Polski

Privacy Policy

for the website: mateuszpoplawski.pl

§1. Data Controller

The controller of your personal data is Mateusz Popławski, a sole trader operating under the business name MatPop Digital Mateusz Popławski, place of business: Rydygiera 18/17, 01-793 Warsaw, Poland, entered in the Polish Central Register and Information on Economic Activity (CEIDG), tax identification number (NIP): 9492207271 (the "Controller").

You can contact the Controller on data protection matters at: [email protected]

Given the scale and nature of the processing, the Controller is not required to and has not appointed a Data Protection Officer (Article 37 GDPR). For all data protection matters, please use the contact above.

§2. Purposes and legal bases for processing

Your personal data is processed for the following purposes:

Handling correspondence and the contact form

Purpose: responding to your inquiry.

Legal basis: Article 6(1)(f) GDPR — the Controller's legitimate interest in maintaining correspondence, handling business inquiries, and establishing, pursuing, or defending claims — or Article 6(1)(b) GDPR (steps taken before entering into a contract).

Marketing and analytics (Google Ads, GA4, Meta)

Purpose: analyzing website traffic, optimizing the site, measuring conversions, and running advertising activities (including remarketing and building audiences).

Legal basis: Article 6(1)(a) GDPR (voluntary consent given through the Cookiebot consent management platform).

Booking an online meeting (Cal.com)

Purpose: enabling you to book a free consultation.

Legal basis: Article 6(1)(b) GDPR (steps taken at your request before entering into a contract) and 6(1)(f) (handling business contact).

Sending materials and the newsletter (from the SST calculator to MailerLite)

Purpose: sending the requested calculator report and — subject to separate consent — further marketing communication.

Legal basis: Article 6(1)(a) GDPR (consent to data processing, confirmed via double opt-in). The sending of commercial information and the use of email for direct marketing take place on the basis of a separate consent referred to in Article 398 of the Polish Electronic Communications Law of 12 July 2024 — independent of the consent to data processing.

Process automation (Make)

Purpose: technical handling of the flow of submissions between the form, the calculator, and email tools. Make acts as a processor on the Controller's behalf (see §6).

§3. Analytics and marketing tools

The following technology tools are used on this site to help measure the effectiveness of activities. Below are details of the technologies used:

Google Tag Manager (GTM)

The GTM container itself does not set cookies or collect personal data for marketing or analytics purposes — it only serves as a tag manager. An IP address may be transiently processed in the provider's technical logs. Provider: Google Ireland Limited.

Google Analytics 4 (GA4)

The Controller uses GA4 for statistical traffic analysis. In GA4, individual IP addresses of EU users are not logged or stored — the IP address is used only momentarily, on servers in the EU, for approximate (city-level) geolocation, and is then immediately discarded. GA4 neither applies nor requires the "IP masking" feature known from Universal Analytics — this mechanism is built in and non-configurable. Provider: Google Ireland Limited.

Google Ads

An advertising system; it may use cookies to build audiences (remarketing) and to measure conversions.

Server-side tagging (own tagging server, Stape)

For server-side measurement, the Controller uses its own tagging server (server-side GTM) hosted by Stape, with the server located in Poland (EU). The server receives measurement events server-side and forwards them to Google (GA4) and Meta (Conversions API). The tagging server operates based on Consent Mode — it respects the status of your consent and forwards only those events you have consented to; without marketing or statistics consent, data covered by that consent is not forwarded. The server-side model allows control over and limits the scope and manner of data transfer, but does not replace the legal basis for transfers to those providers (see §5). Stape acts as a processor; the container is hosted within the EEA.

Meta Pixel and Meta Conversions API (CAPI)

Once you give consent, Meta's measurement tool is activated. It collects, among other things, your IP address, browser information (user agent), cookie identifiers linked to your Facebook or Instagram account, the subpages you visit, and events (e.g., form submission), and — in the extended variant — hashed data (e.g., email address). The Controller uses this data to: (1) measure campaign effectiveness and conversions, (2) build and select audiences (custom and lookalike audiences), (3) target and optimize ads, including remarketing. Legal basis: consent (Article 6(1)(a) GDPR). Provider and joint controller: Meta Platforms Ireland Limited (see §9). You can withdraw consent at any time in the settings.

Cal.com (bookings)

A tool for booking online meetings. It processes the name, email address, and selected time slot of people booking a consultation. Cal.com acts as a processor under a data processing agreement. Provider: Cal.com, Inc. (USA) — see §5.

MailerLite (email marketing)

A tool for sending requested materials (including the SST calculator report) and the newsletter, with sign-up confirmation via double opt-in. It processes the email address and consent status. Data is processed and stored within the European Union (servers in the EEA, ISO 27001 certified); its sub-processors are based in the EEA — no transfer outside the EEA occurs. Provider: UAB "MailerLite" (Vilnius, Lithuania). Acts as a processor.

Cookiebot (CMP)

Manages your consent — it decides which scripts (analytics or marketing, including server-side) are run, depending on your choice. Provider: Cybot A/S (Denmark).

§4. Cookies and Consent Management

The site uses cookies.

In line with legal requirements, a detailed list of the cookies used, their categories (Necessary, Preferences, Statistics, Marketing), lifespan, and providers is generated automatically and kept up to date by Cookiebot.

You can check the current list of cookies and the status of your consent at any time by clicking the "Cookie Settings" icon/widget shown on the site or below:

The detailed cookie declaration is available in the cookie settings panel, opened via the icon in the corner of the screen.

