Version 1.0 · in force since 19 August 2026
This policy describes which personal data are processed when the website www.lukaswojcik.com is used, on what legal basis this happens, how long the data are kept and which rights the persons concerned have. It follows Regulation (EU) 2016/679 (GDPR) and the Polish Act on the Protection of Personal Data of 10 May 2018.
1. Controller
The controller within the meaning of Art. 4(7) GDPR is:
LW IT Solutions Company Lukas Wójcik
al. Tadeusza Kościuszki 80/82, lok. 301
90-437 Łódź, Poland
NIP: PL7252266190 · REGON: 369859995
E-mail: contact@lukaswojcik.com
A data protection officer has not been appointed, because none of the conditions of Art. 37(1) GDPR applies to an operation of this size. All matters concerning data protection are handled directly at the address above.
2. What shapes this website
Three decisions determine how little data this site actually needs, and they are worth stating before the individual processing operations are listed.
- The infrastructure is self-operated. The web server runs on hardware belonging to the controller, connected through a local access provider in Łódź, Poland. There is no external hosting provider, no content delivery network and no reverse proxy in front of it. Requests reach the controller’s own machine directly, which means no third party sees the traffic before it is answered.
- Nothing is loaded from third parties without need. Fonts, stylesheets, scripts and images are delivered from the site’s own domain. A Content Security Policy restricts, at browser level, which external origins may be contacted at all.
- Everything that is not strictly necessary is blocked until consent exists. Analytics scripts are held back by the consent management platform and are only released after an explicit decision. Refusing has no effect on the usability of the site.
3. Server log files
Every retrieval of a file from this website is recorded by the web server in a log file. This happens automatically and cannot be switched off, because without it a server cannot be operated securely. The following data are recorded:
- the IP address of the requesting device
- date and time of the request
- the path and name of the retrieved file
- the HTTP status code and the volume of data transferred
- the referring page, if the browser transmits one
- the browser identification string (user agent)
Purpose and legal basis: the logs serve to deliver the site, to detect and trace attacks, and to diagnose technical faults. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and stable operation of the server.
Storage period: log files are rotated daily and deleted automatically after 14 days. They are not merged with other data sources and are not used to build profiles.
4. Cookies and local storage
This site works without advertising cookies and without cross-site tracking. What is stored locally is limited to the following:
| Name | Type | Purpose | Duration |
|---|---|---|---|
pll_language | Cookie | Retains the chosen blog language (English, German, Polish) | 1 year |
lw-theme | Local storage | Retains the choice between light view, dark view and system default | Until deleted in the browser |
| Consent record of the consent management platform | Cookie / local storage | Retains which categories were accepted or refused, so that the banner is not shown again on every page | Up to 12 months |
wordpress_test_cookie, comment_author_* | Cookie | Set only when a comment is submitted; the comment fields are then pre-filled on the next visit | Session or 1 year |
_ga, _ga_* | Cookie | Google Analytics 4 – only set after consent, see section 6 | Up to 2 years |
mp_visitor_id | Local storage | MousePlayer: random identifier making repeat visits from the same browser distinguishable – only after consent, see section 7 | Until withdrawal or until browser data are cleared |
mp_session_data | Local storage | MousePlayer: identifier of the current visit together with its origin, so that paths across several pages are held together | 30 minutes without activity |
mp_pv_count_* | Local storage | MousePlayer: counter of page views within a visit | As the session |
mp_tab_id | Session storage | MousePlayer: tells apart several open tabs of the same session | Until the tab is closed |
Legal basis: for the language cookie, the display preference and the comment cookies, Art. 6(1)(f) GDPR together with the Polish Electronic Communications Law (Prawo komunikacji elektronicznej) – these entries are technically necessary for a function that was actively requested. For all analytics cookies, Art. 6(1)(a) GDPR, that is consent.
Stored cookies can be deleted at any time in the browser settings, and their storage can be prevented there in general. Blocking all cookies may cause the language selection and the display preference to be forgotten between visits.
5. Consent management
Consent for non-essential scripts is obtained and documented through the consent management platform Consented (consented.eu). That platform is another product of the controller named in section 1 and runs on the same self-operated infrastructure in Poland; loading it means the browser contacts the domain consented.eu, which is under the same operator and is not a third party. Its script runs before all other scripts and blocks the analytics services listed in sections 6 and 7 until a decision has been made.
