( Legal )

Privacy policy

Last updated: 11 August 2026

This policy explains what personal data I collect through mioduszewsky.com, why, and what rights you have. It follows the EU General Data Protection Regulation (GDPR / RODO).

1. Who is responsible for your data

The data controller is Kacper Mioduszewski, a private individual, ul. Fromborska 66, 54-111 Wrocław, Poland. Contact: kacper@mioduszewsky.com.

2. What data I collect and why

• Contact form — your name, email address and the content of your message. Used only to reply to your enquiry and, if relevant, to take steps toward working together.
• Booking a call — if you schedule a call, the booking is handled by Google (Google Calendar appointment scheduling). Google receives your name, email and any details you provide, to confirm the meeting.
• Basic usage analytics — anonymous, aggregated statistics about page visits (which pages, rough referrer, how far down a page people scroll, device type). Run by Vercel and by PostHog in cookieless mode: nothing is stored on your device, and visitor numbers are estimated server-side from an irreversible hash that is rotated daily. It does not record your clicks or what you click on — that needs consent. It does not identify you individually and is not used for advertising. Always on, no consent needed.
• Optional product analytics and ad conversion tracking — PostHog in full mode (a cookie that lets a returning visit be recognised), Google Analytics / Google Ads conversion tracking and the Meta Pixel (to measure whether paid ads lead to real enquiries). These only run after you accept the cookie banner — see section 6.
• Optional session recordings — if you accept the cookie banner, PostHog also records your visit: the pages you move through, clicks, scrolling and mouse movement, played back later as a video-like replay. I use this to find out where the site confuses people. Anything you type into a form field is masked and never recorded, passwords included. Recordings are automatically deleted after 30 days. This does not run if you reject the banner.

3. Legal basis (GDPR Art. 6)

• Your consent for processing the contact form (Art. 6(1)(a)) — given by ticking the consent box.
• Your consent for cookie-based analytics and ad tracking — PostHog in full mode, Google and Meta (Art. 6(1)(a)) — given by accepting the cookie banner. Before that, only the cookieless measurement in section 2 runs, under my legitimate interest in seeing in aggregate how the site is used (Art. 6(1)(f)).
• Your consent for session recordings (Art. 6(1)(a)) — the same banner. Reject it, or simply do not accept, and nothing is recorded.
• Taking steps at your request before entering a contract (Art. 6(1)(b)).
• My legitimate interest in understanding, in aggregate, how the site is used (Art. 6(1)(f)) — for the cookieless basic analytics only.

4. Who processes your data on my behalf

I use a small number of trusted service providers:

• Vercel Inc. — website hosting and cookieless Web Analytics.
• Amazon Web Services (AWS SES) — delivery of contact-form emails. Data is processed in the EU (Frankfurt, eu-central-1).
• Google (Google Workspace) — my email inbox and, if you book a call, the appointment scheduling.
• PostHog (EU servers) — cookieless visit analytics, plus full product analytics and session recordings after you accept the cookie banner.
• Google Analytics / Google Ads — traffic and ad-conversion measurement, only after you accept the cookie banner.
• Meta Platforms Ireland — the Meta Pixel, used to measure whether paid ads lead to real enquiries, only after you accept the cookie banner.

Some providers are based outside the EU. Where that applies, transfers rely on the EU Standard Contractual Clauses or an equivalent safeguard.

5. How long I keep it

Contact messages are kept for as long as needed to handle your enquiry and any resulting collaboration, and then for a reasonable period in case of follow-up. You can ask me to delete them sooner at any time.

Session recordings are deleted automatically after 30 days.

6. Cookies

mioduszewsky.com itself sets no cookies by default. My basic analytics are cookieless and do not identify you.

If a cookie banner is shown on the site, it is asking your consent for the cookie-based tools: PostHog in full mode (product analytics and session recordings, described in section 2), Google Analytics / Google Ads and the Meta Pixel. Google and Meta do not load before you click “Accept”. PostHog runs from the moment you open the page, but until you accept it stays in the cookieless mode described in section 2 and stores nothing on your device. If you click “Reject”, PostHog stops collecting anything at all and no Google or Meta tag is loaded. Your choice is remembered on this device so you are not asked again.

The booking calendar on the /contact page is provided by Google, and once shown it sets a cookie (Google's NID) needed to run that widget. If you have already accepted the cookie banner, the calendar loads automatically; otherwise it only loads after you click “Show calendar”. If you would rather not, you can always book by emailing kacper@mioduszewsky.com instead.

7. Your rights

Under GDPR you can, at any time:

• access your data and get a copy,
• correct or update it,
• ask for it to be deleted,
• restrict or object to processing,
• withdraw consent (without affecting past processing),
• lodge a complaint with the Polish supervisory authority (UODO, uodo.gov.pl).

To exercise any of these, email kacper@mioduszewsky.com.

8. Changes

If this policy changes, the “last updated” date above will change too.