oskar pajka

Privacy policy

Who is responsible

This site belongs to Oskar Pajka, a motion designer and developer based in Kielce, Poland. I am a private person, not a company, and I am the controller of the personal data described here. You can reach me at oskar@oskarpajka.com about anything in this policy.

What this site collects

Very little. The site has no accounts, no contact form, no comments, no newsletter, no payments, no uploads, no ads and no embedded videos from other services. It runs no tracking or analytics script.

When your browser asks for a page, an image or a film, the request necessarily includes some technical data: your IP address, the address of the page, the date and time, your browser and system (the user agent) and the page you came from (the referrer). This data is used to deliver the site and protect it from attacks. Cloudflare also works out your approximate country from the IP address. I have request logging switched off, so I keep no log of visits myself. My Cloudflare dashboard still shows a sample of recent requests, including IP addresses and browser details, for about a month (31 days). I look at it only to fix a problem or deal with an attack.

The legal basis is my legitimate interest in running a secure, working website (Article 6(1)(f) GDPR).

Cookies

The site sets no cookies and stores nothing on your device: no localStorage, no sessionStorage. Your browser only keeps its usual cache of downloaded files. That is why there is no cookie banner.

One exception is up to Cloudflare: if it suspects an attack, it may show a check page and set a short-lived security cookie (cf_clearance, 30 minutes) so it does not check you again. It is strictly necessary and used for nothing else.

Visit statistics

To see which pages are read, I use the totals Cloudflare counts from these same requests: requests and visitors per page and per country. Nothing extra runs in your browser, and I do not try to identify anyone. The legal basis is my legitimate interest in knowing how the site is used (Article 6(1)(f) GDPR).

Hosting and video

The site is hosted on Cloudflare Workers, and the films are served from Cloudflare R2 at media.oskarpajka.com. The provider is Cloudflare, Inc. (101 Townsend St., San Francisco, USA). To deliver the site, Cloudflare processes the request data above on my behalf, as my processor under its Data Processing Addendum (cloudflare.com/cloudflare-customer-dpa). Cloudflare also uses traffic data for its own purposes, such as rating IP addresses as threats. For that use it is a separate controller, under its own privacy policy (cloudflare.com/privacypolicy).

Cloudflare runs a global network, so your data may be processed outside the European Economic Area, including in the United States. Cloudflare, Inc. states that it is certified under the EU-U.S. Data Privacy Framework. If that certification lapses, the European Commission’s Standard Contractual Clauses in its Data Processing Addendum apply instead.

The fonts and films come from this site and Cloudflare, so no other company receives your data while you browse.

Email

If you write to oskar@oskarpajka.com, I receive your email address, your name if you include it, whatever you write and any attachments. I use it only to reply and to continue our conversation. My mailbox is iCloud Mail, provided in the EU by Apple Distribution International Ltd. in Ireland, under Apple’s own terms and privacy policy (apple.com/legal/privacy). Apple may process messages outside the European Economic Area, including at Apple Inc. in the United States, under the European Commission’s Standard Contractual Clauses.

The legal basis is the steps you ask me to take before we agree on work together (Article 6(1)(b) GDPR), and otherwise my legitimate interest in answering messages (Article 6(1)(f) GDPR). I do not add you to any mailing list, and I do not pass your message on to anyone, unless you ask me to or the law requires it.

The site links to my profiles on GitHub, LinkedIn, X and Instagram, and to framecatch and Patryk, who builds it with me, on GitHub. Nothing from those sites loads until you click. Then your browser tells them only that you came from oskarpajka.com, not which page, and their own privacy policies apply.

How long data is kept

  • Request data in my Cloudflare dashboard: about a month (31 days).
  • The cf_clearance cookie, if it is set at all: 30 minutes.
  • Visit statistics: totals only, not linked to anyone.
  • Emails: while we are in touch. About once a year I delete ended conversations, so they usually stay no longer than a year. I keep a message longer only if the law requires it (Article 6(1)(c) GDPR) or while I may need it to establish or defend a legal claim (Article 6(1)(f) GDPR). Ask me and I will delete your messages sooner.
  • What Cloudflare keeps for its own purposes: as set by Cloudflare’s privacy policy.

Your rights

Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict its use, to object to it being used on the basis of legitimate interest, and, for emails about working together, to receive it in a portable format. These rights apply to everyone, wherever you live. To use them, email oskar@oskarpajka.com, ideally from the address you wrote to me from. I will answer within one month.

I can only look up what I can link to you. Request data and statistics are not tied to your name or email, so I usually cannot tell which requests are yours (Article 11 GDPR). If you give me your IP address and the time, I will check my Cloudflare dashboard. For what Cloudflare keeps for its own purposes, write to sar@cloudflare.com.

You can object at any time, for reasons related to your situation, to any use I base on legitimate interest. For your emails, I will then stop using them, unless I need them to establish or defend a legal claim.

I do not sell your data, use it for advertising, profile you or make automated decisions about you. You do not have to give me any data: your browser must send the technical data above for the site to load, and writing to me is up to you.

You can also complain to the Polish data protection authority, Prezes Urzędu Ochrony Danych Osobowych (uodo.gov.pl), or to the authority in the EU or EEA country where you live or work.

Changes to this policy

If something here changes, for example a new service, I will update this page and its date. The previous version is available on request.