Privacy and Cookie Policy of janwestphal.site

​

Effective from: 22 August 2026

​

1. General information

Your privacy is important to me. This Policy explains what personal data may be processed when you use janwestphal.site, the purposes for which it is used, who it may be disclosed to and what rights you have in relation to your personal data.

​

This Policy has been prepared with regard to:

• Regulation (EU) 2016/679 of the European Parliament and of the Council, commonly known as the General Data Protection Regulation (GDPR);

• the Polish Act of 10 May 2018 on the Protection of Personal Data;

• the Polish Act of 12 July 2024 – Electronic Communications Law (Prawo komunikacji elektronicznej).

​

The Website allows you, among other things, to read articles, purchase digital products such as e-books and Excel-based tools, create a User Account and post comments.

​

Creating a User Account is voluntary and is not required to make a purchase. An Account allows you, among other things, to access your order history, use community features available on the Website and access future versions and updates of purchased digital products, where such updates are made available for the relevant product.

​

2. Personal Data Controller

The controller of your personal data is:

Jan Westphal, a natural person carrying out non-registered activity pursuant to Article 5 of the Polish Act of 6 March 2018 – Entrepreneurs’ Law (Prawo przedsiębiorców), Gdańsk, Poland.

​

If you have any questions concerning your personal data, you can contact me at:

aml@janwestphal.site

​

Given the nature and scale of the processing of personal data carried out through the Website, I am not required to appoint a Data Protection Officer under Article 37 of the GDPR.

​

3. What personal data may be processed

The scope of personal data processed depends on how you use the Website.

​

This may include, in particular:

• identification data, such as your first name, surname or username;

• your email address;

• information provided when placing an order or when a sales document is issued;

• information relating to your order, purchased products and payment status;

• information associated with your User Account;

• comments and other information you publish on the Website;

• information you provide when corresponding with me;

• technical information, such as your IP address, device information, browser type, operating system, session information and information about how you use the Website;

• information stored using cookies and similar technologies, depending on the consent you have provided.

​

I do not ask you to provide special categories of personal data through the Website, such as information concerning your health, political opinions, religious beliefs or biometric data.

​

4. Purchases and order fulfilment

If you make a purchase, I process the personal data necessary to:

• accept and fulfil your order;

• provide access to the purchased digital product;

• process the payment;

• contact you in connection with your order;

• handle complaints;

• comply with tax, accounting and record-keeping obligations;

• establish, exercise or defend potential legal claims.

​

The legal bases for processing are:

Article 6(1)(b) GDPR – processing necessary for the performance of a contract or to take steps at your request before entering into a contract;

Article 6(1)(c) GDPR – processing necessary to comply with legal obligations, in particular tax and accounting obligations;

Article 6(1)(f) GDPR – my legitimate interests in protecting my rights, establishing, exercising or defending legal claims and preventing fraud or misuse.

​

Providing the personal data required when making a purchase is voluntary, but it is necessary in order to fulfil your order. Creating a User Account is not a condition of making a purchase.

​

Where card payments are processed by an external payment provider, your full payment card details are submitted directly to that provider and are not stored by me.

​

I receive only the information necessary to confirm and settle the transaction.

​

5. User Account

You may voluntarily create a User Account on the Website.

​

Personal data associated with your Account is processed for the purposes of:

• creating and managing your Account;

• enabling you to log in;

• providing access to your order history;

• linking purchased products to your Account;

• providing access to updates of purchased products, where available;

• enabling you to use features intended for registered users, including posting comments;

• maintaining Account security and preventing misuse.

​

The primary legal basis for this processing is Article 6(1)(b) GDPR, as creating an Account involves entering into an agreement for the provision of electronic services.

​

Data relating to Website security and the prevention of misuse may also be processed on the basis of Article 6(1)(f) GDPR, namely my legitimate interest in maintaining the security of the Website and its users.

​

Personal data associated with your Account will be retained for as long as your Account remains active. After your Account has been deleted, certain data may continue to be retained where this is necessary to comply with legal obligations, maintain records of purchases or establish, exercise or defend legal claims.

​

Deleting your Account may result in the loss of access to features available exclusively to registered users, including access to future product updates made available through the Account.

​

6. Comments on articles and blog posts

Registered Users may post comments on selected content available on the Website.

​

When you post a comment, I may process information identifying your User Account, your username or pseudonym, the content of your comment, the date on which it was published and technical information associated with your use of the Website.

