Webkowsky privacy policy

1. Controller and contact

The controller of personal data is William Karol Łepkowski, an individual working under the Webkowsky brand, referred to below as “the controller” or “I”.

You can use these details to contact me about privacy and your rights. The address below is a correspondence address; it does not describe a company registered office.

This policy covers webkowsky.com, contact with me, booking calls and handling the collaboration. Webkowsky is a brand, not a separate legal person. Settling work through Useme does not transfer responsibility for all data collected through my website to Useme.

• Email: will@webkowsky.com
• Correspondence address: ul. Dembego 22A/3, 02-796 Warszawa, Poland.

2. Data I process

The information depends on how you use the website and contact me:

I receive data primarily from you. I also receive booking information through Calendly and settlement information through Useme. If you contact me as a client representative, the client or another person involved in the project may provide your work contact details. In that case, I will tell you the source, scope and purpose of processing if you do not already have that information.

For an initial contact I do not need a national identification number, identity-document copies, passwords or health information. Please do not send them through the form or calendar. Data needed for a later settlement may be collected separately by the relevant service.

• Form: your name or the name you provide, email address, message contents, optional service selection, language and technical information about the enquiry and anti-spam check.
• Email: the sender address, correspondence and other information you share about your matter.
• Booking: name, email, meeting time, time zone and answers submitted through the Calendly form.
• Online meeting: participant name, connection details and voice, video or screen sharing, depending on the features used.
• Collaboration: contact and organisational details, project decisions and information needed for the agreed settlement.
• Website operation and security: technical data such as IP address, request time and parameters, requested resource, browser, operating system, errors and suspected abuse.

3. Purposes and legal bases

I do not treat every correspondence as contract performance. In particular, the contract basis does not automatically cover a client employee or a situation where Useme is the party to the client contract.

Sending an enquiry or booking a call does not automatically subscribe you to a newsletter or consent to later marketing unrelated to your matter.

4. Forms, email and Google Sheets

The form uses Vercel infrastructure, Cloudflare Turnstile anti-spam protection and Resend, which forwards the message to my contact mailbox. The verification result and a technical enquiry identifier support handling the enquiry and limiting abuse.

If you consent to analytics, I may include limited UTM campaign codes in the form message to connect a later call or business outcome with the enquiry source. The form works the same way without that consent, but I do not include campaign codes.

I receive correspondence at will@webkowsky.com. I save selected information in Google Sheets to organise contact and follow-up. This may include contact details, company name, enquiry subject, status and decisions. Moving information into a spreadsheet does not mean consent to use it for other purposes.

On the Webkowsky side, I am the only person with access to this spreadsheet. The account is protected with two-factor authentication. Zoho Mail, the spreadsheet provider and infrastructure providers also process data as part of operating their services. The spreadsheet is not made public.

5. Calendly and Google Meet calls

I use Calendly to book calls. Loading the calendar connects your browser to the provider’s infrastructure and sends technical browser and connection data. Booking data is sent after you submit it in the form. A booking may be linked with a calendar and an invitation message.

If you consent to analytics, I pass only limited UTM campaign codes to Calendly when opening the embedded calendar or its separate link, so I can identify the source of a booking. Without analytics consent, I do not add those codes to the link.

You do not have to use Calendly — we can agree a time by email or through the contact form. When you visit Calendly, you also use its own features and privacy settings. Calendly information about data processing.

A call may take place through Google Meet. Turning on your camera, microphone or screen sharing affects what is shared with other participants and the service provider.

Booking or holding a meeting does not itself mean that the meeting will be recorded. This version of the policy does not establish a standing process for recording or transcribing calls. If I propose one, you will receive separate information before it starts about the tool, purpose, access, storage period and legal basis. If consent is the basis, a call without recording will remain available. Consent to transcription will not be treated as consent to publish or advertise with your words.

