privacy

Last updated: 18 October 2026 · Applies to idct.tech: the website, its contact and recommendation forms, and the sign-in page of the staff panel. Each app has its own policy, see section 12.

• What changed on 18 October 2026: this policy was rewritten as a complete GDPR (RODO) notice, on the model of the app policies. The contact form now asks for your consent and keeps a record of it: when you ticked the box, and what it said.

The short version. You can read everything on this site without giving us anything. There are no ads and no advertising cookies. If you write to us, we use what you send only to reply, with your consent, and delete it once the matter is dealt with. Google Analytics counts visits only if you accept it in the cookie banner. A Cloudflare spam check protects the forms.

1. Who is responsible (administrator danych)#

The controller of your personal data, administrator danych osobowych within the meaning of the GDPR / RODO, is:

IDCT Bartosz Pachołek, ul. Kaszubska 12/8C, 70-403 Szczecin, Poland, NIP (EU VAT): PL7642542255.

Contact for any privacy matter: the contact form, or a letter to the address above.

We have not appointed a Data Protection Officer (inspektor ochrony danych); we are not required to. Requests go straight to us.

2. What we collect, why, and on what legal basis#

Article 13 GDPR asks for a legal basis for each purpose, so here they are separately.

Data	Why	Legal basis	Kept for
Contact form: your name, email address, optional company, what you need and your message	To reply to you.	Art. 6(1)(a): your consent, given by ticking the box on the form. You can withdraw it at any time.	Until your matter is dealt with, including any follow-up, then deleted. If you withdraw consent, we delete it then.
The record of that consent: when you ticked the box, and its wording	To be able to show that you agreed.	Art. 6(1)(c): the legal obligation to demonstrate consent (Art. 7(1) GDPR).	As long as the message it belongs to.
A salted hash of the IP address a message came from (not the address itself), and your browser's user-agent string	To recognise and stop abuse of the form, such as spam from one source.	Art. 6(1)(f): our legitimate interest in a form that works and is not abused.	As long as the message it belongs to.
Your IP address, briefly	To limit how many messages and recommendations one address can send in a short time.	Art. 6(1)(f): preventing abuse.	Up to an hour, then dropped automatically.
Technical information about your browser and connection, processed by Cloudflare Turnstile on the pages with a form and on the staff sign-in	To tell people from bots before a form is accepted.	Art. 6(1)(f): protecting the forms from spam and abuse.	Held by Cloudflare under its privacy policy. We receive only whether the check passed.
Recommendation form: your name, title, company, how we worked together, an optional profile link, your email address and the recommendation	To review the recommendation and, once approved, publish it on the testimonials page.	Publication: Art. 6(1)(a), your consent, given by ticking the box on the form. Your email address: Art. 6(1)(f), our legitimate interest in asking you about your recommendation if we need to.	Until you ask us to change or remove it.
Server logs: the IP address, time, requested address and browser of each request	To keep the site secure and working, and to investigate faults and attacks.	Art. 6(1)(f): our legitimate interest in a secure site.	A short time, then deleted.
Analytics, only if you accept it: pages viewed, rough location, device and browser type, the link that brought you here and a few interactions	To see which pages are useful.	Art. 6(1)(a): your consent in the cookie banner, which you can withdraw at any time.	See section 3.

3. Analytics, only with your consent#

The site can count visits with Google Analytics 4, and it asks first. Until you press "accept analytics" in the cookie banner, nothing is loaded from Google and no analytics cookies are set; if you reject, or ignore the banner, it stays that way. While analytics is switched off for the site, there is no banner at all.

• What it measures: pages viewed, rough location (country or city), device and browser type, the link that brought you here, and a few interactions such as following an external link or downloading a file. We use it only to see which pages are useful.
• What it does not do: no advertising, no ad personalisation, no tracking across other websites, and no attempt to identify you. Advertising storage and ad personalisation are switched off in the consent signals the site sends.
• Withdrawing: use cookie settings at the bottom of every page. Withdrawing does not affect processing that already happened; rejecting also deletes the analytics cookies.
• Who processes it: Google Ireland Limited, with data processed by Google LLC in the United States (see section 6). Google Analytics 4 does not store IP addresses. See Google's privacy policy.
• How long: the analytics cookies last up to two years; your answer in the banner is kept in your browser for 180 days, then the banner asks again.

