{"id":12333,"date":"2026-08-19T18:31:24","date_gmt":"2026-08-19T16:31:24","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/privacy-policy\/"},"modified":"2026-09-28T17:11:48","modified_gmt":"2026-09-28T15:11:48","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/privacy-policy\/","title":{"rendered":"Privacy Policy"},"content":{"rendered":"
\n

Version 3.6 · in force since 28 September 2026<\/p>\n

This policy describes which personal data are processed when the website www.lukaswojcik.com<\/code> is used, on what legal basis this happens, how long the data are kept and which rights the persons concerned have. It follows Regulation (EU) 2016\/679 (GDPR) and the Polish Act on the Protection of Personal Data of 10 May 2018.<\/p>\n

1. Controller<\/h2>\n

The controller within the meaning of Art. 4(7) GDPR is:<\/p>\n

LW IT Solutions Company Lukas Wójcik
\nal. Tadeusza Kościuszki 80\/82, lok. 301
\n90-437 Łódź, Poland
\nNIP: PL7252266190 · REGON: 369859995
\nE-mail: contact@lukaswojcik.com<\/a><\/p>\n

A data protection officer has not been appointed, because none of the conditions of Art. 37(1) GDPR applies to an operation of this size. All matters concerning data protection are handled directly at the address above.<\/p>\n

2. What shapes this website<\/h2>\n

Three decisions determine how little data this site actually needs, and they are worth stating before the individual processing operations are listed.<\/p>\n

    \n
  • The infrastructure is self-operated.<\/strong> The web server runs on hardware belonging to the controller, connected through a local access provider in Łódź, Poland. There is no external hosting provider, no content delivery network and no reverse proxy in front of it. Requests reach the controller’s own machine directly, which means no third party sees the traffic before it is answered.<\/li>\n
  • Nothing is loaded from third parties without need.<\/strong> Fonts, stylesheets and images are delivered from the site’s own domain, and the comments do without pictures from an external avatar service. Without consent, the only thing loaded from an external server is the spam protection reCAPTCHA described in section 8.1. A Content Security Policy restricts, at browser level, which external origins may be contacted at all.<\/li>\n
  • Everything that is not strictly necessary is blocked until consent exists.<\/strong> Analytics scripts are held back by the consent management platform and are only released after an explicit decision. Refusing has no effect on the usability of the site.<\/li>\n<\/ul>\n

    3. Server log files<\/h2>\n

    Every retrieval of a file from this website is recorded by the web server in a log file. This happens automatically and cannot be switched off, because without it a server cannot be operated securely. The following data are recorded:<\/p>\n

      \n
    • the IP address of the requesting device<\/li>\n
    • date and time of the request<\/li>\n
    • the path and name of the retrieved file<\/li>\n
    • the HTTP status code and the volume of data transferred<\/li>\n
    • the referring page, if the browser transmits one<\/li>\n
    • the browser identification string (user agent)<\/li>\n<\/ul>\n

      Purpose and legal basis:<\/strong> the logs serve to deliver the site, to detect and trace attacks, and to diagnose technical faults. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and stable operation of the server.<\/p>\n

      Storage period:<\/strong> log files are rotated daily and deleted automatically after 14 days. They are not merged with other data sources and are not used to build profiles.<\/p>\n

