Privacy and Cookie Policy – Łukasz Warchoł

I take your privacy seriously. This page explains what data is collected when you use this site, how it is used and what rights you have.

1. Data controller

The data controller is Specjalistyczna Praktyka Psychologiczna Łukasz Warchoł, Polish tax identification number (NIP): 7842290746, which operates lukaszwarchol.com.

Contact: kontakt@lukaszwarchol.com

2. What data is collected

Automatically collected data

The site may automatically collect the following information:

IP address, which is not retained in an identifiable form when Plausible Analytics is used;
browser type and operating system;
pages visited and time spent on the site;
referral source – the page from which you arrived.

Voluntarily provided data

If you subscribe to the newsletter, use one of the contact forms, book a meeting or contact me by email, I process the information you provide, such as your name, email address, message and selected meeting time, solely for the relevant purpose.

3. Purposes and legal bases of processing

Your data may be processed for the following purposes:

ensuring the proper and secure operation of the website;
analysing anonymous usage statistics, if you consent;
sending the newsletter, if you subscribe;
responding to enquiries and feedback;
arranging and managing meeting bookings.

The legal bases for processing are Article 6(1)(a) of the GDPR – consent, where you consent to optional analytics or subscribe to the newsletter; and Article 6(1)(f) of the GDPR – the controller’s legitimate interests, including operating and securing the website and responding to enquiries.

Where processing is required to take steps at your request before entering into a contract or to perform a contract, Article 6(1)(b) of the GDPR may also apply.

4. Cookies and analytics

Cookies are small text files stored on your device. The site uses essential cookies to remember your preferences and ensure that it functions correctly. It may also use optional, cookieless analytics if you consent.

Type or service	Purpose	Retention
Essential cookies	Remembering your theme, font size and consent preferences; ensuring the site functions correctly	Up to one year
Plausible Analytics	Anonymous website usage statistics; Plausible does not use cookies	Not applicable to cookies

Managing your preferences

On your first visit, a banner allows you to choose whether to enable anonymous analytics. You can change your preference at any time by selecting the cookie icon in the bottom-left corner of the page.

You can also manage cookies directly in your browser settings – including blocking them altogether. Please note that blocking essential cookies may affect the site’s functionality.

5. Local storage

In addition to cookies, the site uses your browser’s local storage to save:

your chosen colour theme – light or dark;
your font size preference;
your analytics preference.

This information remains on your device and is not transmitted to a server merely because it is stored locally.

6. Third-party services

The site may use the following third-party services:

Brevo, formerly Sendinblue – newsletter, contact form and feedback form services. Your email address and information submitted through the forms, such as your name and message, are shared with Brevo (Sendinblue SAS, France/EU) as a data processor for the purpose of delivering the newsletter or forwarding your message. Brevo Privacy Policy
Plausible Analytics – anonymous website usage analytics. Plausible does not use cookies and does not retain your IP address in an identifiable form. Data is processed on servers within the European Union by Plausible Insights OÜ, Estonia. Plausible Privacy Policy
Cal.com – meeting booking. If you use the booking calendar, the information you provide, such as your name, email address and selected time, is shared with Cal.com so that your booking can be handled. The site uses Cal.com’s European service instance at app.cal.eu. Cal.com Privacy Policy
Vercel – website hosting. Vercel processes server logs in accordance with its privacy policy. Vercel Privacy Policy

7. Online courses and webinars

This section covers courses that I organise and run in my own name, from the enrolment form on this site through the online session to the invoice and the certificate of completion. Where a course is organised by another entity and I am only the trainer, that organiser is the controller of your data and its own privacy notice applies.

What data is processed

Enrolment details: your name, email address, profession or specialisation, and the content of your message
Billing details: invoicing data, including company name, address and tax identification number, and payment information
Zoom session data: display name, email address, IP address, join and leave times, and the content of chat and questions
The course recording, including your image and voice, where the course is recorded and you consent to it

Purposes and legal bases

Purpose	Legal basis
Responding to your enquiry and agreeing dates and terms of participation	Article 6(1)(b) GDPR – steps taken at your request before entering into a contract
Running the course, providing materials, issuing a certificate	Article 6(1)(b) GDPR – performance of a contract
Organising and evaluating the course, including the post-course survey	Article 6(1)(a) GDPR – consent
Invoicing and accounting records	Article 6(1)(c) GDPR – legal obligation
Establishing, pursuing and defending legal claims	Article 6(1)(f) GDPR – the controller’s legitimate interests
Informing you about future dates and new courses	Article 6(1)(a) GDPR – consent
Recording the course and sharing the recording with participants	Article 6(1)(a) GDPR – consent, together with consent to the use of your image under Article 81 of the Polish Copyright Act

Providing your enrolment and billing details is a condition of taking part in a course. Consent to marketing messages and consent to recording are optional; you may take part without giving them and you may withdraw either at any time.

Zoom

Online courses are delivered through Zoom (Zoom Communications, Inc., USA), acting as a data processor under a data processing agreement. This involves a transfer of data outside the European Economic Area, which takes place on the basis of the standard contractual clauses approved by the European Commission. Zoom Privacy Statement

Recording

If a course is to be recorded, you are told before it begins and asked for separate consent. You may then take part with your camera and microphone switched off and use the chat instead, so that the recording captures neither your image nor your voice. Participants may not make their own recordings of a session.

Confidentiality

These courses are addressed to clinicians, so discussion often touches on real situations from practice. Please present examples in a form that makes the patient unidentifiable, and do not pass on what is said during a session. I do not collect data about your patients and do not wish to receive it.

Recipients of the data

Zoom – hosting the online session
Brevo – the enrolment list and correspondence about the course
My accountants and bank – settling the payment

Payment for a course is made outside this website, by bank transfer. No online payment provider is used and the site does not process card details.

How long the data is kept

An enquiry that does not lead to enrolment – 12 months
Accounting records – 5 years from the end of the tax year in which the tax obligation arose
Participant lists and certificates issued – 5 years
Evaluation surveys – up to 24 months after the course, or until you withdraw consent
The course recording – up to 30 days after the course, unless you withdraw consent sooner
Data used to inform you about future courses – until you withdraw consent

Where a matter is disputed, data needed to resolve it is kept until the proceedings conclude and until the limitation period for claims under the Polish Civil Code expires.

8. Your rights

Under the GDPR, you may have the following rights, depending on the circumstances:

the right of access;
the right to rectification;
the right to erasure – the “right to be forgotten”;
the right to restriction of processing;
the right to data portability;
the right to object to processing;
the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

To exercise any of these rights, contact me at kontakt@lukaszwarchol.com.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office, the Polish supervisory authority.

9. Data security

The site uses HTTPS, which encrypts data transmitted between your browser and the server. I take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure.

10. Changes to this policy

I may update this policy when the way the site operates or the services it uses change. Any significant changes will be communicated on this page. The date of the latest update appears at the top of the document.

11. Copyright

The content of this page and all materials published on lukaszwarchol.com are protected by copyright. Reproduction, distribution or use of these materials without written permission is not permitted, except where allowed by law.