6. Settlements through Useme

If we agree to settle work through Useme sp. z o.o., I may share data needed to identify the client, make contact, describe the work and settle it. You may provide some data directly to Useme.

For its own user, contract and settlement operations, Useme acts as a separate controller. It does not automatically receive every enquiry from my form. Its own processing is described in the Useme privacy policy.

7. Recipients

Data may go to the following providers or recipient categories, depending on the feature you use:

Providers may use subcontractors described in their documentation. Some activities are performed for the controller, while providers may be responsible for their own purposes. For example, Cloudflare distinguishes Turnstile processing for a customer from its own work to improve bot detection. Turnstile privacy policy.

I do not sell a contact database. If another contractor handles a defined part of a project, I will explain the related processing and limit the data shared to what the collaboration needs.

8. Processing outside the European Economic Area

Service providers may process data outside the EEA, particularly in the United States, through their infrastructure or technical support. A European server location does not always rule out access from another country.

Provider documents describe the following transfer safeguards, as applicable to the service and data involved:

The Data Privacy Framework does not automatically cover every organisation in the United States; the relevant recipient’s current certification and scope matter. If a transfer needs additional safeguards, using a well-known provider does not replace them.

You can ask about recipients, safeguards and how to obtain a copy by writing to will@webkowsky.com. A copy will take account of other people’s rights and legally protected information.

• Google: adequacy decisions, including the EU–US Data Privacy Framework for certified organisations in scope, and standard contractual clauses. Google transfer framework.
• Calendly: the Data Privacy Framework; its DPA provides standard contractual clauses as a fallback in the circumstances described there. Calendly DPA.
• Resend: standard contractual clauses and, where applicable, the Data Privacy Framework. Resend GDPR information.
• Cloudflare: transfer safeguards described in its DPA, including standard contractual clauses for transfers within its scope. Cloudflare DPA.
• Vercel: safeguards set out in the applicable service and processing terms. Vercel privacy and data processing information.
• Contentsquare: adequacy decisions, including the Data Privacy Framework within the scope of certification, and standard contractual clauses for other transfers requiring such safeguards, as described in the provider’s DPA. Contentsquare DPA.
• Zoho: its documentation describes European data centres and possible access from India for technical support, using standard contractual clauses. The actual mailbox and account settings determine the scope. Zoho privacy policy Zoho transfer FAQ.

9. Storage and deletion

I use the following periods and criteria:

These periods also cover working copies under my control. Data may be deleted sooner after a valid request, objection or end of purpose. An obligation to retain a particular document does not justify keeping all correspondence and all prospective-client data indefinitely.

Service backups may follow a separate rotating deletion cycle. I do not use them for ordinary further processing of data deleted from active sets. Resend retention, Vercel log retention.

10. Cookies, browser storage and the external calendar

Cookies and similar technologies may support website functions, security, settings or optional measurement. Whether consent is needed depends on the purpose, not only on whether the storage is called a “cookie”.

Calendly may use its own session and persistent cookies and local storage. The scope depends, among other things, on the service features, whether you are signed in to Calendly and your settings. Calendly provides information and preference management through its Cookie Settings / Your Privacy Choices panel. Calendly privacy notice and settings.

Cloudflare Turnstile protection processes technical signals needed to assess abuse. I do not use it for advertising or audience building. The form may require a check; direct email remains an alternative.

This website also stores the following settings and identifiers:

Optional analytics and advertising technologies that require consent do not receive it merely because you enter the website, scroll or read this policy. To change your choice, open “Cookie settings” in the footer, reject optional categories, or independently switch analytics, session replay and the calendar on or off. Calendly remains disabled until you give separate consent to the calendar category. Withdrawal does not automatically delete data already collected — contact me if you want to exercise a deletion right.

You can also manage storage in your browser settings. Blocking or deleting it may limit some features. Settings in one browser may not cover another device or the external Calendly service.