      4. Cookies and local storage<\/h2>\n

      This site works without advertising cookies and without cross-site tracking. What this website stores locally is limited to the following; in addition there are the cookies which reCAPTCHA sets under the domain google.com (section 8.1):<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
      Name<\/th>\nType<\/th>\nPurpose<\/th>\nDuration<\/th>\n<\/tr>\n<\/thead>\n
      pll_language<\/code><\/td>\nCookie<\/td>\nRetains the chosen blog language (English, German, Polish)<\/td>\n1 year<\/td>\n<\/tr>\n
      lw-theme<\/code><\/td>\nLocal storage<\/td>\nRetains the choice between light view, dark view and system default<\/td>\nUntil deleted in the browser<\/td>\n<\/tr>\n
      Consent record of the consent management platform<\/td>\nCookie \/ local storage<\/td>\nRetains which categories were accepted or refused, so that the banner is not shown again on every page<\/td>\nUp to 12 months<\/td>\n<\/tr>\n
      comment_author_*<\/code><\/td>\nCookie<\/td>\nSet only if the box for saving them is ticked when a comment is submitted; on the next visit the name, e-mail address and website are then pre-filled, and the visitor’s own comment that is still awaiting approval is visible<\/td>\n1 year<\/td>\n<\/tr>\n
      wordpress_test_cookie<\/code><\/td>\nCookie<\/td>\nSet only when the blog’s login page is opened, to check whether the browser accepts cookies; reading and commenting do not create it<\/td>\nSession<\/td>\n<\/tr>\n
      _grecaptcha<\/code><\/td>\nLocal Storage<\/td>\nToken of the spam protection reCAPTCHA, see section 8.1 – created on pages with a form when the page loads, on tool pages only when a check is started<\/td>\nUntil deleted in the browser<\/td>\n<\/tr>\n
      _ga<\/code>, _ga_*<\/code><\/td>\nCookie<\/td>\nGoogle Analytics 4 – only set after consent, see section 6<\/td>\nUp to 2 years<\/td>\n<\/tr>\n
      rc_conv<\/code>, rc_seen<\/code>, rc_tab<\/code>, rc_theme<\/code>, rc_locale_wahl<\/code>, rc_dnd<\/code>, rc_dnt<\/code> and further entries beginning with rc_<\/code><\/td>\nLocal storage \/ session storage<\/td>\nChat, see section 6.2: the current conversation, messages already received, the view and language of the window, the wish not to be addressed again – without consent none of this is created<\/td>\nConversation 24 hours, settings up to 1 year<\/td>\n<\/tr>\n
      mp_visitor_id<\/code><\/td>\nLocal storage<\/td>\nMousePlayer: random identifier making repeat visits from the same browser distinguishable – only after consent, see section 7<\/td>\nUntil withdrawal or until browser data are cleared<\/td>\n<\/tr>\n
      mp_session_data<\/code><\/td>\nLocal storage<\/td>\nMousePlayer: identifier of the current visit together with its origin, so that paths across several pages are held together<\/td>\n30 minutes without activity<\/td>\n<\/tr>\n
      mp_pv_count_*<\/code><\/td>\nLocal storage<\/td>\nMousePlayer: counter of page views within a visit<\/td>\nAs the session<\/td>\n<\/tr>\n
      mp_tab_id<\/code><\/td>\nSession storage<\/td>\nMousePlayer: tells apart several open tabs of the same session<\/td>\nUntil the tab is closed<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      Legal basis:<\/strong> for the language cookie, the display preference and the comment cookies, Art. 6(1)(f) GDPR together with the Polish Electronic Communications Law (Prawo komunikacji elektronicznej<\/em>) – these entries are technically necessary for a function that was actively requested. For all analytics cookies, Art. 6(1)(a) GDPR, that is consent.<\/p>\n

      Stored cookies can be deleted at any time in the browser settings, and their storage can be prevented there in general. Blocking all cookies may cause the language selection and the display preference to be forgotten between visits.<\/p>\n

      5. Consent management<\/h2>\n

      Consent for non-essential scripts is obtained and documented through the consent management platform Consented<\/strong> (consented.eu). That platform is another product of the controller named in section 1 and runs on the same self-operated infrastructure in Poland; loading it means the browser contacts the domain consented.eu, which is under the same operator and is not a third party. Its script runs before all other scripts and blocks the services listed in sections 6 and 7 until a decision has been made.<\/p>\n

      When the banner is used, the decision is recorded on the controller’s own server so that the consent can be demonstrated later, as required by Art. 7(1) GDPR. The record contains:<\/p>\n

        \n
      • the decision itself, in the form accepted<\/code> or rejected<\/code><\/li>\n
      • the IP address at the moment of the decision<\/li>\n
      • the browser identification string, shortened to 255 characters<\/li>\n
      • the timestamp of the decision<\/li>\n<\/ul>\n

        Legal basis:<\/strong> Art. 6(1)(c) GDPR, since Art. 7(1) GDPR obliges the controller to be able to demonstrate consent. Storage period:<\/strong> for the duration of the consent and for a further three years afterwards, which corresponds to the general limitation period under Polish civil law.<\/p>\n

        A decision once made can be changed at any time through the cookie symbol at the lower edge of the page. Withdrawal takes effect for the future and does not affect the lawfulness of the processing carried out until then.<\/p>\n

        6. Services that load only after consent<\/h2>\n

        Three services stay held back until the consent management platform described in section 5 releases them: audience measurement with Google Analytics 4, the chat, and the Stats4U visitor counter. The session recording in section 7 follows the same rule.<\/p>\n

        6.1 Web analytics with Google Tag Manager and Google Analytics 4<\/h3>\n

        This website uses Google Tag Manager (container GTM-NKNSMSZ2<\/code>) and, through it, Google Analytics 4. Both are services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager itself sets no cookies and collects no personal data on its own; it is a delivery mechanism for the tags configured within it.<\/p>\n

