Privacy and cookie policy
Last updated: 26 September 2026
This policy explains what happens to personal data in connection with maciej.kankowski.pl. The site has no contact form, no account system and no newsletter. It sets one cookie of its own, and it loads Google Analytics only if you accept it.
1. Who the controller is
- Controller
- Maciej Kankowski, trading as mackan.it Maciej Kankowski
- NIP
- 5882448371
- REGON
- 383090756
- Contact
- maciej [at] kankowski.pl
No data protection officer has been appointed; appointment is not required under Art. 37 GDPR for processing of this scale.
2. What I process, why, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Answering an enquiry you send by e-mail or phone | Your name, e-mail address or phone number, and whatever you choose to write | Art. 6(1)(b) GDPR, steps prior to a contract; Art. 6(1)(f), my legitimate interest in replying to business correspondence |
| Anonymous traffic analytics, so I can see which parts of the page are read | Pseudonymous identifier, truncated IP address, browser and device type, pages viewed, approximate location | Art. 6(1)(a) GDPR, your consent, given in the cookie banner and revocable at any time |
| Serving the page and keeping the server secure | Server logs kept by the hosting provider: IP address, time, requested address, user agent | Art. 6(1)(f) GDPR, my legitimate interest in the availability and security of the site |
Providing any of this is voluntary. Without an e-mail address I cannot answer an enquiry; without analytics consent the page works exactly the same.
3. Recipients of the data
- OVH (OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, operating in Poland as OVH sp. z o.o.) hosts this website and its mailbox, and keeps the server logs.
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) provides Google Analytics 4, and only once you have accepted analytics cookies.
Nobody else receives data from this site. There is no advertising pixel, no heat-mapping tool, no embedded social media widget and no external font, script or image: every asset this page needs is inside the page file itself.
Transfers outside the European Economic Area
If you accept analytics, Google may process the data in the United States. Google Ireland Limited is the controller's counterparty in the EU, and the transfer relies on Google LLC's certification under the EU-US Data Privacy Framework, with the European Commission's standard contractual clauses as the fallback mechanism. If you decline analytics, no data leaves the EEA through this site.
4. Cookies
Before you make a choice in the banner, nothing is loaded from Google and no analytics cookie exists. Only after you press "Accept" is the Google Analytics script fetched and are its cookies written.
| Cookie | Set by | Purpose | Lifetime |
|---|---|---|---|
cookie_consent | This site | Remembers whether you accepted or declined analytics, so the banner does not reappear | 180 days |
_ga | Google Analytics | Distinguishes one visitor from another | 2 years |
_ga_SFNNFBY7Z8 | Google Analytics | Keeps the state of the analytics session | 2 years |
Withdrawing consent is as easy as giving it: the "Cookie settings" link at the bottom of the homepage reopens the banner, and choosing "Decline" stops analytics from loading on your next visit. You can also delete or block cookies in your browser settings at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
5. How long data is kept
- E-mail correspondence: up to 3 years from our last contact, or longer where tax or accounting law requires it for an engagement that was actually contracted.
- Analytics: the retention period configured in the Google Analytics 4 property, currently 14 months, after which event-level data is deleted by Google.
- Consent cookie: 180 days, after which the banner asks again.
- Server logs: for the period applied by the hosting provider, in line with its own documentation.
6. Your rights
Under the GDPR you have the right to: access your data and receive a copy; rectify it; have it erased; restrict its processing; object to processing based on legitimate interest; receive it in a portable format; and withdraw consent at any time. To use any of them, write to the address in section 1.
You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, Poland.
7. Automated decision-making
No personal data processed through this site is used for automated decision-making or profiling that produces legal effects for you. The site runs no AI system: no chatbot, no AI-driven personalisation and no profiling. How I use AI in my work is described in the engagement terms.
8. Links to other sites
The page links out to LinkedIn, Credly, jit.team and studio.mackan.pl. Those are separate services with their own privacy policies; nothing is sent to them until you click the link and open them yourself.
9. Changes to this policy
If the way the site processes data changes, this page changes with it, and the date at the top is updated. The version you are reading is the current one.
10. Contact
For anything related to privacy or cookies, use the details in section 1. See also the engagement terms.