Privacy policy

Version dated 28 October 2026.

This privacy policy is available in Polish and English. The English version is a translation of the Polish version. Both versions are intended to provide the same information about the processing of personal data and your rights.

GDPR means Regulation (EU) 2016/679, the General Data Protection Regulation.

In brief

The controller is eComWizards Mikołaj Mielczarek. The form data (email address, message, optionally your name) is used to reply to your message.
Cloudflare hosts the site and Microsoft 365 handles the mailbox and call bookings; data may be transferred to the USA. The form is protected by Cloudflare Turnstile, which starts only with your consent.
Visit measurement runs only with your consent, which you can change at any time through “Cookie settings” in the footer.
I keep ordinary correspondence for no longer than 2 years after the matter ends; other periods are in the section “Retention”. Your rights and contact: kontakt@ecomwizards.pl.

Controller

Your data controller is eComWizards Mikołaj Mielczarek, ul. Moniuszki 4/4, 98-300 Wieluń, Poland, tax identification number (NIP) 8322021207. I run mikomiel.pl. For personal data matters, you can write to kontakt@ecomwizards.pl, use the contact form or send a letter to the controller's address.

Contact form and correspondence

In the form you provide your email address and message (you may give your name, but you do not have to). I use this information to reply and continue the conversation. Your email address is placed in the Reply-To field of the message so that my reply is sent to you.

I process the information needed to perform the contract for using the form under Article 6(1)(b) GDPR if you are a party to that contract. If you use the form on behalf of another entity, the legal basis for processing your data to that extent is Article 6(1)(f) GDPR, for my legitimate interest in providing the contact form service. The legal bases for further correspondence depend on its purpose and are described below.

If you get in touch about concluding a contract to which you would be a party, I process the necessary information to take steps at your request before entering into the contract (Article 6(1)(b) GDPR). If you act on behalf of another entity or write about something else, the legal basis is my legitimate interest in conducting correspondence and business contacts (Article 6(1)(f) GDPR).

I process information needed to establish, exercise or defend legal claims under Article 6(1)(f) GDPR, that is, in my legitimate interest in the legal protection of the business.

Providing the information is not a statutory requirement. Your email address is needed to reply, and the message to understand what you are writing about. Without them the form does not send the message. You may leave out your name. I do not use your message to add you to a marketing list.

Message delivery

Cloudflare Email Sending delivers your message to my Microsoft 365 mailbox. Its activity log records operational information, including the sender and recipient addresses, the message identifier, the delivery outcome and a fixed subject that contains none of the information entered in the form. I process this operational information to establish whether the message was accepted and delivered, and to investigate errors and abuse. The legal basis is Article 6(1)(f) GDPR. My legitimate interest is reliable and secure handling of correspondence. Email Sending message preview is disabled.

Protecting the form against abuse

I use Cloudflare Turnstile to distinguish human use of the form from automated abuse and to protect the availability of the form and the mailbox. For this, technical information is processed, including the IP address, User-Agent, browser and connection information and the verification result. I start Turnstile only after you consent to the “Form protection” category in the cookie settings. The legal basis for my processing of technical data to protect the form with Turnstile is your consent under Article 6(1)(a) GDPR. As part of the same choice, you also consent to the storage of information on, and access to information stored on, your device for this verification under Article 399 of the Polish Electronic Communications Law of 12 July 2024 (Prawo komunikacji elektronicznej).

Cloudflare processes this information on my behalf to protect the form. According to Cloudflare, it also processes it as a separate controller to improve bot detection, based on its own legitimate interest. The Turnstile privacy notice gives details.

After you consent, the Turnstile script loads only when you interact with the form. The check runs JavaScript tests and reads information about the browser and the connection. Turnstile reads technical information about the browser and connection for verification. Cloudflare's cookie list describes cookies used by its challenge platform; their use depends on the features enabled. I do not send the contents of the form fields or correspondence to Turnstile.

My form does not save a copy of the message in localStorage or sessionStorage.

Without this consent the form cannot send a message, but you can send the same message by email to kontakt@ecomwizards.pl without using Turnstile. I handle a message sent by email in the same way as a message sent through the form. You can withdraw your consent at any time through “Cookie settings” in the footer; withdrawal does not affect the lawfulness of processing before it. Browser settings and blocking the Turnstile script can also prevent submission; in that case, too, you can write to kontakt@ecomwizards.pl.

Turnstile itself does not receive the contents of the form fields or the correspondence. I use the token and the result of the current check to handle that specific attempt to send a message. I do not store the token in logs or correspondence. Technical data recorded in Workers Logs is described in the sections “Technical data and logs” and “Retention”.

Technical data and logs

I process technical request data, including the IP address, browser information, request time and necessary metadata, to deliver the site, keep it secure and available, and detect and fix errors. The legal basis is Article 6(1)(f) GDPR. My legitimate interest is running a secure, working site and form and preventing abuse.