• webkowsky_consent — necessary cookie containing category choices, stored for up to 180 days.
• _ga and _ga_* — Google Analytics cookies after analytics consent; Google’s default is 2 years, subject to browser limits and renewal depending on visits.
• _cs_id — Contentsquare technical user identifier, 13 months; _cs_s — current-session data, 30 minutes and renewed with activity; _cs_c — replay-consent setting, 13 months; _cs_optout — tracking opt-out, 13 months. Contentsquare may set only some of these cookies depending on configuration.
• site.campaign.v1 and site.conversions.v2 — sessionStorage in the current tab for permitted, limited campaign codes and technical event deduplication; they are removed when analytics consent is withdrawn.
• Calendly may store its own cookies and browser-storage data after the calendar is enabled; Calendly determines their names and periods.

11. Optional analytics and session replay

After separate consent, I enable Google Analytics 4 through Google Tag Manager. It measures visits, traffic sources and contact outcomes. Events are limited and cleaned: I do not send form contents, names, email addresses, message contents or booking links to Google. Google Signals and ad personalisation are disabled.

After separate consent, I enable Contentsquare to analyse behaviour and replay sessions. Full masking is used; form, calendar and editable-field contents are additionally excluded from visible recordings. I do not set user identifiers or custom properties containing personal data.

After consent, providers may process technical session and event identifiers, visited pages, basic interactions (such as a page view and an accepted contact), traffic source, device and browser type, and approximate location. In the current tab I also store limited campaign codes and event-deduplication identifiers. I do not send form-field contents, names, email addresses, messages or booking links to analytics tools.

Analytics and session replay have separate choices. Consent for one category does not grant consent for the other or for the Calendly calendar. You can reopen “Cookie settings” in the footer and change the independent toggles. Withdrawal stops further optional-cookie use and loading of the relevant tool; it does not automatically delete data already collected.

Google Analytics and Contentsquare are not used to record your camera, microphone or private conversations. Provider information: Google Analytics, Contentsquare.

Google Ads, ChatGPT advertising and the LinkedIn Insight Tag are not active. Analytics consent does not activate them. Newsletters, cold email, customer lists sent to advertising platforms and remarketing are separate processes — this policy and an ordinary enquiry do not activate them.

12. Your rights

Within the limits set by the GDPR, you have the right to:

To exercise your rights, write to will@webkowsky.com or to the correspondence address above. I will reply without undue delay, generally within one month. If the law permits an extension because of complexity or the number of requests, I will explain the reasons and extension within that period; it will not exceed a further two months.

If I have reasonable doubts, I may ask for information needed to confirm your identity. If a request cannot be fulfilled, I will explain why. You do not have to contact me before making a complaint. EDPB explanation of rights.

• access your data and receive a copy;
• rectify your data;
• erase data or restrict processing;
• port data processed automatically on the basis of consent or contract;
• object, for reasons related to your particular situation, to processing based on legitimate interest;
• object unconditionally to direct marketing;
• withdraw consent at any time, without affecting the lawfulness of earlier processing;
• complain to the competent supervisory authority, in Poland the President of the Personal Data Protection Office — uodo.gov.pl.

13. Voluntary information and automation

Providing data is voluntary. Without the required contact details and information about your matter, however, I cannot answer an enquiry; without data required for a booking, I cannot handle it in Calendly. Missing data needed for a contract or settlement may make it impossible to perform. Additional fields remain optional.

I do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Anti-spam protection may technically reject an enquiry; you can then write directly by email.

This policy does not mean that your data will never leave Poland, or that every technical detail is anonymous. I protect it by limiting data and access and choosing appropriate processing rules.

14. Changes to this policy

I update this policy when processes, tools or controller details change. Before relevant processing begins, I provide information about a material change of purpose and obtain a new consent where one is needed.

Registering a business may require updates to identification and settlement details. If the controller changes, the people concerned will receive the appropriate information. A new version of this policy is not automatic consent to new purposes or recipients.