Privacy policy
This policy explains what personal data we process when you visit vistulacode.com, contact us or discuss a project with us, why we do it, and what rights you have.
Who is responsible for your data
The controller of your personal data is Michał Araszkiewicz, running a business under the name VistulaCode Michał Araszkiewicz, al. Jana Pawła II 43a lok. 37b, 01-001 Warszawa, Poland, NIP 5311590360, REGON 141677609 ("VistulaCode", "we", "us").
For anything related to your personal data, write to hello@vistulacode.com or to the postal address above. We have not appointed a data protection officer, as the law does not require us to.
What this policy covers
This policy covers the website vistulacode.com, its contact form, and email correspondence with us about potential or ongoing work.
When we build AI systems for clients, we may process personal data contained in client data on the client's behalf. That processing is governed by our contract and data processing agreement with the client, not by this policy.
What data we process, why, and on what legal basis
Purposes, data, legal bases and retention Purpose Data Legal basis (GDPR) How long we keep it Responding to your inquiry sent through the contact form or by email, and discussing a possible project Name, work email, company, optional location or time zone, service of interest, project description, optional budget range and start time, and the content of our correspondence Art. 6(1)(b) — steps taken at your request before entering into a contract, where you contact us on your own behalf; otherwise Art. 6(1)(f) — our legitimate interest in answering business inquiries and communicating with representatives of prospective and current clients Until the inquiry is handled, then up to 12 months after our last contact, unless we start working together Concluding and performing a contract, including invoicing and project communication Contact and business details, correspondence, billing data Art. 6(1)(b) — performance of a contract with you; Art. 6(1)(c) — legal obligations under accounting and tax law; Art. 6(1)(f) — communication with client representatives For the term of the contract; accounting records for 5 years from the end of the calendar year in which the related tax payment deadline expired Protecting the contact form against spam and abuse IP address, browser and device information, interaction signals on the contact page assessed by Google reCAPTCHA, and the resulting risk score Art. 6(1)(f) — our legitimate interest in keeping the site and our mailbox secure IP addresses are kept in server memory for up to 10 minutes for rate limiting. We do not store reCAPTCHA scores. Google keeps reCAPTCHA data under its own policies Delivering and securing the website IP address, date and time of the request, requested address, browser user agent, referring page and technical error information Art. 6(1)(f) — our legitimate interest in running a secure, working website Application logs: up to 7 days. Cloudflare keeps network and security data under its own policies Website analytics, only if you allow it in the cookie banner Pseudonymous identifiers stored in cookies, pages viewed, interactions such as scrolling, outbound clicks and form submissions, referral source, device and browser type, and approximate location derived from your IP address Art. 6(1)(a) — your consent, which you can withdraw at any time. Storing analytics cookies on your device also requires consent under Art. 399 of the Polish Electronic Communications Law Event-level data: 2 months. User-level data: 14 months from your last activity. Cookies: up to 2 years, or until you withdraw consent Measuring how our ads in ChatGPT perform, only if you allow "Ads measurement" in the cookie banner The attribution identifier from the ad link you clicked, a random browser reference stored in cookies, pages viewed, the fact that an inquiry was submitted (we do not send its contents), the page address, and the IP address and browser information sent with each request Art. 6(1)(a) — your consent, which you can withdraw at any time, together with consent under Art. 399 of the Polish Electronic Communications Law for the cookies Cookies: 30 days (__oppref) and 365 days (__obref), or until you withdraw consent. OpenAI keeps measurement data under its own policies Establishing, pursuing or defending legal claims Data relevant to the matter Art. 6(1)(f) — our legitimate interest in protecting our rights Until the relevant limitation period expires Giving us your data is voluntary. Without the fields marked as required in the contact form we cannot reply to your inquiry, and without contact and billing details we cannot conclude a contract with you.
Please do not send special categories of personal data (for example health data) or confidential information about third parties through the contact form. If a project involves such data, we will agree how to handle it before you share it.
Who receives your data
We use the following service providers. Where they act as our processors, they process data only on our instructions under data processing terms:
- Cloudflare, Inc. (USA) — website hosting, content delivery, network security, and delivery of contact form messages to our mailbox (Cloudflare Email Service).
- Microsoft Ireland Operations Limited (Ireland) — Microsoft 365 email hosting for our mailbox, where inquiries and correspondence are stored.
- Google Ireland Limited (Ireland) and Google LLC (USA) — Google Analytics, only if you consent, and Google reCAPTCHA on the contact page. For reCAPTCHA, Google processes data under its own Privacy Policy and Terms of Service.
- OpenAI Ireland Limited (Ireland) and its affiliates, including in the USA — the ChatGPT ads measurement pixel, only if you consent. We and OpenAI may be joint controllers for collecting this data on our site and sending it to OpenAI. OpenAI's own use of it, for example to measure and improve ads, is governed by OpenAI's privacy policy.
- Accounting, legal and IT service providers we work with, where needed for the purposes above.
We may also disclose data to public authorities when the law requires it. We do not sell personal data. With your consent, OpenAI receives the ads measurement data described above; we do not share the contents of your inquiry with any advertising service.
Transfers outside the European Economic Area
Cloudflare, Google and OpenAI may process data in the United States. Cloudflare and Google are certified under the EU–U.S. Data Privacy Framework, which the European Commission found to provide an adequate level of protection (decision of 10 July 2023). Where a transfer is not covered by that framework, our providers rely on the European Commission's standard contractual clauses. OpenAI relies on adequacy decisions and standard contractual clauses, as described in its privacy policy.
Microsoft stores our Microsoft 365 data in the EU, but some processing, such as support or security operations, may involve transfers protected by the same mechanisms.
Your rights
Under the GDPR you have the right to:
- access your data and receive a copy of it (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- restrict processing (Art. 18);
- receive your data in a portable format, where processing is based on consent or a contract and carried out by automated means (Art. 20);
- object at any time to processing based on our legitimate interests, on grounds relating to your particular situation (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.
To exercise your rights, write to hello@vistulacode.com. We will respond within one month; in complex cases this can be extended by up to two further months, and we will tell you if it is. We may ask you to confirm your identity.
You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You can also contact the authority in the EU country where you live or work.
Automated decisions
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Google reCAPTCHA automatically assesses whether a form submission looks automated, and a submission with a very low score is not delivered. If your message is blocked, email us directly at hello@vistulacode.com.
How we protect your data
The site is served only over encrypted connections (HTTPS). Access to inquiries and correspondence is limited to the people who handle them. Form submissions are sent to our mailbox and are not stored in a separate database on the website.
Children
This website is intended for businesses. It is not directed at children, and we do not knowingly collect data from anyone under 16.
Changes to this policy
We will update this policy when our processing changes. The date at the top shows when the current version took effect. If a change significantly affects how we use data you have already given us, we will tell you directly where we can.