1. Who is responsible for your data?
The data controller is Bartłomiej Kempe, presenting this portfolio as Kempe Studio and operating an unregistered business under Polish law.
Controller's address: ul. Ceramiczna 3A/9, 49-130 Tułowice.
For personal data matters, email bartlomiej.kempe@gmail.com.
2. What data and for what purpose?
- Contact and preparing an offer. The form requires your name or company name, email address and message. I also process your selected enquiry topic and information you provide voluntarily. Preparing an offer at your request is based on Article 6(1)(b) GDPR; general correspondence and answering questions on Article 6(1)(f) GDPR. The legitimate interest is communicating with you. I use your email only to respond to your enquiry and present an offer, not for email marketing or a newsletter.
- Website operation and security. The hosting infrastructure may process your IP address, connection date and time, requested URL, browser information and errors. Once form protection is activated, Cloudflare Turnstile verifies the CAPTCHA token and technical data, including IP address, browser and device information, to prevent spam. The legal basis is Article 6(1)(f) GDPR — the legitimate interest in protecting the website and correspondence.
- Establishing and defending legal claims. Necessary correspondence may be retained under Article 6(1)(f) GDPR where required to protect the controller's rights.
Providing data is voluntary, but without contact details I may not be able to reply. I do not need your national identification number, document scans or sensitive data — please do not include them in your enquiry.
3. What does the contact form do?
While you type, your data stays in the open page's memory. I do not save it in persistent browser storage or a website enquiry database. Turnstile protection loads only when you start using the form.
When sending is enabled, pressing “Send message” submits your data via HTTPS to the website server. The server checks the fields and CAPTCHA, then passes the message to Resend for delivery to bartlomiej.kempe@gmail.com. The sender's email is used as the reply-to address. Once an enquiry is accepted for sending, I send a short automatic receipt to the address provided, without a copy of the enquiry. This message is solely for handling your contact, not email marketing. I do not add the address to marketing lists. Confirmation is limited to one attempt per address per day; anti-spam limits, provider errors or mail filters may prevent its arrival. Not receiving a confirmation does not mean that a successfully accepted enquiry was not passed on for sending.
If the services are not connected or an error occurs, the form reports unavailability or unconfirmed delivery. You can then copy the message and email it yourself to the address shown. Copying accesses the clipboard only when you click.
The website has no newsletter, user accounts, payments, ads or marketing profiling. An enquiry about a project does not constitute consent to marketing.
Automatic reply safeguards
In Cloudflare D1, I store only daily attempt counters and unreadable HMAC identifiers derived from an email or IP address using a secret key. I do not store names, email or IP addresses in plain text, or enquiry content there. The identifiers are pseudonymous, not anonymous. They serve only to limit abuse, under Article 6(1)(f) GDPR. Entries expire after 48 hours and are deleted the next time the mechanism is used. The provider's retention rules also apply to technical data and backups.
4. Who may receive the data?
To operate the website and handle contact, I use infrastructure providers: OpenAI / Sites (hosting), Cloudflare (website delivery, Turnstile and the D1 technical counter database), Resend / Plus Five Five, Inc. (sending messages once activated) and Google / Gmail (email inbox). Resend receives the name or company name, email address, subject and enquiry content. I do not send message content, name or email fields to Turnstile; it receives the technical data needed to protect the form. Data may also be disclosed to entities authorised by law. I do not sell visitors' data.
Some provider operations may take place outside the European Economic Area, including in the USA. Safeguards depend on the provider and country. Resend describes transfers and standard contractual clauses in its data processing agreement. Information about other providers and safeguards is in their policies: OpenAI, Cloudflare Turnstile, Resend i Google. You can also ask me for details about your data and a copy of the relevant safeguards.
5. For how long?
I keep enquiry data for the time needed to handle the conversation and prepare an offer. If the conversation does not lead to collaboration, I delete the correspondence no later than 12 months after the last contact, unless continued retention is needed for a specific legal claim. In that case, the criterion is the applicable limitation period.
If we work together, retention periods for contracts and billing follow tax and accounting rules and the limitation periods for claims. Technical data remains in the infrastructure for the period determined by its settings and security needs; information on providers' retention is in the policies linked above.
6. Your rights
Under the conditions set out in the GDPR, you may request access, rectification, erasure and restriction of processing. You may object to processing based on legitimate interests. Data portability applies in the cases provided for in Article 20 GDPR. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.
Send your request to bartlomiej.kempe@gmail.com. I will generally reply within one month; where the law permits an extension, I will inform you. You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office.
I do not make automated decisions about you that have legal effects, or use profiling.
7. Optional Google Analytics
Only with your consent, I use Google Analytics 4 to understand page views, traffic sources and portfolio use: pages and projects viewed, scrolling and contact clicks. After a successful form submission, only the fact that an enquiry was passed on for sending is measured. The legal basis is Article 6(1)(a) GDPR — voluntary consent. Without consent, I do not load the Analytics script or send any measurements. Consent is not a condition of using the website or contacting me.
Data processed includes pseudonymous cookie identifiers, activity, event times, referring domain, device, browser and approximate location. Google also receives technical connection data. According to Google's documentation, EU users' IP addresses are not logged or stored by Analytics; they may be used to determine approximate location before being discarded. I do not send form content, visitors' names, company names or email addresses to analytics. I do not enable Google Signals, advertising personalisation, cursor heatmaps or session recording.
The recipient of analytics data is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC and subprocessors may also process it. Data may be processed outside the EEA, including in the USA. Information on roles, entities and transfer safeguards, including standard contractual clauses and relevant adequacy decisions, is provided in Google's data processing terms i Google's privacy policy. You can ask me for information on the safeguards used and a copy of them.
Analytics cookies and the saved choice are set to expire within 180 days. Retention of user- and event-level data in Google Analytics is set to 2 months. Google automatically deletes it after the retention period in accordance with the service's rules. Aggregated statistical reports are not subject to the same limit. Details are in the Google Analytics retention documentation.
You can withdraw or change consent via “Cookie settings” in the footer as easily as you gave it. This does not affect the lawfulness of earlier processing. Withdrawal stops future measurements and deletes Analytics cookies accessible to the website; it does not automatically delete data already sent to Google. You can contact me about deletion or other rights.
8. Cookies and links
Details of browser storage are explained in the cookie information. Social media content is not embedded in players — an external service opens only when you click a link. That service has its own privacy rules.
This policy will be updated if website features or data processing change.