This privacy policy sets out how personal data is processed in relation to visitors to the kocjan.dev website (the "Website") and people who contact its owner.

Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR"), and with applicable Polish law.

1. Data controller

The controller of personal data is Andrzej Kocjan, conducting business as DEV Andrzej Kocjan, ul. Łabska 1/11, 58-560 Jelenia Góra, Poland, tax ID (NIP): PL6112707794 (the "Controller").

For any matter relating to the processing of personal data, the Controller can be contacted:

2. Purposes, legal bases and retention periods

2.1. Enquiries via the contact form and email

  • Categories of data: name, email address, the content of the message and any other information provided by the sender.
  • Purpose: to respond to the enquiry and to conduct any further correspondence.
  • Legal basis: the Controller's legitimate interest in responding to enquiries (Article 6(1)(f) GDPR) and, where the enquiry concerns a potential collaboration, the need to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR).
  • Retention period: messages submitted through the contact form are deleted from the Website after 30 days. Email correspondence is retained for as long as the contact continues.

Providing this data is voluntary, but necessary to receive a response.

2.2. Website security and administration

  • Categories of data: information recorded automatically by the server in its logs, in particular the IP address, the date and time of the connection, the page requested and browser details.
  • Purpose: to ensure the security and proper functioning of the Website. Logs are not used for any other purpose.
  • Legal basis: the Controller's legitimate interest in ensuring the security of the Website (Article 6(1)(f) GDPR).
  • Retention period: up to 30 days.

2.3. Backups

The data described in sections 2.1 and 2.2 may also be stored in backups. Backups are encrypted by the Controller before they are sent to the storage provider, so the provider has no access to their content. They are stored in data centres within the European Union and deleted automatically after 30 days.

3. Recipients of personal data

Personal data may be entrusted to processors acting on behalf of the Controller that provide services necessary to operate the Website and handle communication, in particular providers of:

  • hosting services – OVHcloud (data centres in Europe),
  • website security and content delivery network (CDN) services – Cloudflare, Inc.,
  • email services – Proton AG,
  • backup storage services – OVHcloud (data centres in Europe).

These processors handle personal data under data processing agreements (Article 28 GDPR) and solely on the Controller's instructions.

Personal data may also be disclosed to public authorities where required by law.

4. Transfers outside the European Economic Area

Personal data is transferred outside the European Economic Area (EEA) only to the providers listed below and subject to the safeguards described.

Cloudflare, Inc. (United States) – website security and handling of connections to the Website. Transfers to the United States are based on Cloudflare's certification under the EU-US Data Privacy Framework, which is covered by a European Commission adequacy decision (Article 45 GDPR). For transfers to other countries outside the EEA, Cloudflare relies on standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR).

Proton AG (Switzerland) – email services. Switzerland is a country for which the European Commission has issued an adequacy decision (Article 45 GDPR).

For any questions about the safeguards applied to transfers outside the EEA, please contact the Controller.

5. Rights of data subjects

Under the conditions set out in the GDPR, every person whose data is processed has the right to:

  • access their personal data and obtain a copy of it (Article 15 GDPR),
  • rectification of their data (Article 16 GDPR),
  • erasure of their data (Article 17 GDPR),
  • restriction of processing (Article 18 GDPR),
  • data portability (Article 20 GDPR), with respect to data processed in connection with a contract,
  • object to processing based on the Controller's legitimate interest (Article 21 GDPR).

To exercise any of these rights, please contact the Controller at [email protected].

Every data subject also has the right to lodge a complaint with a supervisory authority (Article 77 GDPR). In Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa.

6. Automated decision-making and profiling

Personal data is not used for automated decision-making, including profiling (Article 22 GDPR).

7. Cookies

The Website does not use analytics or marketing cookies. It may use only cookies that are strictly necessary for the Website to function properly and securely, which do not require the user's consent.

Users can change their cookie settings in their web browser at any time. Please note that blocking strictly necessary cookies may affect some features of the Website.

8. Data security

The Controller applies technical and organisational measures appropriate to the risk in order to protect personal data against unauthorised access, loss, destruction or alteration (Article 32 GDPR).

9. Changes to this privacy policy

The Controller reserves the right to amend this privacy policy, in particular in the event of changes in the law or in how the Website operates. The current version is always available on this page.

Last updated: 6 November 2026