Privacy policy

1. Data controller

The controller of your personal data is INVESTIBULUM Jakub Tomaszewski, a sole proprietorship registered in Poland's CEIDG business register.

• Polish tax ID NIP: 9522221609
• Statistical REGON: 520281048
• Registered address: ul. Kormoranów 24 lok. 3, 05-420 Józefów, Poland
• Contact: hello@jakubtomaszewski.com

2. What data I collect

I collect only data I genuinely need to run the site and respond to your messages.

• From the contact form: first name, last name, email address, optionally company name, message body.
• IP address — stored temporarily (up to 1 hour) to protect against abuse and spam.
• Analytics data (Google Analytics 4, Microsoft Clarity) — only after your consent in the cookie banner.
• Cookies — detailed list in section 7.

3. Purpose and legal basis

• Responding to your form enquiry — Article 6(1)(b) GDPR (steps prior to entering a contract).
• Spam protection (IP rate-limit) — Article 6(1)(f) GDPR (legitimate interest of the controller).
• Analytics and site optimisation — Article 6(1)(a) GDPR (your consent).
• Consultation booking via Google Calendar — Article 6(1)(b) GDPR (pre-contractual measures).

4. Who I share data with

I rely on trusted providers acting as data processors. All of them maintain an appropriate level of data protection under GDPR:

• Vercel Inc. (USA) — site hosting. Standard Contractual Clauses (SCC) + DPF.
• Resend (USA) — outbound email delivery from the form. SCC + DPF.
• Google LLC (USA) — Google Tag Manager, Google Analytics 4, Google Workspace Appointment Scheduling. SCC + DPF.
• Microsoft Corporation (USA) — Microsoft Clarity. SCC + DPF.
• Cybot A/S (Denmark) — Cookiebot consent management platform. EU-based provider.
• zenbox.pl Sp. z o.o. (Poland) — domain and email hosting.

5. Data retention

• Form messages and ongoing correspondence — up to 24 months from the last contact.
• IP rate-limit logs — automatically deleted after 1 hour.
• Analytics data — according to providers' policies (GA4 up to 14 months, Clarity up to 12 months).
• Cookie consent settings (Cookiebot) — up to 12 months.

6. Your rights

At any time you may exercise the following rights:

• right of access to your data and to receive a copy,
• right to rectification of inaccurate data,
• right to erasure (the „right to be forgotten”),
• right to restrict processing,
• right to data portability,
• right to object to processing based on legitimate interest,
• right to withdraw consent at any time (without affecting the lawfulness of processing carried out before the withdrawal),
• right to lodge a complaint with the Polish data protection authority (President of the UODO, uodo.gov.pl).

To exercise any of these rights, write to hello@jakubtomaszewski.com. I respond within 30 days.

7. Cookies

The site uses cookies. Cookies are small text files stored by your browser — they let the site remember your preferences (like language) and help with traffic analysis.

Cookies are divided into four categories per the Cookiebot classification. Only necessary ones run without your consent — the rest require your choice in the consent banner on first visit.

• Necessary — required for the site to function. No consent needed (NEXT_LOCALE — remembers language; CookieConsent — stores your consent choice).
• Preferences — remember UI settings.
• Statistics — Google Analytics 4 (_ga, _ga_*), Microsoft Clarity (_clck, _clsk). Anonymous. Loaded after consent.
• Marketing — none in use at the moment.

You can change your preferences at any time by clicking „Manage cookies” in the footer, or by clearing cookies in your browser settings.

8. Changes to this policy

I may update this policy — particularly when providers or applicable law change. The latest version is always available at this address, with the update date shown at the top of the document.