Privacy Policy
Section 1. General provisions
This Privacy Policy sets out the rules for processing and protecting the personal data of Users of the website available at bartmagielski.com (the “Website”).
The controller of personal data is:
Magielscy Investments sp. z o.o.
ul. Jasielska 14C/27, 60-476 Poznań, Poland
entered into the register of entrepreneurs of the National Court Register (KRS) kept by the District Court Poznań - Nowe Miasto i Wilda in Poznań, 8th Commercial Division of the National Court Register, under KRS number 0000973416
Tax Identification Number (NIP): 5732935307, Statistical Number (REGON): 522100039
share capital: PLN 5,000.00
(the “Controller”)
Contact with the Controller regarding personal data matters: .
The Controller processes personal data in accordance with:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR),
- the Polish Act of 10 May 2018 on the Protection of Personal Data,
- the Polish Act of 18 July 2002 on the Provision of Electronic Services,
- the Polish Electronic Communications Law of 12 July 2024.
Section 2. Scope, purposes and legal grounds for processing data
2.1 Contact form
| Scope of data | email address, subject of the message, content of the message, and any other data voluntarily provided by the User |
|---|---|
| Purpose | responding to inquiries, handling correspondence |
| Legal basis | Art. 6(1)(b) GDPR (actions taken at the request of the data subject prior to entering into a contract) and Art. 6(1)(f) GDPR (the Controller’s legitimate interest in handling correspondence) |
| Storage | the Website’s database in the Cloudflare infrastructure; the form is protected against spam with Cloudflare Turnstile |
| Retention period | for the time needed to handle the request and any further communication, and thereafter for up to 24 months from the last contact, unless cooperation is established, in which case for the duration of the cooperation and any period required by law (including tax law) |
2.2 Booking a consultation call (TidyCal, Google Meet)
| Scope of data | name, email address, and any data provided in the booking form (e.g. company information, topic of the call) |
|---|---|
| Purpose | scheduling and conducting the consultation call, via TidyCal (booking) and Google Meet (call) |
| Legal basis | Art. 6(1)(b) GDPR |
| Recipients | TidyCal (provider of the booking tool, based in the USA), Google Meet (Google Ireland Limited / Google LLC) for conducting the video call |
| Transfers outside the EEA | TidyCal is based in the USA. Data transfer takes place on the basis of mechanisms provided for under the GDPR, in particular standard contractual clauses or, where the provider has joined it, the EU-U.S. Data Privacy Framework. We recommend reviewing TidyCal’s own privacy policy |
| Storage | booking data (first name, email address, date and time, meeting type, meeting link and answers from the booking form) is retrieved from TidyCal into the Website database on Cloudflare infrastructure, so that the booking can be linked to earlier correspondence; phone number and IP address are not retrieved |
| Retention period | until the call takes place and for the period necessary for any further communication, and in the Website database as for contact form data (point 2.1) |
2.3 Newsletter and downloadable materials (Brevo)
| Scope of data | email address (and name, if collected by the form) |
|---|---|
| Purpose | sending the newsletter and/or providing free materials (PDF reports, checklists, templates, etc.) through the Brevo platform |
| Legal basis | Art. 6(1)(a) GDPR (consent), in conjunction with Art. 10 of the Polish Act on the Provision of Electronic Services |
| Recipient | Sendinblue SAS, operating under the Brevo brand (Paris, France, EU) |
| Retention period | until consent is withdrawn / the User unsubscribes |
Consent can be withdrawn at any time by clicking the unsubscribe link in any email or by contacting the Controller. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
An email address signed up for the Newsletter is also stored in the Website database (Cloudflare), with the sign-up date and the status of its transfer to Brevo, until the User unsubscribes.
When a Material is downloaded, the Website stores the User's email address in its database (Cloudflare), together with the first name and company name if provided, information on which Material was downloaded and when, and confirmation that consent was given. The download link is sent by email through Brevo (Sendinblue SAS, France, EU) and is valid for 7 days. We process this data on the basis of consent (Art. 6(1)(a) GDPR) to provide the Material and send commercial information, and on the basis of the Controller's legitimate interest (Art. 6(1)(f) GDPR) to demonstrate that consent was given. We keep it until consent is withdrawn, and the data needed to demonstrate consent until any claims become time-barred. Signing up for the Newsletter when downloading a Material is a separate, voluntary consent.
