Privacy policy
This page explains what personal data I process, why, for how long and what your rights are. I keep it plain, but in line with the GDPR.
Effective from:
1. Data controller
The controller of your personal data is Ewa Kurowska, running a sole proprietorship under the business name Ewa Kurowska WORDS, Polish tax ID (NIP) 5842577205 (“I” or “the Controller”).
For anything related to your personal data, email me at kurowska.ewa@gmail.com.
I have not appointed a data protection officer – at the scale of my business this is not required.
2. What data and why
| Situation | Data | Purpose and legal basis | How long |
|---|---|---|---|
| You email or call me | name, email address, phone number, content of your message | replying to your question and possibly agreeing on cooperation – my legitimate interest (Art. 6(1)(f) GDPR), or, if you ask about a specific service, steps taken before entering into a contract (Art. 6(1)(b) GDPR) | up to 12 months after our last contact |
| You book a meeting via Calendly | name, email address, chosen time slot and any information you add when booking (if the form allows it) | arranging and holding the meeting – steps before entering into a contract or performing it (Art. 6(1)(b) GDPR) | up to 12 months after the meeting, unless we sign a contract |
| You use my services | data needed to perform the contract and issue an invoice (e.g. name, company name, address, tax ID) | performing the contract (Art. 6(1)(b) GDPR); accounting and tax obligations (Art. 6(1)(c) GDPR) | for the duration of the contract; accounting records for the period required by tax law (as a rule, 5 years from the end of the year in which the tax payment was due) |
| You ask me to record a session | video and audio recording of the session | performing the contract – the recording is part of the service you ask for (Art. 6(1)(b) GDPR). I share the recording only with you | up to 30 days after the session, then I delete it |
| In case of a dispute | data needed to show how our cooperation went | establishing, pursuing or defending claims – my legitimate interest (Art. 6(1)(f) GDPR) | until the relevant limitation periods expire |
| You visit the website | server logs: IP address, date and time, page visited, browser information | security and proper operation of the website – my legitimate interest (Art. 6(1)(f) GDPR) | up to 30 days |
| You accept analytics cookies | information about how you use the website, collected by Google Analytics | visit statistics to improve the website – your consent (Art. 6(1)(a) GDPR) | until you withdraw consent; cookie lifetimes are listed in section 6 |
| You accept marketing cookies | cookie identifiers and information about your visits, collected by the Meta Pixel and the LinkedIn Insight Tag | measuring ad performance and showing you my ads on Facebook, Instagram and LinkedIn – your consent (Art. 6(1)(a) GDPR) | until you withdraw consent; cookie lifetimes are listed in section 6 |
Providing data is voluntary. Without an email address or phone number, however, I can’t reply to your message, and without booking details I can’t arrange a meeting.
3. Who receives the data
The website runs on my own server – I don’t use an external hosting company. Data may be passed to the following service providers:
- Google (Google Ireland Limited) – Gmail email, Google Meet (online sessions) and Google Analytics;
- Calendly (Calendly LLC, USA) – meeting booking. You book on Calendly’s website, which has its own privacy policy;
- Meta (Meta Platforms Ireland Ltd.) – Meta Pixel, ads on Facebook and Instagram;
- LinkedIn (LinkedIn Ireland Unlimited Company) – LinkedIn Insight Tag, ads on LinkedIn;
- inFakt (InFakt sp. z o.o., ul. Szlak 49, 31-153 Kraków, Poland) – the accounting office that keeps my books; it processes invoice data on my behalf under a data processing agreement;
- Zoom (Zoom Communications, Inc., USA) – online sessions, if we meet on Zoom.
For the collection of data via the Meta Pixel and the LinkedIn Insight Tag and its transfer to these companies, I am a joint controller with Meta and LinkedIn, under these providers’ terms. After that, they process the data as separate controllers, under their own privacy policies.
4. Transfers outside the EEA
Google, Zoom, Calendly, Meta and LinkedIn may also process data in the United States. Such transfers are based on the European Commission’s adequacy decision (EU-US Data Privacy Framework) for companies certified under it, or on standard contractual clauses approved by the European Commission.
5. Your rights
You have the right to:
- access your data and receive a copy,
- have your data corrected,
- have your data erased,
- restrict processing,
- data portability,
- object to processing based on my legitimate interest,
- withdraw consent at any time – without affecting the lawfulness of processing before withdrawal. You can withdraw cookie consent in the cookie settings.
To exercise these rights, email kurowska.ewa@gmail.com. I’ll reply without undue delay, and within one month at the latest.
You also have the right to lodge a complaint with the Polish data protection authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa).
I don’t make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. If you accept marketing cookies, Meta and LinkedIn may tailor the ads they show you.
6. Cookies
Cookies are small files saved in your browser. This website uses them only if you agree in the banner. Without your consent, no analytics or marketing cookies are set. The only cookie always set is the one that remembers your choice in the banner, so I don’t ask you on every visit.
| Cookie | Provider | Purpose | Lifetime |
|---|---|---|---|
| ekw_consent | ekwords.com | necessary – remembers your choice in the banner | 12 months |
| _ga | Google Analytics | analytics – distinguishes users | 2 years |
| _ga_<ID> | Google Analytics | analytics – keeps session state | 2 years |
| _fbp | Meta | marketing – identifies the browser for advertising | 90 days |
| _fbc | Meta | marketing – stores an ad click | 90 days |
| li_fat_id, li_sugr, bcookie, lidc, UserMatchHistory, AnalyticsSyncHistory | marketing – measuring ad performance and ad targeting | from 24 hours to 1 year |
You can change your choice at any time via the “Cookie settings” link in the website footer. You can also delete or block cookies in your browser settings.
7. Security
The connection to the website is encrypted (SSL certificate). I keep the server updated, make backups and limit access to data.
8. Newsletter
I don’t currently run a newsletter and I don’t send commercial information without your consent. If that changes, signing up will be voluntary and confirmed by email, and every message will include an unsubscribe link.
9. Changes to this policy
When I change how I process data – for example, by adding a new tool – I’ll update this policy and the date at the top of the page.
This English version is provided for convenience. In case of differences, the Polish version prevails.