DATA PROTECTION

Privacy policy

Effective from 11 July 2026

This policy explains how personal data submitted through the contact form on hadrianm.pl is processed. It is written in plain language — no legal noise, yet with the full set of information required by the GDPR.

Data controller

The controller of your personal data is Mateusz Hadrian, conducting business under the name Mateusz Hadrian, ul. Żmigrodzka 40/7, 51-120 Wrocław, Poland, tax ID (NIP): 8322016376 — operator of hadrianm.pl.

For any matter concerning your personal data, write to or use the contact form.

What data I process

From the contact form: your name, e-mail address, an optional topic and the message itself.

Automatically, at the technical layer: your IP address and basic browser information — used by the Cloudflare infrastructure (hosting, WAF firewall, the Turnstile anti-bot mechanism) solely to protect the site against spam and abuse.

The site runs no analytics, shows no ads and uses no cookies for marketing purposes.

Purpose and legal basis

  • Replying to your message and further correspondence — Art. 6(1)(f) GDPR (legitimate interest: communicating with a person who contacts me), and where the message concerns potential cooperation — Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract).
  • Protecting the site against spam, bots and abuse — Art. 6(1)(f) GDPR (legitimate interest: security of the service).

Data recipients

I use the following processors, which handle the technical side of the communication:

  • Resend (resend.com) — delivery of form e-mails (the notification to me and the automatic confirmation to you); sending infrastructure in the EU region (Ireland),
  • Cloudflare — site hosting, firewall and anti-bot protection (Turnstile),
  • OVH — the mailbox where the correspondence arrives and is stored.

Your data is never sold or shared with anyone for their own purposes (e.g. marketing).

Transfers outside the EEA

Resend and Cloudflare are US-based companies, so some data may be processed outside the European Economic Area. Such transfers rely on the Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR) and — to the extent the provider holds a current certification — the EU-U.S. Data Privacy Framework. The mailbox (OVH) is located within the EEA.

How long I keep the data

The form stores nothing along the way — your message goes straight to my mailbox. I keep the correspondence for as long as handling the matter requires and, if we start working together, for the limitation period of potential claims. Short-lived technical logs at the providers (e.g. delivery logs) are deleted automatically under their retention policies.

Your rights

In relation to the processing of your data, you have the right to:

  • access your data and obtain a copy of it,
  • have your data rectified,
  • have your data erased,
  • restrict the processing,
  • object to processing based on legitimate interest,
  • data portability.

To exercise these rights, simply write to me — contact details in section 01. You may also lodge a complaint with the President of the Polish Personal Data Protection Office (uodo.gov.pl) or your local supervisory authority.

Voluntary provision and automated decisions

Providing your data is voluntary, but without an e-mail address I will not be able to reply. I make no automated decisions and do not profile users — the anti-bot mechanism (Cloudflare Turnstile) only assesses whether the form is submitted by a human.

Changes to this policy

The current version of this policy is always available at this address. Material changes will be marked with a new effective date.