Information

Privacy Policy

Last updated: 17 July 2026

1. Data controller

The controller of personal data collected through pawelkardach.pl is Paweł Kardach, trading as Healthtime Paweł Kardach (the "Controller"). Contact for data-protection matters: kontakt@pawelkardach.pl, tel. +48 518 934 042.

2. What data we process and why

Depending on how you use the site, the following categories of data may be processed:

Data from the contact form - full name, email address, phone number (optional), role/title, company/organization name (if given), number of employees (if given), information on the source of funding for the engagement, a description of your goal or challenge, preferred meeting format. Purpose: contacting you to arrange a free initial call and preparing a proposal. Legal basis: Art. 6(1)(b) GDPR (steps taken at the data subject's request prior to entering into a contract) and Art. 6(1)(f) GDPR (the Controller's legitimate interest in business contact).
Data from the e-book sign-up form - name, email address. Purpose: sending the material ("Leader Balance in Uncertain Times") and - only after separate, freely given consent - occasionally sending content for leaders. Legal basis: Art. 6(1)(a) GDPR (consent) for any marketing communication, and Art. 6(1)(b) GDPR for fulfilling the request to send the material.
Data from phone and email contact - data provided voluntarily in the course of correspondence. Purpose: responding to you and handling correspondence related to your inquiry. Legal basis: Art. 6(1)(b) and (f) GDPR.
Technical data - basic data about your visit to the site (e.g. browser type, to the extent normally collected by the server/hosting provider). Purpose: ensuring the site works correctly and securely. Legal basis: Art. 6(1)(f) GDPR (the legitimate interest of maintaining and securing the infrastructure).

3. Forms and data processors

The site's contact form is technically handled by an external form-delivery provider, formsubmit.co. This means data entered into the form passes through that provider's infrastructure in order to deliver the message to the Controller's inbox. This provider acts as a data processor within the meaning of Art. 28 GDPR, acting only on the Controller's documented instructions and to the extent necessary to deliver the message. The Controller takes care to use only providers offering an adequate level of data protection.

4. How long data is kept

Data belonging to people who got in touch to arrange an initial call is kept for the duration of the correspondence and - if an engagement follows - for its duration plus any period required by law (including tax law, where applicable). Data belonging to people who did not go on to work together is deleted no later than 24 months after the last contact, unless the person requests earlier deletion. Data processed on the basis of consent (e.g. sending materials for leaders) is kept until consent is withdrawn.

5. Who receives the data

Data may be shared with parties that support the Controller technically and organizationally: email and hosting providers, the contact-form provider (formsubmit.co), and, where necessary, an accounting office for billing purposes. Data is not sold or shared with third parties for marketing purposes without separate consent.

6. Transfers outside the European Economic Area

Some providers of tools used to run the site may process data on servers located outside the EEA. In such cases the Controller requires providers to ensure appropriate GDPR-compliance mechanisms (e.g. standard contractual clauses).

7. Cookies

The site may use essential cookies required for it to function correctly (e.g. remembering whether the menu is expanded). In its current version, the site does not use analytics or third-party marketing cookies. If such tools are implemented in future (e.g. Google Analytics), this policy will be updated and a cookie-consent banner compliant with applicable telecommunications and GDPR requirements will appear on the site.

8. Your rights

Anyone whose data is processed has the right to: access their data, have it corrected, have it erased ("the right to be forgotten"), restrict its processing, receive a copy of it (data portability), object to processing based on Art. 6(1)(f) GDPR, and - for data processed on the basis of consent - withdraw that consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. To exercise these rights, please contact: kontakt@pawelkardach.pl.

9. Right to complain

Everyone has the right to lodge a complaint with a supervisory authority. In Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw), if they believe the processing of their data breaches GDPR. EU residents outside Poland may also lodge a complaint with their own national supervisory authority.

10. Is providing data mandatory?

Providing data through the forms is voluntary but necessary in order to arrange an initial call, send materials, or respond to an inquiry. Without it, these actions cannot be carried out.

11. Changes to this policy

This policy may be updated as the site evolves or as legal requirements change. The current version is always available at this address, along with the "last updated" date shown at the top of the document.

For questions about personal data or the terms of working together, contact: kontakt@pawelkardach.pl, tel. +48 518 934 042.