My application's own log messages record the message delivery outcome, fixed error codes and information about failed Turnstile verification, including the reason and verification error codes. They do not include the message content, name, email address or Turnstile token. I record information about failed verification in Workers Logs to investigate errors and detect abuse, based on the legitimate interest described above. Cloudflare's system logs can contain request metadata and headers. The site's server does not store the form content in a database or a file store.

Booking and external links

The booking link opens my booking page in Microsoft Bookings. The details you give when booking, that is your first name, last name, email address and any note you add, go to the calendar on my Microsoft 365 account. I use them to arrange the call, send a confirmation and contact you if needed. If the call concerns a contract to which you would be a party, I process them to take steps at your request before entering into the contract (Article 6(1)(b) GDPR). In other cases the legal basis is my legitimate interest in organising requested meetings and maintaining contacts about my business and the topics of this site (Article 6(1)(f) GDPR). Giving the details is voluntary, but without the details the booking form requires you cannot book a time. Microsoft processes these details on my behalf. The retention period is in the section “Retention”.

On this site, I provide a link to an external Microsoft Bookings page rather than an embedded booking form. On the booking page, Microsoft may also process data for its own purposes under its Privacy Statement.

The LinkedIn and Instagram links also lead to external services, and their content is not automatically embedded on this site. When you click a link you leave mikomiel.pl, and the rules of that service apply.

Complaints

I use the data given in a complaint about how the form works to accept and handle it and to reply. To the extent needed to perform the contract for using the form, the legal basis is Article 6(1)(b) GDPR. I process the data of persons acting on behalf of other entities, and the records needed to document how a complaint was handled, under Article 6(1)(f) GDPR, in my legitimate interest in handling reports and legal protection.

Recipients

I use companies in the Cloudflare group for hosting, the contact form, message delivery and, with your consent, form protection and website analytics, and Microsoft for the mailbox and call bookings. For services performed on my behalf they act as processors. The separate role of Cloudflare in improving Turnstile is described in the section “Protecting the form against abuse”.

Microsoft's processing of data for its own purposes on the booking page is described in the section “Booking and external links”.

Transfers outside the EEA

In connection with the use of Cloudflare and Microsoft, data may be transferred outside the European Economic Area, including to the United States, also as part of infrastructure operations and staff access to data. Microsoft 365 mailbox data is stored at rest in the European Union, which does not rule out the cases of transfers outside the EEA described below. The main recipients in the USA:

Cloudflare, Inc.: hosting, the form, message delivery, logs and, with your consent, form protection and visit measurement.
Microsoft Corporation: Microsoft 365 (mailbox and call bookings).

Further recipients may include the sub-processors of these providers, in particular for cloud infrastructure, maintenance, technical support and account administration. According to Cloudflare's published list, its infrastructure and support sub-processors may operate outside the EEA in countries including the USA, the United Kingdom, Switzerland, Japan, South Korea, Canada, Australia, India, Singapore, the United Arab Emirates, Mexico and Malaysia. The list describes possible locations that depend on the service and the type of support, not a transfer of every kind of data to each of these countries. Microsoft describes the cases in which data is transferred out of the EU Data Boundary, including remote access by staff outside that area, in its EU Data Boundary documentation. The information about transfers outside the EEA also covers the Turnstile signals that Cloudflare receives and uses as a separate controller to improve bot detection, under the terms described in its privacy notice.

To the extent that a transfer is covered by Commission Implementing Decision (EU) 2023/1795 while it is in force and by the recipient's current participation in the EU-US Data Privacy Framework, the transfer relies on Article 45 GDPR. The participation of Cloudflare, Inc. and Microsoft Corporation was checked on 28 October 2026. To the extent that data is processed on my behalf, the data processing agreements with Cloudflare and Microsoft provide for the use of standard contractual clauses adopted by the European Commission under Article 46(2)(c) GDPR, in the cases specified in those agreements. Information about the recipients, countries and safeguards is available in those agreements, in Cloudflare's sub-processor list and in the Microsoft documentation referred to above. Information about the safeguards for Cloudflare's processing of Turnstile signals as a separate controller is also available in Cloudflare's privacy policy and the Turnstile privacy notice. You can request a copy of the safeguards at kontakt@ecomwizards.pl, through the form or by post.

