Privacy Policy

The data controller is Jakub Grabski Development. Contact: jakub@grabski.dev. Data is processed to handle inquiries and to deliver custom CRM development services.

• Contact form data — your name and company, email address, optionally a phone number (given only if you want a call back) and the content of your message — inquiry handling, replying to you and preparing a quotation.
• Technical data — server logs, IP address and the approximate location derived from it — website security, maintenance and abuse prevention on the form (a submission limit per address).
• Visit analytics (Google Analytics 4) — traffic statistics, content and UX improvements. Only with your consent.
• Advertising performance measurement (Google Ads) — checking which ad clicks end in an enquiry, and settling campaign spend. Under so-called enhanced conversions Google receives only an irreversible hash (SHA-256) of the email address and phone number given in the form — never the plain values. Only with your consent.

Art. 6(1)(b) GDPR (contract performance or steps prior to entering into a contract) — handling your enquiry and preparing a quotation. Art. 6(1)(f) GDPR (legitimate interests) — communication, website security and protection against form abuse. Art. 6(1)(a) GDPR (consent) — cookies and similar analytics and advertising technologies, including Google Analytics 4 and Google Ads, and the transfer to Google of hashed contact details under enhanced conversions.

Storing and reading information on your device is based on the electronic communications rules: without consent only what is strictly necessary to display the page is used. You can withdraw consent at any time with the “Cookie settings” button in the footer — it is as easy as giving it, and withdrawal does not affect the lawfulness of processing carried out beforehand.

The hosting and infrastructure provider (Vercel Inc.), the transactional email provider behind the contact form (Resend, Inc.) and — only after you consent to analytics and advertising cookies — Google Ireland Limited for Google Analytics 4 and Google Ads. Each of them acts on behalf of the controller and only to the extent required to perform the service entrusted to it.

Some of these entities belong to groups based in the United States, so data may be transferred outside the European Economic Area. Such transfers rely on the Standard Contractual Clauses approved by the European Commission or on an adequacy decision (Data Privacy Framework).

• Access, rectification, erasure, restriction of processing.
• Objection to processing, data portability.
• Withdrawal of consent to analytics and advertising cookies at any time — the “Cookie settings” button in the footer.
• Right to lodge a complaint with the supervisory authority (in Poland: the President of the Personal Data Protection Office).

Form data (including the phone number, if you provide one): until the enquiry and quotation period are completed, then per accounting obligations or until an objection is raised. Technical logs: for the period resulting from the hosting provider’s settings, and no longer than is needed to keep the website secure.

Your cookie decision: 12 months in your browser’s local storage — after that you are asked again. The ad click identifier (gclid, wbraid, gbraid): up to 90 days, and only if you consent to advertising cookies. Retention on the Google Analytics 4 and Google Ads side follows the settings of those services.