Privacy Policy

1. General information

This Privacy Policy sets out the rules for processing and protecting the personal data of users of the jak-zbudowac-strone.pl website (the "Website"). The Website is operated by Paweł Domański. The controller can be contacted at: kontakt@dexterlab.pl.

The Policy applies to all users visiting the Website, using the contact form, subscribing to the newsletter, purchasing digital products or using the live chat.

2. Data controller

The controller of your personal data within the meaning of Art. 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) is:

• Controller: Paweł Domański
• E-mail: kontakt@dexterlab.pl
• Website: jak-zbudowac-strone.pl

The controller has not appointed a Data Protection Officer. For any matters concerning the processing of personal data, please contact the e-mail address above.

3. What data we collect and why

We process personal data provided voluntarily by users. The purposes, scope and legal bases are listed below:

a) Contact form

• Data scope: name, e-mail address, message subject, message content.
• Purpose: responding to the user's inquiry.
• Legal basis: Art. 6(1)(b) GDPR (performance of a contract or steps taken at the data subject's request prior to entering into a contract).

b) Newsletter (Listmonk)

• Data scope: e-mail address, optionally name.
• Purpose: sending a newsletter with educational content and information about new articles and products.
• Legal basis: Art. 6(1)(a) GDPR (the user's voluntary consent). Consent can be withdrawn at any time via the unsubscribe link in every e-mail or by contacting the controller.

c) Sale of digital products (Naffy)

• Data scope: data necessary to fulfil the order (full name, e-mail address, invoicing details).
• Purpose: order fulfilment, delivery of e-books and online courses, payment handling, issuing accounting documents.
• Legal basis: Art. 6(1)(b) GDPR (performance of a sales contract) and Art. 6(1)(c) GDPR (legal obligation — tax and accounting regulations).

d) Live chat (Libredesk)

• Data scope: conversation content, contact details provided during the conversation (e.g. name, e-mail address).
• Purpose: customer service, providing technical and content support in real time.
• Legal basis: Art. 6(1)(f) GDPR (the controller's legitimate interest — handling customer inquiries).

4. Cookies and tracking technologies

The Website uses cookies and similar technologies for the purposes described below. Analytics and marketing scripts run only after informed consent is given via the cookie banner. You can change your preferences or clear cookies in your browser settings at any time.

Important: Google Analytics, Google Tag Manager and Meta Pixel scripts are loaded only after the user gives explicit consent via the cookie banner. Without consent, no analytics or marketing cookies are stored.

5. Data processors

In order to provide the services properly, the controller entrusts the processing of personal data to the following entities:

• Google LLC (USA) — Google Analytics (GA4), Google Tag Manager — transfer based on the EU-US Data Privacy Framework.
• Meta Platforms Inc. (USA) — Meta Pixel — transfer based on the EU-US Data Privacy Framework.
• Hosting provider — storing the Website's files and data.
• Directus CMS (self-hosted, cms.dexterlab.pl) — Website content management.
• Listmonk (self-hosted) — newsletter and mailing list handling.
• Naffy (naffy.io) — payment gateway, fulfilment of digital product orders (e-books, courses).
• Libredesk (self-hosted, pomoc.dexterlab.pl) — live chat and customer support.

6. Data transfers outside the EEA

Due to the use of services provided by Google LLC and Meta Platforms Inc., personal data may be transferred to the United States of America (USA). The transfer takes place on the basis of:

• EU-US Data Privacy Framework (DPF) — the European Commission's adequacy decision.
• Standard Contractual Clauses (SCC) — as an additional safeguard for data transfers.

The controller ensures that transfers of data outside the European Economic Area (EEA) take place with the appropriate safeguards required by the GDPR.

7. Data retention

Personal data is stored for the period necessary to fulfil the purposes for which it was collected:

• Contact form: up to 12 months from the last contact, unless further processing is necessary to establish, pursue or defend claims.
• Newsletter: until you unsubscribe from the mailing list or withdraw consent.
• Analytics cookies (GA4): up to 2 years.
• Marketing cookies (Meta Pixel): up to 90 days.
• Transaction data (Naffy): 5 years from the end of the calendar year in which the transaction took place, in accordance with tax and accounting law.
• Live chat (Libredesk): for the duration of the conversation session and the period necessary to handle the request.

8. Profiling and automated decisions

The Website uses tools that may involve user profiling:

• Meta Pixel — may build user profiles for targeted advertising and remarketing on Meta platforms (Facebook, Instagram).
• Google Analytics (GA4) — analyses user behaviour on the site to produce statistical reports and audience segmentation.

Profiling does not lead to automated decisions producing legal effects for the user. You can withdraw your consent to profiling at any time by changing your preferences in the cookie banner or disabling the relevant cookies in your browser settings.

9. Your rights (GDPR)

Under the GDPR you have the following rights in connection with the processing of your personal data:

• Right of access — you have the right to obtain confirmation whether your personal data is processed, and access to it (Art. 15 GDPR).
• Right to rectification — you have the right to request the correction of inaccurate or completion of incomplete data (Art. 16 GDPR).
• Right to erasure — you have the right to request the deletion of your personal data (the "right to be forgotten") (Art. 17 GDPR).
• Right to restriction of processing — you have the right to request restriction of processing in specific cases (Art. 18 GDPR).
• Right to data portability — you have the right to receive your data in a structured, commonly used format (Art. 20 GDPR).
• Right to object — you have the right to object to processing based on legitimate interest (Art. 21 GDPR).
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR).

To exercise your rights, contact the controller at: kontakt@dexterlab.pl or use the contact form.

You also have the right to lodge a complaint with the supervisory authority — the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

10. Data sharing

Your personal data is not and will never be sold to third parties. Data may be shared only with the processors listed in section 5 of this Policy, and only to the extent necessary to fulfil the processing purposes. Every processor is bound by confidentiality and required to apply appropriate data protection measures.

11. Changes to this Privacy Policy

The controller reserves the right to amend this Privacy Policy. Changes may result from updates to the law, changes in the Website's functionality or the introduction of new tools. Users will be informed of material changes via appropriate notices on the Website. The current version of the Privacy Policy is always available at jak-zbudowac-strone.pl/en/polityka-prywatnosci.