Retention

Ordinary correspondence in Microsoft 365: for as long as needed to handle the matter, and then for no longer than 2 years after it ends, to keep a record of what was agreed and to answer follow-up questions. I delete information not needed for these purposes earlier.
Booking details in Microsoft Bookings: after the meeting takes place or is cancelled, I may keep the necessary organisational booking data in my legitimate interest in documenting the booking and clarifying matters related to the meeting (Article 6(1)(f) GDPR), for no longer than 12 months after the scheduled meeting date; I delete data that is not needed earlier. If correspondence continues after the call or a contract is concluded, I keep what is needed in the same way as that correspondence or the contract documents.
Complaint records: for as long as the complaint is being handled, and then for no longer than 2 years after it is closed, to be able to show the complaint, the reply and how the outcome was carried out. If the matter turns into a dispute, I keep the necessary records until the dispute ends.
Records needed to perform a contract and handle the related financial settlements: for as long as these purposes require. I process the data of the person who is a party to the contract to the extent needed under Article 6(1)(b) GDPR, and the data of representatives and contact persons under Article 6(1)(f) GDPR, in my legitimate interest in managing the business relationship and the related financial settlements.
Tax records, including tax books, registers and the related evidence, such as invoices: until the tax liabilities they concern become time-barred, as a rule 5 years from the end of the calendar year in which the tax payment deadline passed, taking into account any suspension or interruption of the limitation period and different obligations under specific provisions (Article 6(1)(c) GDPR in connection with tax law, in particular Article 86 § 1 of the Polish Tax Ordinance Act of 29 August 1997 (Ordynacja podatkowa)).
Records needed to establish, exercise or defend specifically assessed legal claims: only the documents selected as needed, for as long as that need justifies, and no longer than until the applicable limitation period expires, taking into account specific provisions, when the period starts, and its suspension or interruption. Unless a specific provision provides otherwise, the general limitation period is six years, or three years for claims for periodic performance and claims connected with running a business. Under Article 118 of the Polish Civil Code of 23 April 1964 (Kodeks cywilny), the limitation period ends on the last day of the calendar year, except where it is shorter than two years. If proceedings are brought, I keep the necessary records for as long as needed to conduct the case and give effect to the decision (Article 6(1)(f) GDPR).
Cloudflare Email Sending log: 31 days.
Workers Logs (the site's server logs): up to 7 days after the event, under the configuration in use.
I use the Turnstile token only to handle the current attempt to send a message and do not store it in logs or correspondence. The verification result is used to assess that submission attempt. I record information about failed verification, including the reason and Turnstile error codes, in Workers Logs for the period specified in the “Workers Logs” entry. Under the data processing agreement with Cloudflare, data processed during verification on my behalf is to be retained until the earlier of the expiry or termination of my services agreement with Cloudflare, or the date on which processing is no longer necessary for either party to perform its obligations under that agreement, to the extent applicable. Data that Cloudflare processes as a separate controller is kept under its Turnstile privacy notice.
Counterscale measurement data: in Cloudflare Workers Analytics Engine for 3 months after it is written, in line with how long that service keeps data; I keep no separate archive of summaries.
Unsampled Cloudflare Web Analytics data: 7 days, after which Cloudflare aggregates and samples it. The dashboard shows statistics for the last 6 months; this is the access window, not a confirmation that all technical data has been deleted.

Your rights

You can request access to your personal data, rectification (correction), erasure (deletion) or restriction of processing, subject to the conditions set out in the GDPR. The right to data portability may apply to data you provided, processed by automated means on the basis of consent or a contract; it does not cover processing based solely on legitimate interest. You can withdraw your consent to analytics or form protection at any time through “Cookie settings” in the footer. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. You can lodge a complaint with the President of the Personal Data Protection Office (UODO), the Polish data protection supervisory authority. You may also lodge a complaint with another competent supervisory authority under Article 77 GDPR, in particular in the Member State of your habitual residence, place of work or the alleged infringement.

I do not make decisions about people who visit the site or write through the form that are based solely on automated processing and would have legal or similarly significant effects on them. The automated check by Cloudflare Turnstile protects the form against abuse and is described in the section “Protecting the form against abuse”.

Right to object

You can object at any time to processing based on my legitimate interest (Article 21(1) GDPR). The objection must relate to your particular situation. After an objection I will stop processing the data, unless I demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed to establish, exercise or defend legal claims. You can send the objection to kontakt@ecomwizards.pl, through the form or by post to the controller's address.

Analytics and privacy settings

Measurement is off by default. I load analytics scripts only after you consent to the “Analytics” category; the legal basis for processing personal data for this purpose is consent (Article 6(1)(a) GDPR). You can accept measurement, refuse it or change your choice through “Cookie settings” in the footer. Refusing analytics consent does not limit your access to the site's content or the contact form.

You can withdraw your consent at any time. Withdrawal stops further collection of measurement data and does not affect the lawfulness of processing before it. I do not use data collected on the basis of consent on any other basis or for other purposes after you withdraw it. Measurement records contain no identifier linking them to your choice in the cookie settings. If I cannot link the records to you, I cannot delete them individually. I do not obtain additional data solely to identify you for the purpose of complying with data protection rights under the GDPR. If you provide information enabling that link, I will assess the matter under the GDPR. The periods specified in the “Retention” section do not override an obligation to delete data earlier where the GDPR requires it.

