Privacy policy and GDPR notice

1. Data controller

The controller of personal data collected through this site is Dawid Stepien, sole trader operating under the DAIEN brand, ul. Zelazna 14/37, 81-150 Gdynia, Poland, VAT ID 9581764814, REGON 544725271.

Contact for data matters: dawid.stepien@blackpoint.dev or dawid@daien.pl. I reply within 30 days at the latest, in practice within a few working days.

I act as an independent contractor working with Black Point Digital Poland sp. z o.o. (KRS 0001203171). The company is a recipient of the data, as described in section 5, and is a separate controller in respect of it.

2. What data I collect

From the qualification form: first name, last name, role, company name, company website, email address or phone number, plus your answers about the number of open roles, how long you have been recruiting, technologies, planned start date, engagement type and team size.

From booking a call: whatever you enter in Google Appointment Schedules, typically first name, last name and email. This goes directly to Google and to my work calendar.

Technical data: IP address and basic browser information, processed by the hosting provider only as needed to serve the site and prevent abuse.

From analytics, only after you agree: page views, the address you arrived from, approximate city-level location, device and browser type, clicks and a recording of your movement around the site. Form fields are masked in recordings, so what you type never reaches the analytics tool. Without your consent I collect none of this.

I do not collect special categories of data and I do not profile visitors.

3. Purpose and legal basis

Replying to your enquiry and discussing cooperation - Article 6(1)(b) GDPR, steps taken at your request prior to entering into a contract.

Assessing whether I can help and passing the enquiry to Black Point - Article 6(1)(f) GDPR, the legitimate interest of conducting business correspondence between companies.

Defending against claims and accounting obligations, if cooperation begins - Article 6(1)(f) and (c) GDPR.

Analytics and session recordings - Article 6(1)(a) GDPR, that is your consent. You can withdraw it at any time with the "Privacy settings" button at the bottom of the page. Withdrawal does not affect processing carried out beforehand.

Providing data is voluntary, but without an email address or phone number I have no way to reply.

4. How long I keep it

Enquiries that do not lead to cooperation: up to 24 months from the last contact, then deleted.

Enquiries that lead to cooperation: for the duration of the cooperation, then for the limitation period for claims and the period required by tax law.

Analytics data: session recordings are kept for up to 30 days, other traffic data for no longer than 12 months.

You can ask for earlier deletion at any time, unless a legal obligation prevents it.

5. Who receives the data

Black Point Digital Poland sp. z o.o. - if your enquiry concerns a need for IT specialists, I pass it to the team that will handle it. That is the purpose this site exists for.

Netlify, Inc. (USA) - site hosting and form handling. Submissions are stored on the provider's servers. Transfers outside the European Economic Area rely on the European Commission's standard contractual clauses.

Google Ireland Limited - Appointment Schedules and my work calendar. The booking page embeds a Google tool which may set its own cookies. See Google's privacy policy.

PostHog, Inc. - site analytics and session recordings, started only after you agree. Data goes to the European region of that service, meaning servers inside the European Union. Any access from the US relies on standard contractual clauses. Their terms are set out in the PostHog privacy policy.

I do not sell data and do not share it with data brokers or ad networks.

6. Cookies and third party tools

Until you agree, this site sets no cookies of its own and runs no analytics. Until you click "Accept", your browser does not even download the analytics code.

Once you agree, PostHog runs: it sets its own cookies and a local storage entry to recognise a returning visit, and it records your movement around the site with form fields masked. There is no Google Analytics and no advertising pixels here.

You can withdraw consent with one click on "Privacy settings" at the bottom of the page. After withdrawal I stop collecting data and clear the identifiers stored in your browser.

Regardless of consent: the booking page embeds Google Appointment Schedules. Google may set its own cookies inside that frame, under the terms of its own policy. If you would rather avoid that, email me instead of booking.

The site font is self-hosted, so opening the page does not pass your IP address to an external font provider.

7. Your rights

You have the right to access your data, to rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest.

To exercise any of these, a message to dawid.stepien@blackpoint.dev is enough. No form required.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.

8. Security

The site is served over encrypted HTTPS only. Access to submissions is limited to me and the people at Black Point handling a given enquiry.

If you notice anything concerning in how I handle your data, write to me. I take it seriously.