Data and GDPR
You’re letting a stranger into an inbox full of your clients’ data. It’s reasonable to want to know what will happen to it. Everything is below, in plain English, without legal paragraphs.
What I see
To fix a process, I have to see it. That usually means that during a project I look at your inbox, calendar, spreadsheets or the program where you keep your clients. Sometimes that includes your clients’ data: names, phone numbers, addresses and, in some professions, health information.
I don’t copy that data to myself. I work in your accounts, in your tools, with access you can take back with one click.
Where it sits
Where it sat before, which is with you. I don’t move your data to my own servers and I don’t keep copies just in case.
If something needs an outside service to build, I tell you which one, exactly what goes to it and where that company keeps data. The decision is yours, before I connect anything.
Data processing agreement
With every client I sign a data processing agreement before I get any access. It’s the document that says what I may and may not do with the data, and you both need it for the arrangement to comply with the GDPR.
It’s not a box to check. If there’s something in it you don’t understand, I explain it before you sign.
What happens after a project
We finish the project, you tell me, and you take back the access. What stays with me is my working notes and the process map, without your clients’ data.
If you want me to delete the notes too, one message is enough.
AI tools
I use them where they actually add something, and I don’t use them where a plain form or a rule will do.
Your data and your clients’ data are not used to train anyone’s models. If the most convenient tool would send data somewhere you’re not comfortable with, I pick a different tool. I tell you before the build, not after.
This website
What happens to your audit data
Your answers don’t go anywhere
You fill out the audit and the result is worked out on the spot. Your answers don’t reach any database and can’t be linked to you afterwards, because at this stage I don’t even know who you are. You can see the whole result without giving anything.
You give your email only for the result
You give your address only when you want the same result sent to your inbox. Resend sends it and that’s the end of it: if you don’t check the consent for emails, your address isn’t saved anywhere. If you do check it, it goes to MailerLite together with your audit result, so I know what to talk to you about, and you unsubscribe with the link in the footer of every message.
No cookies and no statistics
This website sets no cookies and has no analytics or tracking tools on it. I don’t know how many people visited or where they came from. That’s why you won’t see a consent pop-up here: there’s nothing to agree to.
Two things happen anyway, and I’d rather name them. Your audit answers are kept by your browser in the memory of the tab, so the result survives the move to the next screen, and they disappear when you close the tab. They don’t reach me. Also, every visit to the site is a connection to the server that hosts it for me, so your IP address ends up in its logs. That’s how every website works, but it’s still data and I won’t pretend it isn’t there.
Deleting your data
Write to jacek@jacekadamczyk.com and I’ll delete your address along with the saved result. You don’t have to explain why.
The formal part
Who is responsible for your data
The controller, meaning the one who decides what happens to your data, is QAlity Jacek Adamczyk, ul. Na Skraju 8a, 11-036 Gietrzwałd, Poland, tax ID (NIP) 5842655589. For anything to do with data, write to jacek@jacekadamczyk.com. I have no data protection officer, so I answer personally.
Why, and on what basis
- To send you the audit report you asked for. Basis: Article 6(1)(b) GDPR, meaning I act at your request. I don’t need separate consent for this, which is why I don’t ask for it.
- To write to you now and then about automation, if you checked that box. Basis: Article 6(1)(a), meaning your consent. If you don’t check it, your address doesn’t go on any list.
- To reply to your email or prepare for a call. Basis: Article 6(1)(f), meaning my legitimate interest in corresponding with someone who got in touch first.
How long I keep it
- Address on the email list: 3 years from your last contact, or until you withdraw consent, whichever comes first.
- Audit result saved with the address: the same as the address, because an audit result without an address tells nobody anything.
- Correspondence: one year after the last message, if the conversation did not lead to working together.
Who else sees your data
I don’t sell or share data with anyone. I do use three companies that work on my behalf and have signed data processing agreements with me. The last two are in the USA, outside the European Economic Area, and data goes there under the standard contractual clauses approved by the European Commission:
- MailerLite: keeps the email list and handles unsubscribing. Where the data sits: European Union (Lithuania).
- Resend: sends the audit report and the notification to me. Where the data sits: USA, under the European Commission's standard contractual clauses.
- Netlify: hosts this website, so its server logs show the IP address of every visit. Where the data sits: USA, under the European Commission's standard contractual clauses.
What you can do about it
You have the right to ask what data of yours I hold, to have it corrected, deleted or restricted, to get it in a file you can move elsewhere, and to object to my using it on the basis of legitimate interest. You withdraw consent to marketing emails with the link in the footer or with one message. Withdrawing doesn’t affect what I sent before.
An email to jacek@jacekadamczyk.com is enough.
You can also complain about me
If you think I’m handling your data unlawfully, you have the right to complain to a supervisory authority. In Poland that is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl. You don’t have to write to me first, though if you do, I’ll try to sort it out like a person first.
Giving your data is voluntary
You see the whole audit and the whole result without giving anything. You give your address only if you want the breakdown by email. I don’t profile anyone and I make no automated decisions about you. The audit result is a pointer for you, not a rating that I store somewhere and treat you by.
A question I haven’t answered here?
Write it in one sentence. I answer plainly, including when the answer is “I won’t do that”.
Want to know who you’re dealing with first? About me.