Last updated: 4 November 2026.
This policy explains what personal data I process when you use kordianzadrozny.pl, why I use it and how to exercise your rights. The cookie policy provides the detailed cookie inventory.
1. Controller and contact
The controller is Kordian Zadrożny, the person operating kordianzadrozny.pl. For questions about your data, email kordian@kordianzadrozny.pl or call +48 784 261 052.
2. Browsing and security
The server processes technical information such as your IP address, request date and time, requested page, response status, browser and operating system. This is needed to deliver the website, investigate faults and prevent abuse.
I use Wordfence (Defiant, Inc.) to protect the website. IP addresses, request details and security events may be processed to detect attacks and unauthorised access. The legal basis is my legitimate interest in operating and securing the website (Article 6(1)(f) GDPR).
3. Email and telephone contact
If you email or call me, I process your contact details and the information you choose to provide, such as your name, email address, phone number, company details and description of the matter. The current contact page contains direct email and telephone links; it does not submit messages through a website contact form.
I use this information to respond and handle correspondence, based on my legitimate interest in dealing with enquiries (Article 6(1)(f) GDPR). Steps taken at your request before entering into a contract with me are based on Article 6(1)(b) GDPR. Providing information is voluntary, but I need a way to contact you to respond.
4. Comments and spam prevention
When you comment, WordPress processes your comment, display name, email address, optional website address, IP address and browser information. Approved comments, display names and supplied website links are public. Email and IP addresses are not published in the comment.
Discussion, moderation and abuse prevention are based on my legitimate interest (Article 6(1)(f) GDPR). Akismet, provided by Automattic, checks comments for spam. Comment text, name, email, website, IP and browser information may be sent for this analysis. See the Akismet privacy information.
If a Gravatar image appears beside a comment, a hash of the email address is sent to Automattic to find the image. Loading it also discloses connection data, including the visitor’s IP address. An email hash does not make the information completely anonymous. See Automattic’s privacy policy.
5. Google Analytics — with your consent
I use Google Analytics 4 to understand which content is useful and how visitors use the website. The EEA provider is Google Ireland Limited. After consent to statistics, the service may process cookie identifiers, page views, events, visit duration, referral source, device and browser information and approximate location.
Analytics is blocked until you consent. The legal basis is consent (Article 6(1)(a) GDPR). You can read the blog without agreeing. Use “Cookie settings” to withdraw consent. This stops future Analytics loading in that browser; it does not automatically erase information already sent to Google or affect the lawfulness of earlier processing.
More information: how Google uses information from websites using its services.
6. YouTube and external links
Some articles embed YouTube videos (Google Ireland Limited). Players are blocked until you consent to external content and marketing. Once enabled, Google receives information including your IP address, device information and player interactions. It may use cookies and associate activity with an account you are signed into. My legal basis for enabling the embed and related processing is your consent (Article 6(1)(a) GDPR). Google’s further processing is described in its privacy policy.
LinkedIn, Instagram and TikTok icons are ordinary links to my profiles. Following them takes you to services governed by their own privacy rules. The same applies to other external links, such as Useme.
7. Cookies and your choice
Complianz remembers consent choices, and Polylang remembers the selected language. WordPress may use cookies for logging in and comment functionality. Optional statistics cookies and cookies associated with embedded videos require consent. Names, purposes and storage periods are listed in the cookie policy.
You can change your decision through “Cookie settings” or delete and block cookies in your browser. Consent choices apply to the particular browser and device. Deleting cookies may make the banner appear again.
8. Recipients and transfers outside the EEA
As necessary for these purposes, recipients may include hosting, email and backup providers, technical support providers, and the services named above: Google, Automattic and Defiant. Information may be disclosed to authorised authorities where required by law. Published comments can be read by visitors and indexed by search engines.
Google, Automattic and Defiant may process information outside the European Economic Area, including in the United States. Providers explain their safeguards here: Google, Automattic and Defiant / Wordfence. Depending on the provider and recipient, these include adequacy decisions, including the EU–US Data Privacy Framework for covered organisations, or standard contractual clauses. You can also contact me for information about the safeguards and how to obtain a copy.
9. Retention
- Correspondence: while dealing with the enquiry or cooperation. Afterwards, where necessary to document arrangements or establish, exercise or defend claims, until the applicable limitation period expires. Documents subject to a legal retention duty are kept for the legally required period.
- Comments: while the article and discussion remain published, until the comment is removed or a justified erasure request is granted. Spam in the Akismet spam folder is automatically removed after 15 days. The provider’s own processing is subject to its linked privacy information.
- Technical and security logs: until removed by the system’s log rotation; records relating to an incident may be kept while investigating it and establishing, exercising or defending claims. Retention serves fault detection and security rather than marketing profiling.
- Consent and cookies: for the periods in the cookie policy. Complianz records the consent choice for 365 days. Analytics cookies may last up to two years and may be renewed on subsequent visits with consent.
- Google statistics: user-level and event-level retention follows the GA4 retention settings. Standard GA4 offers two- or fourteen-month periods, and activity can renew an identifier’s retention period. Aggregated statistical reports may remain available longer. Removing cookies does not automatically erase data already held by the provider.
10. Your rights
Subject to the GDPR’s conditions, you can request access and a copy, rectification, erasure and restriction of processing. You can object to processing based on legitimate interests on grounds relating to your particular situation. Data portability applies in the cases specified by the GDPR, where automated processing is based on consent or a contract.
You can withdraw consent at any time without affecting the lawfulness of earlier processing. To exercise your rights, email kordian@kordianzadrozny.pl. I normally respond within one month; the deadline may be extended where the law allows. You can complain to the President of Poland’s Personal Data Protection Office or the competent supervisory authority.
11. Voluntary information and automated decisions
Reading the blog does not require your name or email address. Some technical data is needed to deliver the site. Contacting me and commenting are voluntary, but missing required information may prevent a response or submission of a comment. Refusing Analytics or YouTube consent does not block access to written articles.
I do not make decisions about you with legal or similarly significant effects based solely on automated processing, including profiling. Spam filters and security tools may automatically hold a comment or block a suspicious request. If this causes a problem, please email me.
12. Updates
I update this policy when website functionality or services change. The revision date appears above. Updating the policy does not itself replace consent required for new optional processing purposes.