​

Please note that your published comment and the username associated with it may be publicly visible to other visitors to the Website. You should therefore not include information in your comments that you do not wish to make public.

​

The legal basis for processing personal data in connection with posting comments is Article 6(1)(b) GDPR, as the processing is necessary to provide you with the commenting functionality.

​

The data may also be processed on the basis of Article 6(1)(f) GDPR for the purposes of content moderation, maintaining Website security, preventing spam and misuse, and establishing, exercising or defending legal claims.

​

7. Contacting me

If you contact me by email or through another communication channel available on the Website, I process the personal data included in your message in order to respond to your enquiry and conduct correspondence with you.

​

The legal basis for processing is:

Article 6(1)(f) GDPR – my legitimate interest in conducting correspondence and responding to enquiries;

or Article 6(1)(b) GDPR, where your enquiry concerns entering into or performing a contract.

​

Your personal data is retained for as long as necessary to deal with your enquiry and, where appropriate, for the period necessary to establish, exercise or defend potential legal claims.

​

8. Information about updates to purchased products

If you have a User Account linked to a purchased product, I may use information relating to your Account and order to enable you to download new or updated versions of that product.

​

This processing is carried out on the basis of Article 6(1)(b) GDPR, as it relates to the provision of services connected with the product you have purchased.

Information concerning the availability of an update to a product is not treated as marketing where it relates to a product you have already purchased and is provided solely for the purpose of performing or supporting the service connected with that product.

​

9. Electronic marketing

If the Website provides an option to subscribe to a newsletter or receive other marketing communications electronically, such communications will be sent only after the required consent has been obtained.

​

The legal basis for processing personal data in this case is Article 6(1)(a) GDPR, namely your consent, in conjunction with the rules governing electronic marketing communications set out in Article 398 of the Polish Act of 12 July 2024 – Electronic Communications Law (Prawo komunikacji elektronicznej).

​

Providing marketing consent is voluntary and is not a condition of making a purchase or creating a User Account.

​

You may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal.

​

10. Technical data, security and statistics

When you use the Website, certain technical information relating to your connection and use of the Website may be collected automatically, such as your IP address, device type, browser type, time of visit or information about errors that occur while using the Website.

​

Data necessary for the proper operation and security of the Website and for detecting misuse may be processed on the basis of Article 6(1)(f) GDPR, namely my legitimate interest in maintaining the security and proper functioning of the Website.

​

Data used for additional analytics or marketing purposes through cookies or similar technologies is processed only after consent has been obtained, where such consent is required.

​

11. Cookies and similar technologies

The Website uses cookies and similar technologies.

​

Cookies are small pieces of information stored in your browser or on your device. They may be used, among other things, to maintain your session, enable your User Account and shopping basket to function, remember your preferences, maintain security and, subject to obtaining the appropriate consent, analyse how the Website is used or support marketing activities.

​

Cookies may be divided into the following categories:

Essential cookies – cookies required for the proper operation of the Website and for providing functionality you have requested, such as logging in, operating the shopping basket, processing payments and maintaining security. Their use does not require consent where the conditions for an exemption from the consent requirement under applicable law are met.

Functional, analytics and marketing cookies – these are used in accordance with the consent choices made by the user, where their use requires consent.

​

When you first visit the Website, you can make choices regarding the use of cookies other than essential cookies through the consent management mechanism available on the Website.

​

You can subsequently change your choices or withdraw your consent through the cookie settings available on the Website.

​

You may also delete or block cookies directly through your browser settings. However, blocking essential cookies may prevent certain Website features, such as logging in or placing orders, from functioning correctly.

​

Up-to-date information about the cookies used on the Website, their providers, purposes and retention periods may be available through the Website's cookie settings panel.

​

12. Recipients of personal data

To operate the Website, I use services provided by external suppliers. Personal data is disclosed to them only to the extent necessary for the provision of the relevant service.

​

The main recipients include:

Wix.com Ltd., other Wix group companies and their subcontractors – providers of the Website infrastructure, hosting and functionality associated, among other things, with the online shop, User Accounts, comments and technical operation of the Website;

Stripe Payments Europe, Limited and Stripe Technology Europe, Limited – where payments are processed through Stripe;

PayPal (Europe) S.à r.l. et Cie, S.C.A. – where payments are made through PayPal;

Revolut Bank UAB – where payments are made through Revolut or by bank transfer to an account provided by Revolut;

providers of email, technical and security services – to the extent necessary for the operation of the Website and communications;

public authorities – only where I am legally required to disclose personal data to them.

