Privacy policy

In force since October 26, 2026.

This is an English translation, provided for convenience. The binding version is the Polish one, published at jt-consulting.pl/polityka-prywatnosci/. Where the two differ, the Polish version prevails.

1. Who the data controller is

The controller of personal data is Juliusz Tomeczek, a sole trader operating under the business name JT CONSULTING - Juliusz Tomeczek, ul. Panewnicka 327/8, 40-773 Katowice, Poland, NIP (Polish tax identification number) 633-182-39-45, REGON (Polish statistical number) 278085759. On matters of data protection, please write to .

2. What data I process, and why

The site presents services, and browsing it requires no personal data. I process personal data in the following situations:

• Contact form. You provide your first name, last name, email address and message and, if you wish, your company name and phone number. I also record which language version of the form the message came from and its date. The message goes into my contact management system, and I send a confirmation of receipt to the address you provided. I process the data in order to answer the inquiry and carry on the correspondence, and, where the conversation moves toward working together, also in order to prepare a proposal and enter into a contract.
• Correspondence. If you write to me directly, I process your email address and the content of your message for the same purpose. If we work together, or are currently discussing doing so, I also save a copy of each email we exchange in my contact management system, so that all our correspondence on any given matter is kept in one place. Each copy includes the sender, recipients, subject line, date and message text.
• Newsletter. If you tick the box consenting to the AI for Everyone newsletter in the form, I record your email address, first and last name, the language of the form and the date of sign-up, and, when you confirm, the date of confirmation and your IP address. This data is used to send the newsletter and to demonstrate that consent was given.
• Commercial information. If you tick the box consenting to commercial information in the form, I record that choice together with the date of the submission. I may then send you commercial information about JT CONSULTING services at the email address and phone number you provided. I write each such message personally and send it to one person, not to a mailing list.
• Protecting the form against abuse. The form is protected by ALTCHA, which runs on my own server without third-party services. To prevent automated mass submissions and confirmations sent to other people's addresses, I limit the number of submissions from one IP address and the number of submissions and confirmations for one email address per day. To count these attempts, I keep a cryptographic hash of the IP address and of the email address, not the addresses themselves, for no longer than one day.
• Server operation and security. The server logs technical data about each request, including the IP address and browser type.

3. On what legal basis

Answering an inquiry, sending a confirmation of receipt and the correspondence that follows rest on the legitimate interest of the controller (Article 6(1)(f) GDPR). Steps taken at your request toward entering into a contract rest on Article 6(1)(b) GDPR. Sending the newsletter rests on your consent (Article 6(1)(a) GDPR), which is also required by Article 398 of the Polish Electronic Communications Law, because the newsletter contains information about the services of JT CONSULTING. You give consent by ticking the box in the form and confirm it by clicking the link in the email sent to the address you provided. Sending commercial information to the email address and phone number you provided rests on your consent (Article 6(1)(a) GDPR), which is also required by Article 398 of the Polish Electronic Communications Law. You give this consent by ticking a separate box in the form. Keeping proof of consent, protecting the form, keeping server logs and making backups rest on the legitimate interest of the controller (Article 6(1)(f) GDPR), namely the need to demonstrate consent and keep the services secure.

4. Who I entrust the data to

In running the site, the form and the correspondence I use the services of the following entities:

• OVH provides the server, in a data center in Warsaw, on which the site, the contact form, the contact management system, the newsletter and the automations run,
• Amazon Web Services EMEA SARL sends emails, including form confirmations and the newsletter, through Amazon SES from a data center in Frankfurt,
• Microsoft Ireland provides email in the Microsoft 365 service,
• Google Ireland Limited provides email for the aiforeveryone.blog domain, from which the newsletter is sent, and stores encrypted server backups.

The contact form and the automations (n8n), the contact management system (Twenty), the newsletter (Listmonk) and the statistics (Umami) are software running on my own server; their developers have no access to the data. The entities listed above process the data on my instructions, under data processing agreements or their own statutory obligations, and they may not use it for their own purposes, with one exception: Amazon may store and automatically scan sent emails to block spam and malware.

5. Whether data leaves the European Economic Area

The server and the sending service operate within the European Union. With the Google, Microsoft and Amazon services, however, a transfer outside the European Economic Area cannot be ruled out. Any such transfer then takes place on the basis of a European Commission adequacy decision (the Data Privacy Framework) or standard contractual clauses.

6. How long I keep the data

• I keep form submissions and correspondence for as long as the matter is being dealt with, and after it closes for the period in which any claims could be brought, and no longer than three years.
• I keep data connected with a concluded contract for as long as tax and accounting law requires.
• I keep subscriber data until consent is withdrawn. After unsubscribing, the address stays on the list of unsubscribed addresses so that no further email is sent to it, and I keep proof of consent and of unsubscribing for the period in which any claims could be brought, and no longer than three years.
• I keep the data needed to send commercial information until consent is withdrawn, and I keep proof of consent and of its withdrawal for the period in which any claims could be brought, and no longer than three years.
• I delete a newsletter sign-up that is not confirmed after 30 days.
• I delete the hashes used to protect the form after one day.
• If processing a submission fails, the submitted data stays in the automation system for no longer than 14 days so that the cause of the error can be found.
• I keep server logs for 30 days.
• I keep backups for 7 days on the server and for 30 days in an encrypted external copy.

7. What rights you have

You have the right to access your data, to rectify it, to erase it, to restrict its processing and to transfer it, as well as the right to object to processing based on legitimate interest. You can withdraw your consent to the newsletter at any time in three ways: using the link at the bottom of every newsletter email, on the subscription settings page (linked from the confirmation of receipt sent after you use the form), or by writing to the address in section 1. You can withdraw your consent to commercial information at any time by replying to any such message or by writing to the address in section 1. Withdrawing consent does not affect the lawfulness of processing carried out beforehand. You are also entitled to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

8. Cookies and statistics

The site sets no cookies, and the contact form works without them too. Visit statistics are collected by Umami, a tool running on my own server, which uses no cookies and does not allow a visitor to be identified. In the newsletter, I count email opens and link clicks only in aggregate, without attributing them to any individual.

9. Whether providing data is mandatory

Providing data is voluntary. Without an email address, however, I will not be able to answer a message or send the newsletter. The company name and phone number in the form are optional. Consent to the newsletter and to commercial information is also voluntary, and not giving it does not affect the reply to your message.

10. Automated decisions and profiling

I do not take decisions based solely on automated processing, and I do not profile visitors to the site.

11. Changes to this policy

The policy may change as the site develops, for instance when new tools are added. The version published at this address applies, with the date given at the top.