1. Who is responsible for your data
This website, oleksiak.dev (including its subpages such as the cookie-compliance service page and the portfolio), is operated by:
Marcin Oleksiak
Email: marcin@oleksiak.dev
I am the data controller for personal data processed through this website, within the meaning of the UK General Data Protection Regulation (UK GDPR) and, where it applies to visitors from the European Economic Area, the EU General Data Protection Regulation (Regulation (EU) 2016/679).
2. What data is processed, why, and by whom
This is a small, mostly informational website. It does not require accounts and collects only the data described below.
2.1 Server logs (hosting)
The website is hosted by Spaceship. When you visit any page, the hosting infrastructure automatically records technical access data: your IP address, date and time of the request, the page requested, browser type and version (user agent), and referrer URL.
This is necessary to deliver the website, keep it secure, and diagnose technical faults. Log data is not combined with other data sources and is retained only for as long as the hosting provider's standard log-rotation requires. As Spaceship is based in the United States, this may involve a transfer of data outside the UK/EEA — see section 5.
2.2 Contact form
The contact form on the cookie-compliance page is processed by Formspree, which forwards your submission to my email inbox. Depending on what you fill in, this includes your name, email address, website URL, company name, selected services, and message.
I use this data solely to respond to your enquiry and prepare a quote — the legal basis is that processing is necessary for steps taken at your request prior to entering into a contract. Formspree's own privacy practices are described in its privacy policy.
2.3 Email
If you email me at marcin@oleksiak.dev, I process your email address and the contents of your message in order to reply and handle your request.
2.4 Analytics
This site uses Google Analytics to understand how visitors use it (pages viewed, approximate location, device type). Analytics cookies are only set after you give consent through the cookie banner. If you decline, no analytics cookies are set.
You can withdraw your consent at any time using the button in section 3 below.
2.5 Consent management
Cookiebot manages the cookie consent banner and stores your consent choice. To be able to demonstrate that valid consent was given (as the law requires), Usercentrics logs your anonymised IP number, the date and time of consent, browser user agent, the URL from which consent was submitted, and your consent state.
2.6 Google Fonts
The Inter typeface is loaded from Google's font servers. When your browser fetches the font files, your IP address is transmitted to Google. Google states that font requests are not used for profiling and are stored separately from other Google services. My legitimate interest is the consistent, fast display of this website's typography.
3. Cookies
A full, automatically maintained list of every cookie used on this site — including its name, provider, purpose, and expiry — is shown below. This declaration is kept up to date by monthly automated scans.
You can change or withdraw your cookie consent at any time:
4. Who receives your data
Your data is shared only with the service providers named in section 2, acting as processors or independent controllers:
- Spaceship, Inc. — website hosting
- Formspree, Inc. — contact form processing
- Google — analytics (with consent) and font delivery
- Usercentrics A/S (Cookiebot) — cookie consent management
I do not sell personal data, and I do not share it with anyone else unless required by law.
5. International transfers
Some of the providers above (Spaceship, Formspree, Google LLC) are based in the United States, which means personal data may be transferred outside the UK and the European Economic Area. Such transfers rely on appropriate safeguards: the UK Extension to the EU–US Data Privacy Framework or Standard Contractual Clauses / the UK International Data Transfer Addendum, as applicable to each provider.
6. How long data is kept
- Server logs — for the hosting provider's standard short rotation period.
- Enquiries (form/email) — for as long as needed to handle your enquiry; if it leads to a project, for the duration of the engagement and any legally required accounting retention afterwards. Enquiries that go nowhere are deleted within 12 months.
- Analytics data — up to 14 months (Google Analytics' shortest retention setting).
- Consent logs — 12 months from your consent, the period Cookiebot retains proof of consent.
7. Your rights
Under the UK GDPR and the EU GDPR you have the right to:
- Access — obtain a copy of the personal data I hold about you
- Rectification — have inaccurate data corrected
- Erasure — have your data deleted where there is no reason to keep it
- Restriction — limit how your data is processed
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interest
- Withdraw consent — at any time, without affecting processing that happened before withdrawal (for cookies, use the button in section 3)
To exercise any of these rights, email marcin@oleksiak.dev. I will respond within one month.
8. A few final points
- You are never required to provide personal data to browse this site — the contact form and email are entirely optional.
- This site makes no automated decisions about you and does no profiling beyond the consented analytics described above.
- This site is not directed at children and does not knowingly collect children's data.
- External links (e.g. client career sites, LinkedIn) lead to websites with their own privacy policies, which I do not control.
9. Changes to this policy
If the way this site processes data changes — for example, a new tool is added — this policy will be updated and the "last updated" date at the top revised. The current version is always available at oleksiak.dev/privacy/.