When the banner is used, the decision is recorded on the controller’s own server so that the consent can be demonstrated later, as required by Art. 7(1) GDPR. The record contains:
- the decision itself, in the form
acceptedorrejected - the IP address at the moment of the decision
- the browser identification string, shortened to 255 characters
- the timestamp of the decision
Legal basis: Art. 6(1)(c) GDPR, since Art. 7(1) GDPR obliges the controller to be able to demonstrate consent. Storage period: for the duration of the consent and for a further three years afterwards, which corresponds to the general limitation period under Polish civil law.
A decision once made can be changed at any time through the cookie symbol at the lower edge of the page. Withdrawal takes effect for the future and does not affect the lawfulness of the processing carried out until then.
6. Web analytics with Google Tag Manager and Google Analytics 4
This website uses Google Tag Manager (container GTM-NKNSMSZ2) and, through it, Google Analytics 4. Both are services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager itself sets no cookies and collects no personal data on its own; it is a delivery mechanism for the tags configured within it.
Google Analytics 4 uses cookies to distinguish visits and to record how the site is used. The following are processed in particular: shortened IP address, pages viewed, time of access, duration of visit, approximate location derived from the IP address, device type, browser and operating system, and the source that led to the site.
IP anonymisation: Google Analytics 4 shortens IP addresses within the European Union before any further processing and does not store the full address.
Legal basis: Art. 6(1)(a) GDPR. Neither the container nor the analytics tag is loaded before consent has been given. Without consent nothing is transmitted to Google.
Transfer to third countries: data may be transferred to Google LLC in the United States. Google LLC is certified under the EU–US Data Privacy Framework, so that an adequacy decision of the European Commission pursuant to Art. 45 GDPR applies. In addition, standard contractual clauses pursuant to Art. 46(2)(c) GDPR have been concluded with Google.
Storage period: event data in Google Analytics 4 are retained for 14 months and then deleted automatically.
Further information is available in Google’s privacy policy at policies.google.com/privacy. Independently of the consent banner, a browser add-on offered by Google at tools.google.com/dlpage/gaoptout prevents transmission to Google Analytics.
7. Session recording and heatmaps (MousePlayer)
This website uses MousePlayer, a tool for recording and analysing sessions, under the channel identifier 955a45df5ee842cb. It captures how visitors use the website and then presents the sequence as a replay and as a heatmap. This is reviewed in order to identify usability barriers, drop-offs and technical errors. A session may also be followed live while it is happening; no separate notice is given at the moment someone is watching.
Of everything described in this policy, this is the most far-reaching processing. It therefore gets the most detail.
7.1 Who operates it
MousePlayer is not a third-party service here. It is developed and operated by the controller named in section 1, on that controller’s own infrastructure. Provider and controller are the same legal person, which is why no processing agreement pursuant to Art. 28 GDPR exists for it and no recordings are handed to an external analytics provider. The one external element is the encrypted backup described in section 7.8.
7.2 Data processed
- Device and environment data: browser and version, operating system, device class, screen resolution and window size
- Behavioural data: mouse movement and pointer paths, clicks, scroll depth, timestamps of interactions
- Navigation and origin: pages and addresses opened, landing page, referring domain, campaign identifiers
- The structure of the pages displayed, used solely to replay the session
- A random identifier assigned in the browser to tell visits apart
- The country derived from the IP address
7.3 IP address
The full IP address exists only in memory, for as long as establishing the connection, determining the country and preventing abuse require it. It is truncated before anything is written to the database. A visitor’s full IP address is neither stored nor displayed in the analysis.
7.4 Form input
Every character of every form input is replaced in the browser before it is transmitted. A replay shows that someone typed and how long they took – not what. Fields identified as password or payment fields always stay fully obscured. This full masking is the setting in force for this website.
One limit deserves to be stated plainly: what the website itself displays – a confirmation page repeating an address that was entered, for instance – is part of the page and therefore part of the replay.
7.5 Legal basis
Consent pursuant to Art. 6(1)(a) GDPR; for storing information on the terminal device and accessing it, additionally the Polish Electronic Communications Law (Prawo komunikacji elektronicznej). Without consent the script assigns no identifier, stores nothing, opens no connection and records nothing. A Global Privacy Control signal sent by the browser is honoured and takes precedence over an approval.
7.6 Withdrawal
Consent can be withdrawn at any time with effect for the future, through the cookie symbol at the lower edge of the page. Withdrawal takes effect immediately: recording stops, the connection is closed, data not yet transmitted is discarded rather than sent, and the identifiers stored in the browser are deleted.
