Privacy policy

Data controller

The controller of personal data is IT POMELO Marek Walczak, Ochla-Makowa 15, 66-006 Zielona Góra, Poland, tax ID (NIP) 925-202-99-18, REGON 541417563 (the Controller).

Contact for data protection matters: kontakt@it-pomelo.pl, phone +48 607 105 768.

What data I process and why

I only process the data needed for the purposes below.

• Contact by e-mail or phone: e-mail address, phone number, message content. Purpose: replying to your enquiry and corresponding with you. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in handling enquiries) or, where the enquiry concerns entering into a contract, Art. 6(1)(b) GDPR.
• Contact form: name, e-mail address and message. Purpose and basis as above. I store the message in a database and forward it to my mailbox. The form is protected by Cloudflare Turnstile, which assesses whether a human is submitting it (Art. 6(1)(f) GDPR: protection against spam and abuse).
• AI assistant (chat): the content of your messages and the replies. Purpose: providing information about the services. Basis: Art. 6(1)(f) GDPR. Messages are processed by a language model running on Cloudflare Workers AI. Do not enter sensitive or confidential data in the chat. I collect contact details only through the form, not through the model.
• Visit statistics (Google Analytics 4): online identifiers and data about your device and behaviour on the site. Purpose: analysing and improving the site. Basis: your consent (Art. 6(1)(a) GDPR). I enable statistics only after you give it.
• Security and operation of the site: IP address and technical request data processed by the Cloudflare infrastructure (hosting, protection against attacks). Basis: Art. 6(1)(f) GDPR.

Recipients of data

• Cloudflare, Inc. – website hosting, DNS, protection against attacks, Turnstile, database and the Workers AI service.
• E-mail provider (dpoczta.pl) – operation of mailboxes, including messages from the form.
• Google Ireland Limited – Google Analytics statistics, only with your consent.
• Entities authorised under applicable law.

Transfers outside the EEA

Cloudflare and Google may process data outside the European Economic Area, including in the USA. The transfer relies on the European Commission adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses.

How long I keep data

• Correspondence and form messages: up to 12 months after the matter is closed. If it leads to a contract, longer: for the period required by tax law and limitation periods.
• Conversations with the AI assistant: I do not store their content in my database. I only keep a daily message counter, without content or personal data.
• Google Analytics data: according to the retention period set in the service (up to 14 months). After you withdraw consent, no new data is collected.
• Theme and consent choice: in your browser until you delete it.

Your rights

To exercise your rights, write to kontakt@it-pomelo.pl.

You have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

• access to your data and a copy of it,
• rectification,
• erasure,
• restriction of processing,
• data portability,
• objection to processing based on legitimate interest,
• withdrawal of consent at any time, without affecting the lawfulness of earlier processing (you can change your statistics consent via “Cookie settings” in the footer).

Voluntary provision and automated decisions

Providing data in the form is voluntary, but necessary for me to reply. I do not make decisions about you by automated means, including profiling. The AI assistant gives general information and does not make decisions with legal effects.

Cookies and similar technologies

The site stores small entries and files in your browser. You can change your statistics consent at any time via the “Cookie settings” link in the footer, and you can also block cookies in your browser settings.

• theme (local storage): remembers your light or dark theme choice. Works without consent because it provides the feature you choose.
• consent (local storage): remembers your statistics choice. Works without consent.
• _ga and _ga_* (Google Analytics cookies): distinguish users and sessions for statistics. Only after consent; valid for up to 2 years.
• Cloudflare: may store technical entries used to protect against bots (e.g. with the form). They serve security.

Changes to this policy

I may update this policy when the way the site works or the law changes. The current version is always here.