Privacy Policy and Terms of Personal Data Processing
This is the English version of a document originally written in Polish. The controller is established in Poland and processing is governed by Regulation (EU) 2016/679 (GDPR) and Polish implementing law. In the event of any discrepancy between language versions, the Polish version prevails.
1. Data Controller
Controller of personal data (the controller is a natural person):
Dmytro Nechyporenko (a natural person conducting registered business activity in Poland)
ul. Williama Lindleya 16
02-013 Warsaw, Poland
Email: info@thenech.com
Phone: +48 733 765 023
LinkedIn: linkedin.com/in/dmytronch
Dmytro Nechyporenko operates under the brand “the nech” and bears full legal responsibility for the processing of personal data.
2. Data Protection Officer
No data protection officer has been appointed, because none of the conditions in Article 37 GDPR applies. For all data protection matters you can write directly to the controller at info@thenech.com.
3. Categories of Personal Data Processed
Data categories:
- Identification data: first name and surname.
- Contact data: email address, phone number.
- Company data: company name, position, industry, country.
- Correspondence data: the content of the messages you send me.
- Technical data: IP address, browser type, operating system, language.
- Cookie data: identifiers stored on your device.
- Analytics data: pages visited, time on site, traffic source.
I do not process special categories of data (Article 9 GDPR) and I do not ask you to provide them.
4. Purposes of Processing and Legal Basis
I process your data solely for the purposes listed below:
| PURPOSE | LEGAL BASIS | RETENTION PERIOD |
|---|---|---|
| Performance of a business consulting agreement | Art. 6(1)(b) GDPR | Term of the agreement plus 3 years |
| Replying to an enquiry sent through the contact form | Art. 6(1)(a) GDPR (your consent) | Until the enquiry is handled plus 12 months |
| Business correspondence | Art. 6(1)(b) GDPR | 3 years from the last contact |
| Tax and accounting obligations | Art. 6(1)(c) GDPR | As required by Polish law (5 years from the end of the financial year) |
| Direct marketing (newsletter, updates) | Art. 6(1)(a) GDPR (explicit consent) | Until consent is withdrawn |
| Website analytics and service improvement | Art. 6(1)(f) GDPR (legitimate interest) and consent for non-essential cookies | 38 months |
| Compliance with legal and judicial obligations | Art. 6(1)(c) GDPR | As required by law |
THERE ARE NO COMMERCIAL PURPOSES OTHER THAN THOSE LISTED.
5. Recipients and Processors
Your data may be accessible to:
- Infrastructure and IT providers: website hosting, email, backups and CDN, always under a signed data processing agreement.
- Form and newsletter providers: Brevo (Sendinblue SAS, France) for the newsletter and Web3Forms for relaying contact form submissions.
- Analytics and measurement providers: Google Ireland Ltd. and Google LLC (Google Analytics 4, Google Tag Manager, Google Fonts) and, if you consent to marketing cookies, LinkedIn, Meta and Vimeo.
- Project collaborators: only under a written agreement and only to the extent necessary to deliver the service.
- Public authorities and tax administration: where required by a court order or a legal obligation.
I NEVER sell or share your data with data brokers, marketing companies or any third party without your explicit written consent.
6. Transfers Outside the European Economic Area
The website, email and backups are hosted on servers located in the European Union.
Some of the services listed in section 5 are provided by companies based in the United States or by their European subsidiaries, which may transfer data to the United States. This applies in particular to Google (analytics, tag management and web fonts), to Web3Forms and, if you accept marketing cookies, to LinkedIn, Meta and Vimeo.
These transfers rely on the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) for certified providers and, where that does not apply, on the Standard Contractual Clauses approved by the Commission together with supplementary measures.
You can avoid most of these transfers by declining analytics and marketing cookies in the consent panel.
7. Your Rights
The GDPR gives you the following rights:
7.1 Right of access (Art. 15 GDPR)
You can ask me to confirm whether I process your data and obtain a copy of it together with information about the processing.
7.2 Right to rectification (Art. 16 GDPR)
You can ask me to correct inaccurate data or complete incomplete data.
7.3 Right to erasure (Art. 17 GDPR, the right to be forgotten)
You can ask me to delete your data, except where I must keep it under a legal obligation, in particular a tax or accounting one.
7.4 Right to restriction of processing (Art. 18 GDPR)
You can ask me to restrict processing while the accuracy of the data or the lawfulness of the processing is being verified.
7.5 Right to data portability (Art. 20 GDPR)
You can receive the data you provided in a structured, commonly used, machine-readable format, or ask me to transmit it to another controller.
7.6 Right to object (Art. 21 GDPR)
You can object to processing based on legitimate interest and, at any time and without justification, to processing for direct marketing.
7.7 Right to lodge a complaint (Art. 77 GDPR)
You can complain to the competent supervisory authority. Details are in section 18.
