Who is the data controller
The controller of your personal data in connection with your use of itcompass.io is a sole trader registered in CEIDG (the Polish Central Register and Information on Business):
- Controller
- ITCompass Artem Shevchenko
- NIP
- 6343060594
- Registered office
- Katowice, Poland
- Contact for data matters
- contact@itcompass.io
We have not appointed a data protection officer — we handle all personal data matters directly at the email address above.
What data we process — overview
The website is public and anonymous: there is no registration, login or payment. We ask for your name and email address only when you choose to contact us; we never ask for your surname, phone number or password. Personal data within the meaning of the GDPR can appear in only four situations:
- A message to us — when you send an enquiry through the form on the home page or write us an email yourself (section 3).
- Visit statistics — when you open any page (section 4).
- Blog — counting post views and, if you wish, email notifications about new posts (section 5).
- Technical server logs — recorded automatically with every connection (section 6).
Providing data is always voluntary. Without it you can still use all the content of the website; the only consequence of not providing your name and email address is that we will not be able to reply to your enquiry or send post notifications.
We do not profile visitors and we do not make decisions about anyone solely by automated means. We do not sell data and we do not pass it on for advertising purposes.
Contact form and email messages
The “Get in touch” form. When you send an enquiry through the form on the home page, we store the name, email address and short description of your process that you enter, together with the language version of the page and the time of sending. We do not store your IP address or any information about your device. The enquiry also reaches our contact@itcompass.io mailbox as an email; we reply from it to the address you gave.
Email messages. When you write to us directly at contact@itcompass.io, we process the sender address, the content of the message and any data you include yourself (for example a company name or phone number).
- Purpose
- replying to your enquiry or message, preparing a quote, conducting talks before a possible contract
- Legal basis
- Article 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Article 6(1)(f) GDPR (legitimate interest: handling enquiries, including those not related to a contract)
- Retention period — form
- the record in the website's database — 12 months from sending, after which it is deleted automatically
- Retention period — email
- the message from the form and the correspondence in our mailbox — until the matter is closed, and then until any claims become time-barred (as a rule, 3 years); if a contract is concluded — also as long as tax and accounting regulations require (as a rule, 5 years from the end of the year in which the tax obligation arose)
The checkbox under the form only confirms that you know this policy — it is not consent within the meaning of Article 6(1)(a) GDPR and is not the basis of processing.
Enquiries from the form and email messages pass through the email and email delivery services used by ITCompass Artem Shevchenko (section 7).
Visit statistics and the right to object
We want to know which pages are read, where visitors come from and on what devices — without tracking people. That is why we run the statistics ourselves, on our own server, without cookies and without external analytics tools (no Google Analytics, no Meta Pixel and nothing similar).
Each time a page is displayed, we record:
- the page address and language version,
- the visitor's country (determined from the IP address using a database of address ranges that runs locally on our server — the IP address is not sent anywhere),
- the type of device (computer, phone, tablet) and the browser family,
- the type of traffic source (search engine, social media, direct, other website), the source domain name, and campaign tags (utm_source, utm_medium, utm_campaign) if they appear in the address,
- whether the visitor is a robot,
- the time of the visit,
- a daily fingerprint — a hash computed from the IP address using a random key that is generated once a day and irreversibly deleted when the day ends.
The IP address is not stored in the statistics. The fingerprint serves only to tell one visitor from another within a single day (so that we can count how many different people visited the website). Because the key disappears after a day, fingerprints from previous days can no longer be linked to any device or person — and we have no other data that would make this possible.
- Purpose
- assessing which content is needed and improving the website; detecting robot traffic
- Legal basis
- Article 6(1)(f) GDPR (legitimate interest: developing and securing the website)
- Retention period
- individual records — 30 days; after that only daily aggregate summaries (numbers) remain, from which no visit can be reconstructed
Objection. You have the right to object at any time to this processing, on grounds relating to your particular situation (Article 21 GDPR). Write to contact@itcompass.io. Because of how the mechanism is built, we may not be able to identify records relating to a specific person (Article 11 GDPR) — in that case we will explain this in our reply.
Blog: views and email notifications
Post views. Opening a blog post is recorded separately, to show the number of readers. We store a daily fingerprint (as in section 4) and the country; a post is counted at most once a day per visitor. We do not store the IP address. Legal basis: Article 6(1)(f) GDPR; once the daily key is deleted, the records can no longer be linked to a person.
Notifications about new posts. If you leave your email address in the form on the blog, we store that address, the language version in which you want to receive messages, and the date of sign-up. We send only notifications about new posts, with no advertising from other companies.
- Purpose
- sending notifications about new blog posts
- Legal basis
- Article 6(1)(a) GDPR (your consent — you give it by entering your address and clicking “Subscribe”) and Article 10 of the Act of 18 July 2002 on Providing Services by Electronic Means
- Retention period
- until you unsubscribe or withdraw consent; after you unsubscribe we delete the address or — if it is needed to demonstrate that consent was given — keep it until any claims become time-barred
You can withdraw your consent at any time — using the unsubscribe link in every message or by writing to contact@itcompass.io. Withdrawing consent does not affect the lawfulness of earlier mailings.
The sharing buttons under a post are ordinary links. Until you click them, no social network learns that you are reading our post; after you click, you leave the website and that network's own rules apply.
Technical server logs
The server on which the website runs, like any web server, records basic information about each connection in a technical log: the IP address, the time, the address of the requested resource, the response code and the browser header. The log is used solely to ensure security, detect abuse and diagnose faults; we do not combine it with the statistics described in section 4.
- Legal basis
- Article 6(1)(f) GDPR (legitimate interest: security and continuity of the website)
- Retention period
- no longer than 30 days, unless a specific entry is needed to investigate a security incident — then until the incident is closed
Who we share data with
Data does not go to advertising networks or data brokers. We use only service providers without whom the website and email would not work, under data processing agreements:
- a server and hosting provider, on whose infrastructure the website and its database run,
- an email provider that handles the contact@itcompass.io mailbox,
- an email delivery provider (currently Hostinger — Hostinger International Ltd.) — for enquiries from the contact form, which we forward to our mailbox, and for blog post notifications.
If any provider processes data outside the European Economic Area, it does so on the basis of standard contractual clauses or another mechanism provided for in Chapter V of the GDPR. We may also disclose data to public authorities where a legal provision obliges us to do so.
The website's fonts, scripts and images are served from our own server — when the page loads, the browser does not connect to external servers (CDNs, Google Fonts and the like).
Your rights
In connection with the processing of personal data you have the right to:
- access your data and receive a copy of it,
- rectify data that is incorrect,
- erase your data (the “right to be forgotten”),
- restrict processing,
- data portability for data you provided on the basis of consent or in connection with a contract or steps before entering into one,
- object to processing based on a legitimate interest,
- withdraw consent at any time.
To exercise these rights, write to contact@itcompass.io. We reply without undue delay and at the latest within one month. To protect data from being released to the wrong person, we may ask you to confirm that you are the sender of the message.
You also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl). We would appreciate it if you first gave us a chance to resolve the matter, but this is not a condition.
Data security
The website is available only over an encrypted connection (HTTPS). Access to the server, its database and the panel in which we edit the blog and manage the notification list is limited to authorised persons and protected by authentication. We minimise the amount of data: the contact form asks only for a name, an email address and a short description, and where a hash or an aggregate number is enough, we do not store the source data.
Changes to this policy
We change the policy when the way the website works or the law changes. The current version is always at this address, and the date of the last change appears at the top of the document. We will inform subscribers by message of significant changes concerning email notifications.