PRIVACY POLICY
1. Controller and contact
The controller is Invert8 Grzegorz Michalski, ul. Sikorki 14/46, 31-589 Kraków, Poland, tax identification number (NIP) 6751302294. For personal data matters, contact office@invert8.com. I have not appointed a data protection officer.
2. Information and purposes
When you use the website, connection and request data are processed, including your IP address and browser information. This supports content delivery, troubleshooting and protection against abuse. The legal basis is Article 6(1)(f) GDPR: the legitimate interest in operating and protecting the website. Form protection also records a hash of the IP address, attempt counters and timing information; errors are logged with an error code and request identifier. The form collects your name, email, the scope of your needs and environment size. The issue description is optional; attachments are not supported. I use the information to respond and discuss possible cooperation: under Article 6(1)(b) GDPR when taking steps at your request before entering into a contract with you, or Article 6(1)(f) when you represent an organisation or exchange other correspondence. The legitimate interest in the latter case is handling that communication. Providing information is voluntary, but required fields and successful anti-spam verification are needed to submit the form. You may also email office@invert8.com. Do not send passwords, keys, special-category personal data or unnecessary information about other people.
3. Form protection
Cloudflare Turnstile analyses technical browser and connection signals, including IP addresses, to check for automated submissions. Failed verification may prevent submission. The legal basis for protection against abuse is Article 6(1)(f) GDPR. Cloudflare describes processing both on behalf of website operators and as a separate controller to improve bot detection. Provider information: https://www.cloudflare.com/turnstile-privacy-policy/. Turnstile protects the form; Cloudflare does not proxy all website traffic.
4. Analytics and your choice
I activate Google Analytics 4 only after analytics consent, under Article 6(1)(a) GDPR. No choice, or selecting “Essential only”, does not activate GA4. Analytics uses cookie identifiers, device information and activity on the website. The code does not send form fields to analytics. Analytics consent does not include advertising consent. Your choice is remembered in your browser. You can change or withdraw it through “Cookie settings” in the footer. Withdrawal blocks further measurement and removes GA cookies accessible to the website. If analytics has started, the page reloads after refusal is saved; the panel explains this beforehand. If saving is blocked, the choice may last only until the page is closed or refreshed; automatic reloading is skipped if it could restore an earlier consent. Withdrawal does not affect the lawfulness of earlier processing or automatically delete information already held by the provider.
5. Who participates in processing
I use providers for the following functions: Pulsar Projekt for website hosting and sending messages, using Atman infrastructure; Google Workspace for receiving and storing email; Cloudflare for anti-spam verification; and Google Analytics for statistics after consent. I am the only user with access to received enquiries. This does not exclude providers’ technical access when delivering their services. Information processed by Google and Cloudflare may be transferred outside the European Economic Area, including to the United States. The links below explain the arrangements and safeguards for each service. Google Workspace: its data processing terms provide for transfers covered by an adequacy decision or an applicable transfer mechanism. Google identifies the EU–US Data Privacy Framework for transfers to the United States covered by Google LLC’s certification. Where other transfers require safeguards, the terms provide for standard contractual clauses according to their applicable scope. Google Analytics 4: separate data processing terms for analytics services and transfer information describe reliance on adequacy decisions, including the EU–US Data Privacy Framework for covered transfers to the United States, and standard contractual clauses where applicable. Cloudflare Turnstile: the Turnstile privacy notice refers to Cloudflare’s privacy policy on international transfers. Cloudflare identifies the EU–US Data Privacy Framework for covered transfers to the United States, and standard contractual clauses where applicable for transfers requiring other safeguards. The links provide information about safeguards and the applicable terms, including contractual clauses. This does not mean that one mechanism applies to every service and every transfer.
6. Retention
I delete enquiries that do not lead to cooperation after 12 months from the last substantive contact, as part of a monthly review. I retain cooperation records according to their purpose: information needed for agreed work until the related obligations have been fulfilled; records subject to legal requirements until the applicable statutory retention periods expire (Article 6(1)(c) GDPR); and materials necessary to establish, exercise or defend claims until the limitation period applicable to the particular claim expires, or until an ongoing case concludes (Article 6(1)(f) GDPR). These criteria concern the relevant records, not automatically all correspondence. I retain logs and backups for 3 months. This period is not assigned to the form rate limiter: its counters use 15-minute windows and expired entries are removed on subsequent writes, without a separate schedule. The GA4 settings have been separately confirmed as: event data — 2 months; user data — 14 months. These are not retention periods for all Google data or cookie lifetimes. The settings do not cover every report; standard aggregated reports follow other rules described by Google. Google describes a default lifetime of 2 years for _ga and _ga_<identifier> cookies. This is a provider-documented default, separate from the GA4 retention settings above; actual lifetimes also depend on cookie settings and browser restrictions. Cookies may be removed earlier by the user or on consent withdrawal insofar as they are accessible to the website. The analytics choice itself remains in the browser until changed or website data is deleted, with no automatic expiry. Cloudflare describes retention criteria based on the collection purpose, the amount and sensitivity of information, the risk of misuse, whether the purpose can be achieved with less information, and applicable legal and contractual requirements. Its Turnstile notice does not give one numerical retention period for all signals. Its policy provides for deletion or destruction when the applicable period ends, or protection against further use where deletion is not technically possible. Turnstile pre-clearance is disabled, so I do not use the cf_clearance cookie issued by that feature. Anti-spam verification information is not included in the email. The validity of a single-use verification token is not Cloudflare’s data retention period.
7. Your rights
Subject to the conditions set by law, you may request access, rectification, erasure or restriction of processing. Data portability and objection rights apply where their requirements are met. You may withdraw consent at any time. For personal data matters, contact office@invert8.com. You may also complain to the President of the Polish Personal Data Protection Office or another competent supervisory authority.