1. Who is responsible
The controller is Patryk Wróblewski, Switzerland. You can reach me through the contact form on this website. No data protection officer is appointed because the current processing does not require one.
2. What data is processed
When you use the contact form, the site stores your name, email address, subject, message, selected language and submission timestamps. To limit abuse, it also stores a one-way fingerprint derived from your IP address, browser identifier and email address; the raw IP address and browser identifier are not stored in the contact-message record.
Like most websites, the hosting infrastructure necessarily processes request data such as IP address, time, requested URL, device or browser information and security events to deliver and protect the site.
3. Purposes and legal bases
Contact data is used to read your message, reply, maintain correspondence and protect the form from abuse. Under Swiss data protection law, processing follows the principles of transparency, proportionality and purpose limitation. Where the GDPR applies, the bases are taking steps at your request or performing a contract, legitimate interests in communication and service security, and compliance with legal obligations.
Optional analytics or marketing technologies rely on consent where consent is required. Refusing them does not limit access to the site or contact form.
4. Cookies and local storage
The site uses a necessary language cookie for up to one year to remember the selected language. It stores your privacy choice in your browser's local storage for up to 180 days so the banner does not reappear on every page. These preferences are necessary for the requested service and do not track you across websites.
With analytics consent, Google Analytics 4 (Google Ireland Limited / Google LLC) measures visits, page addresses, referring sites, device/browser information and interactions using pseudonymous cookie identifiers. Google receives technical request data, including your IP address. We do not send contact-form contents. Advertising signals and ad personalization are disabled. The _ga and _ga_* cookies expire after at most 180 days without renewal. Withdrawal in Privacy settings disables measurement, removes these cookies and reloads the page. Google may process data outside Switzerland and the EEA, including in the USA. Analytics report retention depends on the settings of this Google Analytics property; cookie lifetime is separate from report retention.
With marketing consent, Meta Pixel (Meta Platforms Ireland Limited / Meta Platforms, Inc.; pixel 1299529613441332) measures page views and a Lead event only after the contact API accepts a genuine message. Meta receives the page address and technical request, device/browser and cookie data, including the IP address and identifiers such as _fbp or _fbc when available. The integration sends no contact name, email, subject or message and disables automatic event discovery. Meta may use the event for campaign attribution, optimisation and audience measurement. Withdrawal blocks further events, removes Meta first-party cookies accessible to this site and reloads the page; third-party cookies remain controlled by Meta and the browser. Meta may process data outside Switzerland and the EEA, including in the USA.
With marketing consent, X Pixel (X Corp.; base pixel rft4t) measures site and landing-page visits and the Lead event tw-rft4t-rften only after the contact API accepts a genuine message. X receives the page address and technical request, device/browser and cookie data, including the IP address and a click identifier such as twclid when available. The integration sends no contact name, email, phone number, subject or message and does not create a Website Activity Audience. X may use events for campaign attribution and optimisation. Withdrawal blocks further events, removes the twclid first-party cookie accessible to this site and reloads the page; third-party cookies remain controlled by X and the browser. X may process data outside Switzerland and the EEA, including in the USA.
5. Service providers and international transfers
The site is built and hosted using OpenAI Sites and Cloudflare infrastructure, including a Cloudflare D1 database for contact messages. These providers process data on the controller's behalf to host, secure and operate the site.
Meta Platforms Ireland Limited and its affiliates process consented marketing event data under the applicable Meta Business Tools terms and privacy information. X Corp. processes consented marketing event data under the applicable X Ads terms and privacy information. Neither pixel is loaded without marketing consent.
Provider infrastructure may process data in Switzerland, the EEA or other countries. Where a transfer requires safeguards, the controller relies on an adequacy decision, approved contractual safeguards or another lawful transfer mechanism. Personal data is not sold.
6. How long data is kept
Contact messages are kept only as long as needed to handle the conversation, document relevant work or meet legal obligations, and are then deleted or anonymised. The retention decision considers whether the exchange led to an ongoing business relationship, a dispute or a legal record requirement.
The consent preference stays on your device until you change it, clear browser storage or the consent version expires. Hosting and security logs follow the provider's operational retention schedules.
7. Your choices and rights
Depending on the law that applies, you may ask whether your data is processed and request access, correction, deletion, restriction, portability or objection. You may withdraw optional consent at any time without affecting earlier lawful processing.
You may also complain to the Swiss Federal Data Protection and Information Commissioner or, where the GDPR applies, to the competent data protection authority in your country. Use the contact form to exercise a right; I may need enough information to verify the request safely.
8. Security and automated decisions
Reasonable technical and organisational measures are used to protect messages, including encrypted transport, server-side validation, rate limiting, access controls and a one-way anti-abuse fingerprint. No system is completely risk-free, so safeguards are reviewed as the site changes.
The site does not use contact data for automated decisions with legal or similarly significant effects.
9. Changes to this notice
This notice is updated when the data flow, providers, purposes or law materially changes. The date and version at the top show the current text. A new optional tracking purpose will require a fresh choice when legally required.