Privacy Policy — Kubicka.co

Hello! This is the website of Aleksandra Kubicka (kubicka.co). This policy explains what personal data I collect when you visit the site or get in touch, why I collect it, who I might share it with, and what rights you have.

I keep this simple on purpose. I don't sell your data, I don't run a shop, and I don't have sign-up forms or a newsletter. The only ways I end up with your data are: you contact me, or the site's cookies collect some basic information. That's it.

This policy is written in line with the EU General Data Protection Regulation (GDPR, known in Poland as RODO) and Polish data protection law.

The controller of your personal data is Clean Culture, NIP: 5842677326, which operates this website (kubicka.co).

If you have any questions about your data or want to exercise any of your rights, email me at aleksandra@kubicka.co.

I only process data that you give me yourself, or that is collected automatically through cookies. Here's the full picture:

If you email me or message me on LinkedIn. When you contact me, I process whatever is in your message — usually your name, email address, and the content of what you wrote. I use this to reply to you and continue our conversation. Legal basis: my legitimate interest in responding to people who reach out (Article 6(1)(f) GDPR). Note that LinkedIn is a separate service with its own privacy rules — when you message me there, LinkedIn also processes your data as its own controller, under its own policy.

If you book a call (Notion Calendar or Google Calendar). When you schedule a meeting with me, I process the details you enter — typically your name, email address, and anything you add about the meeting (and a phone number if you choose to give one). I use this to arrange and hold the call. Legal basis: taking steps at your request before or as part of providing a service, and my legitimate interest in organising meetings (Article 6(1)(b) and (f) GDPR).

Cookies and basic site data. When you visit the site, cookies may collect technical information such as your IP address, browser type, device, language, and how you move around the site. More detail is in the Cookies section below. Legal basis: essential cookies rely on my legitimate interest in running the site properly (Article 6(1)(f) GDPR); analytics cookies run only if you consent (Article 6(1)(a) GDPR).

Giving your data is always voluntary. But if you don't give me the basics — for example, an email address — I won't be able to reply to you or set up a call.

I only share data where it's needed to run the site or respond to you. Depending on what you use, your data may be handled by:

• —Google — for website analytics (Google Analytics), which runs only if you accept analytics cookies; Google Workspace, which runs my email (so it processes any message you send me); and Google Calendar, if you book a call.
• —Notion — where I organise my work and notes and take call bookings (Notion Calendar), so it may hold your booking details and contact information.
• —Cookiebot (Usercentrics) — the tool that runs the cookie banner and records your consent choices.
• —OVH — my hosting provider, which keeps the website running.

Each of these acts as my processor and handles your data only on my instructions. I may also have to share data with public authorities if the law requires it.

Some of the tools above are provided by companies based in the United States, so your data may be processed outside the EEA. In those cases, the transfer is protected in line with GDPR — usually through the European Commission's Standard Contractual Clauses.

• —Google (Google Analytics, Google Workspace and Google Calendar) — see how Google handles data:policies.google.com/privacy
• —Notion — see Notion's privacy policy:notion.so/notion/Privacy-Policy

My hosting (OVH) and my cookie-consent tool (Cookiebot / Usercentrics) are provided by EU-based companies, so the data they handle stays within the EEA.

If you don't want analytics tools to collect data about you, you can decline analytics cookies in the cookie banner or block them in your browser (see below).

I keep your data only as long as I need it:

• —Emails and LinkedIn messages — up to 2 years from our last contact, then I delete them unless there's a reason to keep them (for example, an ongoing conversation or legal obligation).
• —Call bookings (Notion Calendar or Google Calendar) and notes/contact details in Notion — up to 2 years from our last contact, unless there's a reason to keep them longer.
• —Analytics data — up to 2 years.
• —Cookies — according to your browser settings and your consent (see below).

I don't keep data "just in case". Once it's no longer needed, it goes.

Under GDPR you have the right to:

• —access your data,
• —correct it,
• —have it deleted,
• —restrict how it's processed,
• —move it to another provider (data portability),
• —object to processing,
• —withdraw your consent at any time (this doesn't affect anything done before you withdrew it),
• —complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warsaw. More atuodo.gov.pl

To use any of these rights, just email me at aleksandra@kubicka.co and I'll help.

What cookies are. Cookies are small files saved on your device when you browse the site. They help the site work properly and let me understand how it's being used.

The cookie banner. I use Cookiebot to manage cookies on the site. When you first visit, a banner lets you accept or decline each category of cookie, and it records your choice. You can reopen the banner and change your consent at any time.

The categories you can control. Cookiebot groups cookies into four types:

• —Necessary — needed for the site to work properly (for example, remembering your cookie choices). These run by default and don't need your consent.
• —Preferences — remember choices you make, such as language, to give you a smoother experience. Run only with your consent.
• —Statistics — help me see how people use the site so I can improve it. This is where Google Analytics sits. Runs only with your consent.
• —Marketing — used to show or measure ads. I only set these if I'm running marketing activity, and only with your consent.

Your control. You choose which categories to allow in the banner, and you can change your mind at any time. You can also block or delete cookies in your browser settings. If you turn some cookies off, parts of the site may work less smoothly.