7.7 Retention
Recordings are deleted automatically after no more than 365 days. Records of the consent decision itself are kept longer; they contain no behavioural data, only the fact, time and source of the decision.
7.8 Place of processing and recipients
Processing takes place on the controller’s own servers in Łódź, Poland. The recording script transmits to that infrastructure only. For backup purposes, an encrypted copy of the database is stored daily with Google Drive (storage location USA/worldwide); encryption happens before the transfer and the keys do not leave the controller. Google therefore holds a container it cannot open.
7.9 Seeing and deleting what is stored
The browser identifier described above is the key to the recordings. MousePlayer keeps a self-service page on which that key can be used to see how many sessions are stored under it, what period they date from and on which websites they were created – and to request their deletion. The page deliberately does not display the recordings themselves: the identifier is a key without a password.
My stored data – the link carries the identifier of this browser with it, so nothing has to be typed in on arrival. Where no consent was given, no identifier exists and nothing was recorded; the link then simply leads to the general page.
Independently of this, requests concerning recordings are answered at the address given in section 1, which is also the operator of MousePlayer. All rights set out in section 12 apply to them without restriction.
8. Contact form
The contact form on the start page and beneath the articles transmits the name entered, the e-mail address, the message text and the address of the page from which the form was sent. This last item makes it possible to see which article prompted the enquiry.
Purpose and legal basis: the data are processed solely in order to answer the enquiry. Where the enquiry concerns the initiation or performance of a contract, the legal basis is Art. 6(1)(b) GDPR; in all other cases Art. 6(1)(f) GDPR, with the legitimate interest lying in answering the enquiries addressed to the controller.
Storage: submitted messages are stored in a database on the controller’s own server and are not passed on to anyone.
So that a new enquiry is noticed promptly, a short push notification is sent through the messaging service Telegram. This notification deliberately carries no personal data. It contains the record number of the entry and the page from which the form was sent – and nothing else: neither the name, nor the e-mail address, nor a single word of the message. Reading an enquiry requires access to the database on the controller’s own server, so the content never leaves that machine.
Storage period: enquiries are deleted once the matter has been dealt with conclusively and no statutory retention obligation stands against deletion. Where an enquiry becomes part of business correspondence, the retention periods under Polish tax and accounting law apply, which normally amount to five years.
8.1 Spam protection with reCAPTCHA
The contact form is protected against automated submissions by reCAPTCHA v3, a service of Google Ireland Limited. reCAPTCHA analyses behaviour in the browser and returns a score between 0 and 1 which expresses how probable it is that a human is acting. Submissions below a score of 0.5 are rejected.
For this purpose reCAPTCHA processes the IP address, the duration of the stay on the page, mouse and keyboard movements, browser and device information, and it reads and sets cookies of the domain google.com. The check runs invisibly; no images have to be selected.
Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in protecting the form from misuse, which without such a check would make the contact route unusable within a short time. Anyone who does not wish reCAPTCHA to run can reach the controller by e-mail without using the form.
9. Comments on blog articles
Articles in the blog can be commented on. When a comment is submitted, WordPress stores the name entered, the e-mail address entered, the comment text, the time of submission, the IP address and the browser identification string. The IP address and the e-mail address are not published; they serve to combat spam and to allow enquiries in case of legal objections to a comment.
Legal basis: Art. 6(1)(a) GDPR for publication of the comment together with the chosen name, and Art. 6(1)(f) GDPR for storing the IP address, the legitimate interest lying in defence against abusive entries.
Storage period: comments and the associated data remain stored until the comment is deleted. Deletion can be requested informally at any time.
No external spam service is used for this. A comment by someone who has not had a comment approved before is held back and appears only after review, so comment data are not passed to any third party for filtering.
10. The Toolbox
The Toolbox contains a collection of technical tools – calculators, generators, validators and analysers. Almost all of them run entirely in the browser. The tools themselves send nothing: values entered are processed by the browser and are transmitted to no server. Anyone wishing to verify this can disconnect the network connection after the page has loaded, and the tools continue to work.
One tool departs from that. URL Pretty Print sends the address entered to the server, takes it apart there and returns the result. That address is not stored, and it does not appear in the log described in section 3 either, which records the path of a request but not the content of a form submission.