4. Cookies#

The site sets no advertising cookies. The forms and the staff panel need a few strictly necessary ones, and analytics sets its own only if you accept it. The cookie list names every one, with its purpose and lifetime.

5. Who else sees your data#

• Cloudflare, Inc.: Turnstile, the spam check on the forms and the staff sign-in. Privacy policy.
• Google Ireland Limited / Google LLC: Google Analytics, only if you accept it (section 3).
• Our hosting provider: runs the servers this site and its database are on, as a processor acting on our instructions.
• Our email provider: delivers the notice of each new message or recommendation to our mailbox and holds that mailbox, as a processor acting on our instructions. A copy of what you send therefore also sits in our email.
• The public: a published recommendation shows your first name, title, company, profile link and the text. Your surname and email address are never published.
• Supabase: only on the Whaaack! account page, where links from Whaaack! account emails land; that page talks straight to the game's backend. The Whaaack! privacy policy covers it.
• Authorities: only where the law obliges us to, for example on a court order.

We do not sell your data, and we do not use it for advertising.

6. Transfers outside the EEA#

Cloudflare and Google are established in the United States, so data handled by them may leave the European Economic Area. Both are certified under the EU-U.S. Data Privacy Framework, and the European Commission's Standard Contractual Clauses apply as a fallback. Any other provider of ours that moves data outside the EEA must use the same safeguards. You can ask us for a copy of the safeguards relied on through the contact form.

7. Do you have to give us your data?#

No. Reading the site needs nothing from you. The forms need a name, an email address and a message or recommendation; without them we cannot reply to you or publish anything. The spam check needs JavaScript and Cloudflare. If you would rather not use a form, write to us by post at the address in section 1.

8. Your rights#

Under the GDPR you have the right to:

• access your data and get a copy of it (Art. 15);
• rectify anything inaccurate (Art. 16);
• erasure (Art. 17);
• restrict processing (Art. 18);
• data portability for the data you gave us on the basis of your consent (Art. 20);
• object to processing based on our legitimate interest (Art. 21);
• withdraw consent at any time where consent is the basis: for a message or a recommendation, through the contact form or by post; for analytics, under cookie settings. Withdrawal does not affect the lawfulness of what happened before it.

Exercise any of them through the contact form or by post. Anything typed into a form proves nothing on its own, so before acting on a request about a message or a recommendation, we reply to the email address it was sent from. We answer within one month, as Art. 12(3) requires.

Complaints#

If you think we have handled your data badly, you can complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland, tel. 22 531 03 00, uodo.gov.pl.

9. Children#

The site is not directed at children. In Poland the age at which a child can consent to an information society service on their own is 16. If you are under 16, please ask a parent or guardian before you use a form. If you believe a child has sent us data, tell us and we will erase it.

10. Security#

• The site is served over HTTPS.
• Messages and recommendations can be read only by staff signed in to the panel with a role that allows it, and every change made there is logged.
• The staff sign-in is protected by the spam check and throttles repeated attempts; every form is protected against forged submissions.
• The IP address a message came from is stored only as a salted hash.

11. Automated decision-making#

None within the meaning of Art. 22 GDPR: we do not profile you. The only automatic step is the spam check, which refuses a form submission that looks like it comes from a bot. If that happens to you, write to us by post instead.

12. The apps#

Each app has its own policy, about what the app itself does (and does not) collect:

• Chromis
• Whaaack!
• Sticker Maker
• Gentastic
• Helena
• NUTS

13. Changes to this policy#

When this policy changes, we update the date at the top and say what changed. The current version always lives at this URL.