​

Certain payment providers and other service providers may, in some circumstances, process your personal data as independent data controllers. This means that they independently determine how and why they process personal data within the scope of the services they provide and the legal obligations applicable to them.

​

13. Transfers of personal data outside the European Economic Area

Some of the technology providers used by the Website operate globally and may process personal data outside the European Economic Area (EEA).

​

Where this occurs, personal data may be transferred:

• to a country in respect of which the European Commission has adopted an adequacy decision;

• to an organisation covered by a recognised mechanism providing an adequate level of data protection;

• on the basis of Standard Contractual Clauses approved by the European Commission;

• on the basis of other safeguards permitted under the GDPR.

​

Wix.com Ltd. is based in Israel, a country that the European Commission has recognised as providing an adequate level of protection for personal data. Wix also uses infrastructure and service providers located in other countries. Where appropriate, additional safeguards are therefore used in connection with international transfers of personal data.

​

14. How long I retain personal data

The retention period depends on the purpose for which the personal data is processed.

​

Personal data associated with orders and sales documentation is retained for the period required under applicable tax and accounting legislation and for the period necessary to establish, exercise or defend potential legal claims.

​

Personal data associated with a User Account is retained for as long as the Account remains active and, after its deletion, only to the extent required by law or necessary to establish, exercise or defend legal claims.

​

Data associated with comments may be retained for as long as the comments remain published and subsequently where this is necessary for moderation, security or the establishment, exercise or defence of legal claims.

​

Data relating to correspondence is retained for as long as necessary to resolve the relevant matter and, where justified, for the applicable limitation period for potential legal claims.

​

Personal data processed on the basis of consent is processed until the consent is withdrawn or until the purpose for which the data was collected ceases to apply, whichever occurs first, subject to the retention of information necessary to demonstrate that consent was given or withdrawn.

​

15. Your rights

Depending on the legal basis and nature of the processing, you may have the right to:

• access your personal data and obtain a copy of it;

• have inaccurate personal data rectified;

• have your personal data erased;

• restrict the processing of your personal data;

• receive and transmit your personal data to another controller where the conditions for data portability under the GDPR are met;

• object to processing based on my legitimate interests;

• withdraw your consent at any time where your personal data is processed on the basis of consent.

​

The right to erasure is not absolute. I may be required to retain certain information, for example information relating to completed sales, where retention is required by law or where the information is necessary to establish, exercise or defend legal claims.

​

Where personal data is processed for direct marketing purposes, you have the right to object to such processing at any time.

​

To exercise any of your rights, please contact me at:

aml@janwestphal.site

​

16. Right to lodge a complaint

If you believe that your personal data is being processed unlawfully, you have the right to lodge a complaint with the Polish supervisory authority:

President of the Personal Data Protection Office
(Prezes Urzędu Ochrony Danych Osobowych – Prezes UODO)

​

This is the independent public authority responsible for supervising compliance with data protection law in Poland. The authority itself uses “President of the Personal Data Protection Office” as its official English name. 

​

However, I encourage you to contact me first at aml@janwestphal.site so that I can review the matter and respond to your concerns.

​

17. Automated decision-making

I do not make decisions concerning Users based solely on automated processing that produce legal effects concerning them or similarly significantly affect them.

​

18. Data security

I use appropriate technical and organisational measures designed to protect personal data against loss, unauthorised access, disclosure, alteration or destruction.

​

The Website also benefits from technical security measures provided by infrastructure providers and payment service providers.

​

19. Links to external services

The Website may contain links to external websites and services, such as LinkedIn, WhatsApp, PayPal, Stripe or Revolut.

​

Once you leave the Website and access an external service, the processing of your personal data is governed by the privacy policy and practices of the relevant external service provider.

​

20. Changes to this Privacy Policy

This Policy may be updated, in particular where there are changes to applicable law, the way in which the Website operates, the tools used on the Website or the service providers I use.

​

The current version of this Policy will always be made available on the Website together with its effective date.

​

21. Contact

If you have any questions about this Policy or the processing of your personal data, please contact me:

Jan Westphal
Email: aml@janwestphal.site