        Google Analytics 4 uses cookies to distinguish visits and to record how the site is used. The following are processed in particular: shortened IP address, pages viewed, time of access, duration of visit, approximate location derived from the IP address, device type, browser and operating system, and the source that led to the site.<\/p>\n

        IP anonymisation:<\/strong> Google Analytics 4 shortens IP addresses within the European Union before any further processing and does not store the full address.<\/p>\n

        Legal basis:<\/strong> Art. 6(1)(a) GDPR. Neither the container nor the analytics tag is loaded before consent has been given. Without consent nothing is transmitted to Google.<\/p>\n

        Transfer to third countries:<\/strong> data may be transferred to Google LLC in the United States. Google LLC is certified under the EU–US Data Privacy Framework, so that an adequacy decision of the European Commission pursuant to Art. 45 GDPR applies. In addition, standard contractual clauses pursuant to Art. 46(2)(c) GDPR have been concluded with Google.<\/p>\n

        Storage period:<\/strong> Google Analytics 4 keeps two separate periods. Event data are retained for 2 months, user-level data for 14 months; both are deleted automatically once the period has run.<\/p>\n

        Further information is available in Google’s privacy policy at policies.google.com\/privacy<\/a>. Independently of the consent banner, a browser add-on offered by Google at tools.google.com\/dlpage\/gaoptout<\/a> prevents transmission to Google Analytics.<\/p>\n

        6.2 Chat<\/h3>\n

        A chat window is available on every page. Behind it stands Reactive Chat<\/strong>, another product of the controller named in section 1; it runs on the same self-operated infrastructure, and no external provider is involved. The window is loaded from the domain cdn.reactive.chat, and the exchange runs over a WebSocket connection to reactive.chat; both domains are under the same operator.<\/p>\n

        Already when the page loads:<\/strong> where consent exists, the window opens the connection immediately, not only when it is opened. What is transmitted then: the address and title of the page, the referring page, the browser language, the time zone, window and screen dimensions, whether the device is a mobile one, and campaign identifiers from the address such as utm_source<\/code> or gclid<\/code>. The server sees the IP address of the connection and the browser identification string; the IP address is not stored.<\/p>\n

        A conversation:<\/strong> what is stored are the messages with their time and direction, a session and a visitor identifier, the browser identification string, and the page on which the conversation began. Name and e-mail address are not asked for. Recognised e-mail addresses, phone numbers and card, tax and bank account numbers are replaced before storage – in the browser, and once more on the server.<\/p>\n

        The text of the page:<\/strong> when the window is opened, it reports the visible text of the page to the server, so that a question about that page can be answered; there it is stored. Form fields are left out entirely, and the result containers of the tools described in section 10 are marked as private – their content does not go along.<\/p>\n

        Answers from a language model:<\/strong> part of the answers is produced by a language model. It runs on the controller’s own machines in the local network; nothing goes to a provider of AI services or to a third country. The model receives the cleaned question, the conversation so far, extracts from a knowledge base of the site’s own pages, and the title and path of the page.<\/p>\n

        In the browser<\/strong> the chat stores entries under names beginning with rc_<\/code>; they are listed in section 4. Without consent, none of them is created.<\/p>\n

        Legal basis:<\/strong> Art. 6(1)(a) GDPR and, for the storage on the device, the Polish Electronic Communications Law in addition. Without consent the window is not loaded; withdrawal through the cookie icon takes effect for the future.<\/p>\n

        Storage period:<\/strong> no fixed period has been set for conversations so far; they remain stored until deletion is requested. The chat window has a button of its own for that, which removes conversation, messages and session immediately and completely; an informal message to the address in section 1 is equally sufficient. As soon as a period is set, it will be stated here.<\/p>\n

        6.3 Visitor counter (Stats4U)<\/h3>\n

        This website uses the Stats4U visitor counter (stats4u.net, LW IT Solutions Company, Łódź, Poland). When a page is opened, your browser loads a counter image from stats4u.net and, as a technical necessity, transmits its IP address, the browser identification and the address of the page being viewed.<\/p>\n

        The IP address is used to determine country and city approximately and to build a daily hash, which counts a visitor only once per day. It is not stored in the statistics. The daily hash is built with a secret salt that changes every day and is deleted after 2 days; after that it cannot be traced to anyone. The web server’s access log holds the IP address for up to 14 days.<\/p>\n

        The counter sets no cookies and reads nothing from your device. What is stored are daily totals: hits, visitors, country, browser, operating system, language, the pages of this website that were opened and the transitions between them, the domain of the referring page, events defined for this website, time on page, scroll depth, load time, and the entry and last page of a visit. They are kept for 400 days. Processing takes place in Poland; no data is transferred to third countries. For the duration of a visit there is additionally one row in the live list “who is on the site now”: country, city, the page currently open, browser, operating system, device type and language. It is deleted at the next nightly clean-up. While the page stays open the counter checks in about once a minute so that this row does not age prematurely; all it sends is the counter number, and nothing additional is stored.<\/p>\n