2.4 Cookies, analytics and marketing tools (Google Analytics, Google Tag Manager, Microsoft Clarity, LinkedIn Insight Tag)
| Scope of data | cookie identifiers, IP address (anonymized/pseudonymized where possible), data on the User’s behavior on the Website (pages visited, clicks, scrolling, time spent on the page), device and browser data |
|---|---|
| Purpose | analysis of visit statistics and User behavior on the Website (Google Analytics), management of scripts used on the Website (Google Tag Manager), analysis of how the Website is used, including heatmaps and session recordings (Microsoft Clarity), measuring the effectiveness of marketing activities on LinkedIn (LinkedIn Insight Tag) |
| Legal basis | Art. 6(1)(a) GDPR (consent given via the cookie banner), in conjunction with Art. 399-400 of the Polish Electronic Communications Law |
| Recipients | Google Ireland Limited / Google LLC (Google Analytics, Google Tag Manager), Microsoft Ireland Operations Limited / Microsoft Corporation (Microsoft Clarity), LinkedIn Ireland Unlimited Company (LinkedIn Insight Tag) |
| Transfers outside the EEA | Google, Microsoft and LinkedIn may transfer data to the USA on the basis of certification under the EU-U.S. Data Privacy Framework and/or standard contractual clauses |
| Retention period | in accordance with the User’s consent settings and the periods specified in the privacy policies of the above providers |
Google Analytics and Microsoft Clarity are only activated after the User consents to statistics cookies, and LinkedIn Insight Tag only after the User consents to marketing cookies, via the cookie banner. Until consent is given, the scripts of these tools are not loaded. The Website uses Google Consent Mode v2. Google Tag Manager itself does not collect personal data, it is only used to manage the loading of the other tools once consent has been given.
Regardless of consent, the Website uses Cloudflare Web Analytics, a statistics tool that does not store cookies on the User’s device and does not build a profile of the User. It collects aggregated visit data (page visited, referrer, country, device and browser type) on the basis of the Controller’s legitimate interest (Art. 6(1)(f) GDPR) in keeping statistics of the Website. The recipient of the data is Cloudflare, Inc. (USA).
2.5 Infrastructure and server logs (Cloudflare)
| Scope of data | IP address, date and time of the request, browser type, operating system |
|---|---|
| Purpose | ensuring the proper and secure operation of the Website, protection against abuse and spam, technical statistics |
| Legal basis | Art. 6(1)(f) GDPR (the Controller’s legitimate interest in security and maintenance of the infrastructure) |
| Recipient | Cloudflare, Inc. (USA) |
| Transfers outside the EEA | Cloudflare may process data in the USA on the basis of certification under the EU-U.S. Data Privacy Framework and standard contractual clauses |
| Retention period | in accordance with the Website settings and the provider’s terms, no longer than necessary for security purposes |
The Website forms (contact, Newsletter, Materials, calculator, Program Scorecard) are protected by Cloudflare Turnstile, which checks that a person is submitting the form. To prevent abuse, the Website stores a hash of the IP address with a message (one-way, with a secret salt), not the address itself.
The Website also keeps its own statistics without cookies: it counts page views, tool use and referring domains as daily totals, without IP addresses, identifiers or data about any individual.
2.6 Affiliate program potential calculator
| Scope of data | email address and, if provided, first name, company name and website address, together with the data entered into the calculator (industry, channels, figures needed for the estimate) and the result |
|---|---|
| Purpose | presenting the result and contacting the User about possible cooperation |
| Legal basis | Art. 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract) and Art. 6(1)(f) GDPR (the Controller’s legitimate interest in responding to interest in its services) |
| Storage | the Website database on Cloudflare infrastructure |
| Retention period | as for contact form data (point 2.1) |
2.7 Contact database and enquiry rating
Submissions from the contact form, the calculator, the Program Scorecard, Newsletter sign-ups, Material downloads and call bookings are linked by email address into a single contact record in the Controller’s admin panel, together with the history of submissions and notes. The Controller may add the industry, company size, approximate budget and whether the company already runs a partner program. Based on this, the panel calculates a fit rating that helps decide the order of replies. The legal basis is the Controller’s legitimate interest (Art. 6(1)(f) GDPR) in handling enquiries and developing its business. The rating has no legal or other significant effects for the User, and every enquiry receives a reply. The data is kept as for contact form data (point 2.1). The Controller receives email notifications about new submissions and planned follow-ups, sent to its mailbox by Cloudflare or Brevo.