Consent also covers server-side measurement — the tagging server operates continuously but respects the status of your consent (Consent Mode) and forwards only events covered by your consent.

Detailed Cookie List

Below is an automatically updated list of all cookies used on this site, with their detailed description, lifespan, and providers.

§5. Transfers of data outside the EEA

Some data may be transferred to countries outside the EEA, in particular to the USA. This takes place on the basis of:

  • the EU-U.S. Data Privacy Framework — the European Commission's adequacy decision of 10 July 2023 (successor to Privacy Shield; validity upheld by the judgment of the General Court of the EU of 3 September 2025 in case T-553/23), for providers that actually hold an active DPF certification;
  • Standard Contractual Clauses (SCC) approved by the European Commission — as a standalone or supplementary basis.

Specifically, transfers outside the EEA concern:

  • Google (GA4, Google Ads, Workspace) — Google LLC (USA): DPF + SCC.
  • Meta Platforms (Pixel, CAPI) — Meta Platforms, Inc. (USA): DPF + SCC.
  • Cal.com (bookings) — Cal.com, Inc. (USA): SCC (under a data processing agreement).
  • Make — operated by Celonis Inc. (USA); the Controller's account is run in the EU region, so data is stored in data centers within the European Union. Given the US entity and some sub-processors, any transfer relies on DPF (Celonis) + SCC.

Remaining fully within the EEA (no transfer): MailerLite and the Stape tagging server itself (container in the EU) — subject to the reservation that data forwarded onward to Google and Meta is covered by the mechanism described above.

A copy of the safeguards applied (Standard Contractual Clauses), or information on where to obtain them, can be requested by contacting the Controller: [email protected].

§6. Data recipients

Your data may be shared with entities that process it on the Controller's behalf, and with the joint controller:

  • Hosting: Netlify, Inc. (USA)
  • Email: Google Workspace (Google Ireland Limited)
  • Analytics: Google Analytics 4 (Google Ireland Limited)
  • Advertising: Google Ads (Google Ireland Limited)
  • Consent management (CMP): Cookiebot / Cybot A/S (Denmark)
  • Server-side tagging: Stape (sGTM hosting, container in PL/EU)
  • Bookings: Cal.com, Inc. (USA)
  • Email marketing: UAB "MailerLite" (Lithuania)
  • Automation: Make / Celonis Inc. (EU region / USA)
  • Remarketing and conversion measurement: Meta Platforms Ireland Limited — as a joint controller (see §9), not a mere processor.

§7. Your Rights

In connection with the processing of your data, you have the right to:

  • access your data, rectify, erase, or restrict its processing;
  • data portability;
  • object — to processing based on the Controller's legitimate interest (Article 21(1) GDPR), and, as regards direct marketing, an objection that the Controller shall absolutely uphold (Article 21(2) GDPR);
  • withdraw consent at any time (for data processed on the basis of consent, e.g., marketing cookies — via the Cookiebot settings). Withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal;
  • lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl) — if you believe the processing infringes the GDPR.

§8. Data retention periods

  • Correspondence / contact form (Article 6(1)(f) or (b)) — until the matter is concluded; where no cooperation follows, until the limitation period for claims expires (as a rule, up to 3 years).
  • Bookings (Cal.com) (Article 6(1)(b)) — until the meeting takes place; where no further cooperation follows, deleted after 12 months.
  • Newsletter and materials (MailerLite) (Article 6(1)(a)) — until consent is withdrawn or you unsubscribe; proof of consent (double opt-in) retained for accountability.
  • Analytics (GA4) (Article 6(1)(a)) — in line with the GA4 retention setting: 14 months.
  • Remarketing (Google Ads, Meta) (Article 6(1)(a)) — in line with audience settings (as a rule, up to 180 days from the last interaction).
  • Cookies (Article 6(1)(a)) — in line with the Cookiebot declaration (lifespan of each cookie).

§9. Joint controllership with Meta Platforms Ireland

With respect to data collected by the Meta Pixel and Conversions API and transmitted to Meta Platforms Ireland Limited, the Controller (MatPop Digital Mateusz Popławski) and Meta Platforms Ireland Limited are joint controllers within the meaning of Article 26 GDPR — for the phase of collecting and transmitting event data. Joint controllership covers only the collection of this data on this site and its transmission to Meta — for any further processing after receipt, Meta is solely responsible, in accordance with its own privacy policy.

The essence of the arrangement between the joint controllers is set out in Meta's "Controller Addendum", available at facebook.com/legal/controller_addendum. Regardless of that arrangement, you may exercise your rights under the GDPR both against the Controller and directly against Meta.

§10. Profiling

For marketing purposes, the Controller uses profiling that consists of building advertising audiences (remarketing, custom and lookalike audiences in Meta and Google). This profiling does not produce legal effects concerning you or similarly significantly affect you — Article 22 GDPR (automated decision-making) does not apply. It takes place only after consent has been given, and you can disable it at any time by withdrawing consent in the settings.

§11. Whether providing data is required

Providing your data is voluntary. For the contact form and bookings, providing your name and email address is a condition for, respectively, receiving a response or booking a time slot — without them, these purposes cannot be fulfilled. For the newsletter, providing your email address and giving consent is voluntary, and not doing so simply means you will not receive the materials.

§12. Changes to this Policy

Last updated: 18 July 2026. Version 2.0. The Controller reserves the right to update this Policy; changes are published on this page together with the date.