Privacy policy

1. Data controller

DAWKOZ is Dawid Kozula’s brand. The controller’s full identity and address still need to be confirmed; a brand name alone does not identify the party responsible for processing personal data.

Person operating DAWKOZ

Dawid Kozula

Email

[email protected]

Please send privacy questions and requests for further information to the email address provided.

2. Data that may be processed

• Information you provide in a message: email address, name, phone number, company name and enquiry or project description, to the extent supplied.
• Information needed to agree, perform and bill for a project if we work together.
• Technical hosting or email data, such as IP addresses and connection information, if providers record these in their logs.

Do not provide information that is unnecessary to discuss your enquiry.

3. Purposes and legal bases

• Answering enquiries, preparing quotes and taking pre-contractual steps at your request: GDPR Article 6(1)(b), if you are the prospective contracting party.
• Contact with company representatives and correspondence: GDPR Article 6(1)(f); the legitimate interest is handling enquiries and cooperation.
• Performing a contract: GDPR Article 6(1)(b), for the contracting party's data.
• Meeting applicable legal duties, particularly billing record requirements: GDPR Article 6(1)(c).
• Establishing, pursuing or defending claims: GDPR Article 6(1)(f); the legitimate interest is protecting the controller's rights.
• Protecting the panel and preventing unauthorised access, including limiting login attempts — Article 6(1)(f) GDPR; the legitimate interest is the security of the services.

4. Email contact and website functions

Email links open your email application. Clicking an address does not send a message; you send it from your mailbox. Messages sent to [email protected] are forwarded to a Google-operated Gmail mailbox, where Dawid Kozula receives and handles correspondence.

The public website has no form that sends data to the server and no online payments. Contact links open an email application. The copy button writes DAWKOZ’s address to the clipboard without reading its previous contents.

The private /app panel is used by the DAWKOZ operator to prepare documents. It does not provide customer accounts. Document fields and imported projects remain in the tab’s memory; they are not sent to the server or automatically saved in browser storage. Downloaded files need to be protected on your own device.

The public customer panel demonstration uses sample data only. Changes remain in the tab’s memory and disappear when the page is reloaded. It is not a customer account or a place to submit documents or real personal data.

5. Cookies and browser preferences

The public website’s code contains no analytics, advertising pixels or advertising cookies. The private panel uses an essential session cookie after login.

The dawkoz_panel_session cookie maintains the operator’s /app session for up to 8 hours. It is marked HttpOnly and SameSite=Strict, and Secure in production. Logging out removes the cookie and invalidates the session; restarting the server also invalidates sessions. The cookie is not used for advertising.

Your choice to disable animations may be saved in browser local storage (localStorage, key dawkoz-pause-motion). This stores only the animation preference and is not used for advertising or tracking.

Your website language choice is saved in localStorage under the key dawkoz-language. This stores only the selected language code to preserve your preference on future visits.

Change preferences with the language and animation controls, or delete them by clearing website data in your browser. They remain until changed, deleted or cleared by the browser.

Additional cookies, logs and protection settings provided by the hosting service or CDN need to be checked in the live configuration. Describing the application code does not establish how all external services behave.

6. Recipients and service providers

As needed to operate the website and correspondence, data may be shared with these providers according to the services used:

• OVHcloud — domain and email services, to the extent used in the actual configuration.
• Cloudflare — DNS services and, when the proxy is enabled, traffic proxying. The actual scope and data recipients need to be confirmed in the domain configuration.
• Railway — platform running dawkoz.com.
• Google (Gmail) — provider of the mailbox receiving messages forwarded from [email protected].

Data needed to enter into a contract and handle billing may be shared with the actual seller or its authorised accounting service. The recipient, purpose and scope must be identified before the contract is concluded; no automatic access by another company to requests or calls has been agreed.

Data may also be disclosed to legally authorised bodies where a legal basis exists.

The providers’ relevant legal entities, service regions, retention, data processing agreements and any transfers outside the EEA and their safeguards still need to be confirmed. Merely naming a provider does not establish these arrangements.

7. Retention

Enquiry data is kept as needed to respond and correspond. Project data is kept during cooperation and afterwards to the extent and for the period required by law or needed to establish, pursue or defend claims.

Technical log retention periods and hosting and email provider retention settings require confirmation.

Panel sessions expire after 8 hours, logout or a process restart. Failed login attempts are counted for 15 minutes. The application does not keep a server-side archive of data entered into documents; users determine how long to protect downloaded files.

8. Your rights

Subject to GDPR conditions, you may request access, rectification, erasure or restriction of processing. Where legally applicable, you have rights to data portability and to object to processing based on legitimate interests.

If processing is based on consent, you may withdraw it without affecting the lawfulness of earlier processing. Send requests to [email protected].

You may also complain to the President of the Polish Personal Data Protection Office. Supervisory authority information is available at uodo.gov.pl.

9. Providing data voluntarily

Providing enquiry data is voluntary. Without contact details or information needed to define the scope, we may be unable to respond or quote. Data required for a contract follows from its performance and applicable law.

The described website version does not make decisions based solely on automated processing or carry out advertising profiling.