The session recording described in section 7 captures the displayed page, and would otherwise make readable a result that never left the browser on its own. The containers in which the tools display their results are therefore marked in the markup as areas to be masked. Before anything is transmitted, the recording replaces their content character by character. A replay shows that a result appeared and how much room it took – not what it said. Characters typed into a field are masked in any case.
The search function of the site follows the same principle. It loads a prepared index file and searches it locally in the browser. Search terms are not transmitted to the server and are not logged.
10.1 Tools with Google sign-in
Four tools are an exception, because their purpose is to read data out of a Google account:
- GTM Container History Deep Search Engine – scope
tagmanager.readonly - GA4 PII Checker – scope
analytics.readonly - GA4 Anomaly Detector – scope
analytics.readonly - GA4 Bot Detector – scope
analytics.readonly
These tools request a temporary access token through Google’s sign-in dialogue. The requested permissions are read-only in every case; none of these tools can change, create or delete anything in a Google account.
Limited Use disclosure. The use and transfer of information received from Google APIs by these tools adheres to the Google API Services User Data Policy, including its Limited Use requirements. In concrete terms: the access token and the retrieved data remain in the browser. They are not sent to the server of this website, not stored, not passed on to third parties, not used for advertising purposes and not used to train models. The token expires by itself and is gone at the latest when the browser tab is closed.
Legal basis: Art. 6(1)(b) GDPR, since the processing takes place solely in order to provide the function that was actively requested. The permission granted can be withdrawn at any time in the Google account settings at myaccount.google.com/permissions.
11. Recipients of the data
Data are only passed on where this is necessary for the purposes described above. The recipients are:
| Recipient | Purpose | Location | Basis for transfer |
|---|---|---|---|
| Google Ireland Limited / Google LLC | Analytics, Tag Manager, reCAPTCHA, API access for four tools | Ireland / USA | EU–US Data Privacy Framework, standard contractual clauses |
| Google LLC (Google Drive) | Storage of the daily encrypted database backup that includes the MousePlayer recordings; the keys do not leave the controller | USA / worldwide | EU–US Data Privacy Framework, standard contractual clauses |
Beyond this, data are only disclosed where a legal obligation to do so exists. Personal data are never sold, and they are never made available to advertising networks or data brokers.
12. Rights of the persons concerned
Every person whose personal data are processed has the following rights under the GDPR:
- Access (Art. 15 GDPR) – confirmation of whether data are being processed, and a copy of them
- Rectification (Art. 16 GDPR) – correction of inaccurate data and completion of incomplete data
- Erasure (Art. 17 GDPR) – deletion, provided no retention obligation stands against it
- Restriction of processing (Art. 18 GDPR) – a stop on processing while a matter is being clarified
- Data portability (Art. 20 GDPR) – receipt of the data in a structured, machine-readable format
- Objection (Art. 21 GDPR) – objection to processing based on Art. 6(1)(f) GDPR, on grounds arising from the particular situation of the person concerned
- Withdrawal of consent (Art. 7(3) GDPR) – withdrawal at any time, with effect for the future
These rights can be exercised informally by e-mail to contact@lukaswojcik.com. A reply follows within one month; where a request is complex, this period may be extended by two further months, in which case notification is given.
13. Right to lodge a complaint
Independently of any other remedy, a complaint may be lodged with a supervisory authority. The authority responsible for the controller is:
Prezes Urzędu Ochrony Danych Osobowych (UODO)
ul. Stawki 2
00-193 Warszawa, Poland
uodo.gov.pl
A complaint may equally be lodged with the supervisory authority of the place of residence or of the place where the alleged infringement occurred.
14. Obligation to provide data, automated decision-making
There is no legal or contractual obligation to provide personal data. The entries in the contact form and in the comment function are voluntary; without them, however, an enquiry cannot be answered and a comment cannot be published.
Automated decision-making within the meaning of Art. 22 GDPR does not take place. The reCAPTCHA score described in section 8.1 decides only whether a form submission is accepted, not about any matter of legal effect; a rejected submission can be sent by e-mail at any time instead.
15. Data security
The entire site is delivered exclusively over TLS-encrypted connections; unencrypted requests are redirected. A Content Security Policy limits which origins the browser may contact, which considerably reduces the effect of injected scripts. Access data for the database and for external services are held outside the web directory and appear in no source file that is delivered. The administration area is protected by additional access checks.
16. Changes to this policy
This policy is amended whenever a change in the services used or in the legal position requires it. The version currently in force is always the one retrievable here. Substantial changes will be indicated on the start page. The current version number and the date on which it took effect appear at the top of this page.