Privacy Policy — Ewelina Gaballa

Data controller

The data controller is Ewelina Gaballa, operating as a registered sole trader (jednoosobowa działalność gospodarcza), NIP 7743092612, REGON 544595992, registered address ul. Wierzbowa 6, 09-530 Gąbin. For data protection matters: ewelina@gaballa.pl.

Scope of data processed

We only process data you voluntarily provide — for example your name, email address, phone number, company name and the content of the message you send us. This data is needed to prepare an offer, correspond with you and deliver services. Providing this data is voluntary but necessary to respond to your enquiry and deliver services.

Purposes and legal basis

We process data for: (1) responding to enquiries and providing services — Art. 6(1)(b) GDPR; (2) complying with legal obligations, e.g. tax/accounting — Art. 6(1)(c) GDPR; (3) the legitimate interest of the controller, e.g. defending claims — Art. 6(1)(f) GDPR.

Retention period

Data related to the delivery of services is retained for the duration of the engagement and for the period required by applicable laws (e.g. tax law). Contact data from enquiries that do not result in an engagement is deleted after 12 months.

Recipients

Data may be shared with trusted providers supporting our work: email and communication providers (Google Workspace), hosting provider (Firebase Hosting / Google Cloud), project-management tools and accounting offices — strictly to the extent needed to deliver services.

Your rights

You have the right to access your data, rectify it, erase it, restrict its processing, port it, object to processing, and lodge a complaint with the Polish Data Protection Authority (UODO). To exercise these rights: ewelina@gaballa.pl.

Security

We apply technical and organisational measures appropriate to the data processed — including HTTPS, multi-factor authentication, and access limited to people who need it.

Server logs

The site is hosted on Firebase Hosting (Google Cloud). The hosting server automatically records standard technical data in its logs — including IP address, the date and time of the request, and browser type — to keep the site secure and working correctly. The legal basis is the legitimate interest of the controller (Art. 6(1)(f) GDPR).

International transfers

We use provider tools (Google Workspace, Firebase Hosting) that may process data on servers outside the European Economic Area. Where this happens, the transfer relies on Standard Contractual Clauses approved by the European Commission or other GDPR-compliant mechanisms.

Profiling and automated decisions

We do not make automated decisions and do not profile data subjects.

Changes

This policy may be updated. The current version is always available on this page.