Privacy Policy

1. Data controller

The controller of your personal data is:

2. Scope

This policy covers personal data processed in connection with the website, the contact form, email correspondence, and optional analytics. It does not replace a separate data processing agreement (DPA) for client projects involving third-party personal data — see the DPA template.

3. What data we process

• Contact form: name, email address, message content, and technical anti-abuse data (session identifier, one-time form token / nonce, rate-limit timestamps).
• Email / direct contact: address and content you send to tomasz@badtrip.software or related addresses, plus ordinary mail-server metadata.
• Technical / server logs: IP address, date and time, requested URL, user agent, and similar data generated by the web server when you visit the site (to the extent such logs are retained by the hosting environment).
• Cookies and similar technologies: see section 7.
• Analytics (only if you consent): online identifiers, approximate device/browser data, and aggregated usage events via Google Analytics 4 (see below).

We do not intentionally collect special categories of data (GDPR Art. 9). Please do not submit sensitive data via the contact form.

4. Purposes and legal bases

Where processing is based on legitimate interests, you may object under GDPR Art. 21 (see section 10).

5. Recipients and processors

Data may be disclosed only where needed, to:

• Hosting / infrastructure providers operating the server that hosts this website and email (data centres as configured for badtrip.software; currently including infrastructure consistent with a self-managed or VPS-style setup in the EU where applicable).
• Google Ireland Limited / Google LLC — only if you consent to analytics (Google Analytics 4, measurement ID G-PYMFCHB2GG). Google acts as a provider of analytics services; see Google’s Privacy Policy and Google Analytics data protection.
• Professional advisers (e.g. accountant, lawyer) where required for legal or accounting duties.
• Public authorities where required by Polish or EU law.

Contact form messages are delivered by email to the controller (recipient address configured on the server). They are not sold or used for third-party marketing lists.

6. Transfers outside the EEA

If you consent to Google Analytics, data may be processed by Google entities outside the European Economic Area (including the United States). Such transfers rely on safeguards permitted under GDPR Chapter V — in particular the EU–US Data Privacy Framework where applicable and/or Standard Contractual Clauses used by Google, together with Google’s product configuration (including Consent Mode defaults denying analytics storage until you accept).

Without analytics consent, we do not intentionally transfer your form or preference data to Google for analytics purposes.

7. Cookies and similar technologies

The site uses the following categories:

• Strictly necessary (session): a PHP session cookie is set when you use the contact form (nonce / anti-abuse and rate limiting). This is required for the form to work securely. Legal basis: Art. 6(1)(f) GDPR / necessity for the service you request.
• Preference storage: your cookie choice (cookiesAccepted is stored in localStorage in your browser so we do not re-prompt you every visit. This is not used for advertising.
• Analytics (optional): Google Analytics 4 cookies / identifiers only after you click Accept on the banner. Default Consent Mode sets analytics_storage and advertising-related storage to denied until you accept. Reject keeps analytics storage denied.

You can change your mind by clearing site data for badtrip.software in your browser (this removes the stored preference and typically shows the banner again), or by adjusting browser cookie settings. You may also use Google’s tools for ads personalisation where relevant.

The site is not intended to run non-essential advertising cookies. If additional cookies are introduced later, this section will be updated and consent obtained where required.

8. Retention

• Contact enquiries: kept for the time needed to handle the request and related follow-up, and thereafter for up to 3 years (limitation periods / legitimate interest in establishing, exercising or defending claims), unless a longer period is required by law or an ongoing relationship.
• Contract / billing data: retained for the periods required by Polish tax and accounting law (typically up to 5 years counted from the end of the relevant calendar year, unless a different statutory period applies).
• Session / rate-limit data: short-lived; session lifetime as configured on the server (typically until the browser session ends or the session expires).
• Analytics data: retained according to the GA4 property retention settings configured in Google Analytics (and only if you consented).
• Server logs: according to hosting / server rotation policy (commonly days to a few weeks unless needed for security investigation).

9. Security

Appropriate technical and organisational measures are applied, including HTTPS on the public site, origin checks and rate limiting on the contact endpoint, one-time form tokens, and access limited to the controller. No method of transmission or storage is perfectly secure; absolute security cannot be guaranteed.

10. Your rights

Under the GDPR you may have the right to:

• access your data (Art. 15);
• rectification (Art. 16);
• erasure (Art. 17);
• restriction of processing (Art. 18);
• data portability (Art. 20), where applicable;
• object to processing based on legitimate interests (Art. 21);
• withdraw consent at any time, without affecting lawfulness of processing before withdrawal (Art. 7(3)) — relevant for analytics;
• not be subject to solely automated decision-making producing legal or similarly significant effects (Art. 22) — this site does not perform such decision-making.

To exercise these rights, email tomasz@badtrip.software with enough detail to identify your request. We will respond without undue delay and in any event within one month (extendable as permitted by GDPR Art. 12(3)).

You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (UODO):

11. Children

The website and services are directed at businesses and adult professionals. We do not knowingly collect personal data from children under 16. If you believe a child has provided data, contact us so it can be deleted.

12. Profiling and marketing

We do not use contact form data for automated profiling with legal or similarly significant effects. We do not sell personal data. We do not send marketing newsletters from this site unless you separately and clearly agree to such communication in the future (in which case this policy will be updated).

13. Changes

This policy may be updated to reflect legal or operational changes. The effective date at the top of the page will be revised. Material changes affecting analytics or new processing will be reflected in the cookie banner / this page as appropriate.

14. Contact

Privacy questions and data-subject requests: tomasz@badtrip.software.