7.8 Right to be informed (Arts. 13 and 14 GDPR)
You have the right to know who processes your data, for what purpose and for how long. This document fulfils that obligation.
You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
8. How to Exercise Your Rights
Write to info@thenech.com.
Subject line: the right you want to exercise, for example “Request for access to my data”.
Content: your name, the email address you used to contact me and the specific request.
I reply within 30 days of receiving the request. If the case is complex, I may extend the deadline by a further two months and will tell you why. Exercising your rights is free of charge.
9. Data Security
I apply the following security measures:
- SSL/TLS encryption: all communication with the site is encrypted.
- Strong passwords: unique credentials and two-step verification where the service supports it.
- Access control: access to data limited to what is necessary.
- Backups: regular backups stored within the European Union.
- Monitoring: monitoring of access to the site and the infrastructure.
- Confidentiality agreements: with any collaborator who processes data.
- Security reviews: regular updates and reviews.
HOWEVER: no method of transmission over the internet is completely secure. I apply measures proportionate to the risk, but I cannot guarantee the absolute security of transmitted data.
10. Cookies and Tracking
10.1 Essential cookies
Required for the site to work: session, security, language and the record of your consent choice. They do not require consent.
10.2 Analytics cookies
They measure how the site is used (Google Analytics 4). They are set only if you accept them and you can withdraw consent at any time.
10.3 Marketing cookies
They allow campaign measurement and content delivery on third-party platforms (LinkedIn, Meta, Vimeo). They are set only with your consent.
MANAGING COOKIES: you can change your choice at any time through the consent panel on the site and delete stored cookies in your browser settings. Details are in the cookie policy.
11. Persons Under 18
the nech services are addressed to adults and to companies. I do not knowingly process data of persons under 18. If I discover that I have received data from a minor, I delete it without delay.
12. Retention Periods
Specific retention periods:
- Contact form data: 12 months or until the request is handled.
- Client data: term of the agreement plus 5 years (tax obligation).
- Newsletter data: until consent is withdrawn.
- Session cookies: until the browser is closed.
- Analytics cookies: up to 38 months.
- Access logs: up to 12 months.
13. Personal Data Breaches
In the event of a personal data breach I notify the supervisory authority within 72 hours of becoming aware of it, in accordance with Article 33 GDPR. If the breach is likely to result in a high risk to your rights, I inform you directly and without undue delay, in accordance with Article 34.
14. Changes to This Policy
I reserve the right to amend this policy with reasonable notice. Material changes are published on this page and, if you have consented to receive communications, announced by email as well. The date of the last update is shown at the top of the document.
15. Limitation of Liability
15.1 Informational nature of the content
Content published on thenech.com is informational and does not constitute legal, tax, financial or investment advice.
15.2 Scope of liability
I accept no liability for:
- business decisions you take on the basis of content published on the site;
- the operation of third-party sites linked from thenech.com;
- technical interruptions beyond my control;
- damage resulting from use of the site contrary to its purpose.
This limitation does not exclude liability that cannot be excluded under applicable law, in particular towards consumers.
16. Response Times
Response times:
- Enquiry sent through the contact form: 24 working hours.
- Request for access to data: 30 days.
- Request for rectification or erasure: 30 days.
- Objection or withdrawal of consent: without delay, and in any case within 30 days.
17. Contact and Dispute Resolution
Direct contact:
Dmytro Nechyporenko
Email: info@thenech.com
Phone: +48 733 765 023
If you disagree with how your data is processed: write to me first. Most cases are resolved in a conversation. If we do not reach a solution, you can turn to the supervisory authority.
18. Supervisory Authority
You can lodge a complaint with the Polish supervisory authority, competent for the controller’s place of establishment:
Urząd Ochrony Danych Osobowych (UODO)
ul. Stawki 2
00-193 Warsaw, Poland
Phone: +48 22 531 03 00
Website: https://uodo.gov.pl
If you are resident in another EU or EEA country, you may also lodge the complaint with your local supervisory authority, which will handle it in cooperation with the Polish authority under Article 77 GDPR.
19. Controller Identification Data
Full details of the data controller:
Name: Dmytro Nechyporenko
Legal form: natural person conducting registered business activity in Poland (CEIDG)
Address: ul. Williama Lindleya 16, 02-013 Warsaw, Poland
Email: info@thenech.com
Phone: +48 733 765 023
20. Governing Law and Language Versions
This policy is a binding document between you and Dmytro Nechyporenko. By using the site and my services you accept the terms set out in it.
Processing is governed by Regulation (EU) 2016/679 (GDPR) and by Polish law, in particular the Act of 10 May 2018 on the protection of personal data and the Act of 18 July 2002 on the provision of services by electronic means. The competent forum is that of the controller’s seat, without prejudice to the mandatory consumer protection rules of your country of residence.
This document exists in Polish, English, Ukrainian and Spanish. The Polish version is the reference version; in the event of any discrepancy it prevails over the others.