        The legal basis is our legitimate interest in audience measurement (Art. 6(1)(f) GDPR).<\/p>\n

        The statistics for this website are not publicly visible.<\/p>\n

        Stats4U privacy policy: https:\/\/www.stats4u.net\/privacy<\/a><\/p>\n

        7. Session recording and heatmaps (MousePlayer)<\/h2>\n

        This website uses MousePlayer, a tool for recording and analysing sessions, under the channel identifier 955a45df5ee842cb<\/code>. It captures how visitors use the website and then presents the sequence as a replay and as a heatmap. This is reviewed in order to identify usability barriers, drop-offs and technical errors. A session may also be followed live while it is happening; no separate notice is given at the moment someone is watching.<\/p>\n

        Of everything described in this policy, this is the most far-reaching processing. It therefore gets the most detail.<\/p>\n

        7.1 Who operates it<\/h3>\n

        MousePlayer is not a third-party service here. It is developed and operated by the controller named in section 1, on that controller’s own infrastructure. Provider and controller are the same legal person, which is why no processing agreement pursuant to Art. 28 GDPR exists for it and no recordings are handed to an external analytics provider. The one external element is the encrypted backup described in section 7.8.<\/p>\n

        7.2 Data processed<\/h3>\n
          \n
        • Device and environment data: browser and version, operating system, device class, screen resolution and window size<\/li>\n
        • Behavioural data: mouse movement and pointer paths, clicks, scroll depth, timestamps of interactions<\/li>\n
        • Navigation and origin: pages and addresses opened, landing page, referring domain, campaign identifiers<\/li>\n
        • The structure of the pages displayed, used solely to replay the session<\/li>\n
        • A random identifier assigned in the browser to tell visits apart<\/li>\n
        • The country derived from the IP address<\/li>\n<\/ul>\n

          7.3 IP address<\/h3>\n

          The full IP address exists only in memory, for as long as establishing the connection, determining the country and preventing abuse require it. It is truncated before anything is written to the database. A visitor’s full IP address is neither stored nor displayed in the analysis.<\/p>\n

          7.4 Form input<\/h3>\n

          Every character of every form input is replaced in the browser before it is transmitted. A replay shows that someone typed and how long they took – not what. Fields identified as password or payment fields always stay fully obscured. This full masking is the setting in force for this website.<\/p>\n

          One limit deserves to be stated plainly: what the website itself displays – a confirmation page repeating an address that was entered, for instance – is part of the page and therefore part of the replay.<\/p>\n

          7.5 Legal basis<\/h3>\n

          Consent pursuant to Art. 6(1)(a) GDPR; for storing information on the terminal device and accessing it, additionally the Polish Electronic Communications Law (Prawo komunikacji elektronicznej<\/em>). Without consent the script assigns no identifier, stores nothing, opens no connection and records nothing. A Global Privacy Control signal sent by the browser is honoured and takes precedence over an approval.<\/p>\n

          7.6 Withdrawal<\/h3>\n

          Consent can be withdrawn at any time with effect for the future, through the cookie symbol at the lower edge of the page. Withdrawal takes effect immediately: recording stops, the connection is closed, data not yet transmitted is discarded rather than sent, and the identifiers stored in the browser are deleted.<\/p>\n

          7.7 Retention<\/h3>\n

          Recordings are deleted automatically after no more than 365 days<\/strong>. Records of the consent decision itself are kept longer; they contain no behavioural data, only the fact, time and source of the decision.<\/p>\n

          7.8 Place of processing and recipients<\/h3>\n

          Processing takes place on the controller’s own servers in Łódź, Poland. The recording script transmits to that infrastructure only. For backup purposes, an encrypted copy of the database is stored daily with Google Drive (storage location USA\/worldwide); encryption happens before the transfer and the keys do not leave the controller. Google therefore holds a container it cannot open.<\/p>\n

          7.9 Seeing and deleting what is stored<\/h3>\n

          The browser identifier described above is the key to the recordings. MousePlayer keeps a self-service page on which that key can be used to see how many sessions are stored under it, what period they date from and on which websites they were created – and to request their deletion. The page deliberately does not display the recordings themselves: the identifier is a key without a password.<\/p>\n

          My stored data<\/a> – the link carries the identifier of this browser with it, so nothing has to be typed in on arrival. Where no consent was given, no identifier exists and nothing was recorded; the link then simply leads to the general page.<\/p>\n