The Workers Analytics Engine interface I currently use does not provide a function for deleting individual records myself. This technical limitation does not override your rights or an obligation to delete data where the GDPR requires it.

Counterscale counts visits on my Cloudflare account; its script runs at analytics.mikomiel.pl. For each measured page view it records the page address (host and path, without parameters), the traffic source information described below, the country determined by Cloudflare and information about the browser and device derived from the User-Agent header: the browser name, its version with a partly masked number, and the device model and type. Measurement records also contain the full User-Agent header. It also records whether the view is the first one that day and whether the visit ended on a single page. It does not store the IP address in the measurement records, but the IP address is processed when the connection to the collector is handled. Workers Logs and log forwarding are turned off for the collector's Worker. I treat these records as personal data and apply data protection and storage limitation rules to them; combining them into statistics does not by itself anonymise them.

It determines the traffic source from a referring page on another website, removing the part of its address starting with “?”. If there is no such referring page, it sends the value of the first parameter found in the current page address as the traffic source, checking ref, referer, referrer, source and utm_source in that order. It also removes the part of that value starting with “?” and omits the value if it contains the address of this site. The parameter value does not have to be a web address.

Before measurement starts, the site removes from the current address in the browser the ref, referer, referrer, source and utm_source parameters whose values are not on a closed list of generic traffic source labels permitted for tagging my links to this site. From these parameters, the Counterscale script can obtain only a label from that list as fallback traffic source information. Measurement records created before 27 October 2026 may contain values obtained from these parameters that are not on the current list; the retention and deletion rules described in the “Retention” section apply to them.

Counterscale recognises further views by a timestamp in the browser's HTTP cache. The timestamp is separate for each measured site and is used to recognise further views only on the given day in UTC. The response carrying the timestamp may stay in the cache longer, until the browser removes it under its own rules, but before reusing it the browser checks it with the collector.

It sets no analytics cookies. Counterscale does not use the value of the cc_cookie cookie for measurement, but the browser may send that cookie with requests to the collector, because the collector runs on a subdomain of this site.

Cloudflare Web Analytics measures visits and website performance, including loading time and Core Web Vitals; its script reads performance metrics in the browser and sends them to Cloudflare. Measurement covers the page address and path, the referring page, the country and information about the device, operating system and browser. Cloudflare states that Web Analytics does not use cookies or localStorage to collect metrics and does not identify people by fingerprinting to present analytics. This does not mean that the connection to the service transfers no technical data, including the IP address, or that other features of my site do not use browser storage. I do not send form content to analytics. The Cloudflare Web Analytics documentation describes what is measured.

Cookies and browser storage

Below is what the site stores in your browser or reads from it, for what purpose and whether it requires consent. You can also set the conditions for storing and reading in your browser settings and through “Cookie settings” in the footer.

cc_cookie (essential, no consent needed): Remembers your cookie choice; cookie, 182 days. It stores the accepted categories and services, the banner revision number, a random identifier of the choice record, the time of the first and the last choice, the language and the expiry date. It serves to handle privacy settings, not visit measurement, profiling or advertising. Because of its domain setting, the browser sends it to the site's host and its subdomains, including the Counterscale collector at analytics.mikomiel.pl. The code of the site and the collector does not use its value for analytics and keeps no server-side record of choices based on it.
Cloudflare Turnstile (form protection, consent needed): Protects the contact form against spam and automated abuse; script from challenges.cloudflare.com, loaded only after you consent and interact with the form. Without this category turned on the form cannot send a message, but you can contact me by email without using Turnstile. The section “Protecting the form against abuse” describes storage in the Turnstile frame and Cloudflare's separate role in improving bot detection.
Counterscale (analytics, consent needed): Page visit statistics; sets no cookies; recognises further views on the same day (UTC) by a timestamp in the browser's HTTP cache, separate for each site; the response carrying the timestamp may stay in the cache longer, but the browser checks it with the collector before reusing it.
Cloudflare Web Analytics (analytics, consent needed): Page visits and website performance; script from static.cloudflareinsights.com, according to Cloudflare without cookies and localStorage.

Changes to this policy

I mark material changes to this policy, such as a new purpose, a new recipient or a change in how you exercise your rights, on this page and give the date of the version. I also inform people whose data I already process about changes that matter to them, clearly and effectively and in a way that suits the change, for example by email or by a notice on the site, and in advance where the nature of the change requires it. I inform you about a new purpose of processing before processing for that purpose starts. I start measurement operations that go beyond earlier consent only after obtaining new consent that covers them.