according to my instructions. Data may also be disclosed to competent authorities where required by law.
5. Transfers outside the European Economic Area
Cloudflare, Inc. and Google may process data in the United States. Both companies participate in the EU-US Data Privacy Framework, which the European Commission has found to ensure an adequate level of protection (Art. 45 GDPR). Standard contractual clauses approved by the European Commission are applied as well.
6. Your rights
In connection with the processing of your data, you have the right to:
- access your data and receive a copy of it (Art. 15 GDPR),
- rectification of your data (Art. 16 GDPR),
- erasure of your data (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR), where processing is based on consent or a contract,
- object to processing based on legitimate interest (Art. 21 GDPR),
- withdraw consent at any time (Art. 7(3) GDPR),
- lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland (Art. 77 GDPR).
To exercise these rights, write to [email protected]. I will reply without undue delay and within one month at the latest.
7. Automated decisions and profiling
I do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you. The Cloudflare Turnstile check only distinguishes people from bots sending spam.
8. Changes to this privacy policy
This policy may be updated, for example when the services used or the law change. The current version is always available on this page and the date of the last change is shown at the top.