2.8 Affiliate program scorecard
| Scope of data | the answers entered into the scorecard form (industry, commission terms, cookie length, average order value, margin, payout rules and tools for publishers) and the result; if the User requests the full report, also the first name, email address, company name, website address and confirmation of consent to commercial information |
|---|---|
| Purpose | calculating the score on screen (in the User’s browser, without storing the answers), sending the full report by email, sending commercial information and contacting the User about possible cooperation |
| Legal basis | Art. 6(1)(b) GDPR (sending the report at the User’s request), Art. 6(1)(a) GDPR (consent to commercial information) and Art. 6(1)(f) GDPR (the Controller’s legitimate interest in responding to interest in its services and demonstrating that consent was given) |
| Storage | the Website database on Cloudflare infrastructure, in the contact database described in point 2.7; the report is sent through Brevo (Sendinblue SAS, France, EU) |
| Retention period | as for contact form data (point 2.1), and the data needed to send commercial information until consent is withdrawn |
Section 3. Data recipients
Personal data of Users may be disclosed to the following categories of recipients:
- infrastructure and hosting provider - Cloudflare, Inc. (USA),
- provider of the call booking tool - TidyCal (USA),
- provider of the video call tool - Google (Google Meet),
- provider of the email marketing system - Sendinblue SAS, Brevo brand (France), also for sending Material download links, Program Scorecard reports and notifications to the Controller,
- providers of analytics and marketing tools - Google (Google Analytics, Google Tag Manager), Microsoft (Microsoft Clarity), LinkedIn (LinkedIn Insight Tag), Cloudflare (Cloudflare Web Analytics),
- entities providing accounting, legal or advisory services to the Controller, to the extent necessary,
- public authorities, to the extent that disclosure is required by law.
Section 4. Transfer of data outside the European Economic Area
Some of the recipients listed in Section 3 (Cloudflare, TidyCal, Google, Microsoft, LinkedIn) may process data outside the EEA, including in the United States. In such cases, the transfer of data is based on mechanisms provided for under the GDPR, namely a European Commission adequacy decision (e.g. the EU-U.S. Data Privacy Framework) or standard contractual clauses approved by the European Commission. Data subjects may obtain a copy of the relevant safeguards by contacting the Controller.
Section 5. Data retention period
Personal data is stored for the period necessary to achieve the purposes set out in Section 2, and thereafter, where required by law (e.g. tax law), for the period resulting from those provisions, or until any potential claims become time-barred.
Section 6. Rights of data subjects
Every person whose data is processed has the right to:
- access their data and obtain a copy of it,
- rectify (correct) their data,
- erasure of their data (“the right to be forgotten”),
- restrict the processing of their data,
- data portability,
- object to processing based on Art. 6(1)(f) GDPR,
- withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal,
- lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, if they consider that the processing infringes the GDPR.
The above rights can be exercised by contacting the Controller at the address indicated in Section 1.
Section 7. Cookies
The Website uses cookies, i.e. small text files stored on the User’s end device.
The Website uses the following types of cookies:
- essential (technical) - necessary for the proper functioning of the Website, including remembering the chosen language version; do not require consent,
- statistics (Google Analytics, Microsoft Clarity) - require the User’s consent,
- marketing (LinkedIn Insight Tag) - require the User’s consent,
- tag management (Google Tag Manager) - a technical tool used to load the above scripts once consent has been given.
Under Art. 399-400 of the Polish Electronic Communications Law, the installation of cookies other than essential ones requires prior, clear and understandable information and the User’s consent, expressed e.g. via a cookie banner.
The User can change their cookie settings at any time via the “Cookie settings” link in the Website footer or through their browser settings (including blocking or deleting cookies), which may however affect the functionality of the Website.
Section 8. Data security
The Controller applies appropriate technical and organizational measures to ensure the security of the personal data processed, including protection against unauthorized access, loss, destruction or unauthorized alteration.
Section 9. Automated decision-making
The Controller does not make decisions concerning Users based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect them. The enquiry fit rating described in point 2.7 is used only to plan the order of work and is not such a decision.
Section 10. Changes to the Privacy Policy
The Controller reserves the right to make changes to this Privacy Policy, in particular in connection with changes in the law, the scope of its business activity, or the tools used. The current version of the Privacy Policy is always available on the Website.
Section 11. Contact
For any matters relating to this Privacy Policy and the processing of personal data, please contact .