Privacy policy

This policy explains how personal data are processed on paweljarosz.pl, including the Codeward studio pages, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”).

Controller

The controller of your personal data is Paweł Jarosz, trading as Paweł Jarosz Software Development, Os. 2. Pułku Lotniczego 2/39, 31-867 Kraków, Poland, Tax ID (NIP): 6751729992, who runs the game development studio Codeward (the “Controller”, “we”).

For any matter related to your personal data, contact us by email at biuro@paweljarosz.pl or by phone at +48 737 504 274.

What data we process, why and on what basis

• Contact form. When you send a message through the form, we process your name, email address and the content of your message. The message is stored in a database on our hosting server and delivered to our mailbox, and a short automatic confirmation, without the content of your message, is sent to the email address you provide. We use these data to answer your inquiry and, if you wish, to prepare an offer or take other steps before concluding a contract (Article 6(1)(b) GDPR) and on the basis of our legitimate interest in replying to messages sent to us (Article 6(1)(f) GDPR).
• Direct email or phone contact. If you contact us by email or phone, we process the data you provide for the same purposes and on the same legal bases.
• Protection of the contact form. To protect the form against spam and abuse, we process your IP address, the time of submission, your browser’s user agent and the email address entered in the form. The IP address and submission times are used to limit the number of messages sent in a short period, and the security log records events such as successful submissions or blocked attempts. The legal basis is our legitimate interest in keeping the website secure (Article 6(1)(f) GDPR).
• Google reCAPTCHA. The form uses Google reCAPTCHA v3, which is loaded only when you start using the form. reCAPTCHA collects information about your device and how you use the page (for example IP address, browser data and interactions) and sends it to Google to assess whether the submission comes from a person or a bot. The result does not produce legal effects for you. The legal basis is our legitimate interest in protecting the form against spam (Article 6(1)(f) GDPR). Data processed by Google are also subject to the Google Privacy Policy and Terms of Service.
• Server logs. Like most websites, our hosting provider automatically records technical data about visits (such as IP address, date and time, requested address and browser information) to keep the service running and secure (Article 6(1)(f) GDPR).
• Cooperation. If we start working together, we process the data needed to conclude and perform the contract (Article 6(1)(b) GDPR) and to meet accounting and tax obligations (Article 6(1)(c) GDPR).

Providing your data is voluntary, but without your email address and message we cannot reply to your inquiry. We do not use your data for automated decision-making that produces legal effects or for profiling.

Cookies and analytics

The website does not use analytics, advertising or marketing cookies and does not track you across websites. A technical session cookie may be set when you send the contact form, and Google reCAPTCHA may use cookies and similar technologies when it is loaded. You can delete or block cookies in your browser settings, although blocking reCAPTCHA may prevent the form from working.

Links to external services such as YouTube, Steam, itch.io, GitHub, LinkedIn or X open those services, which process data under their own policies. Some game screenshots on the Witchcrafter page are loaded from itch.io servers, which receive your IP address when the images load.

Recipients of data

Your data may be disclosed only to the extent necessary to:

• our hosting and email provider, nazwa.pl sp. z o.o. with its registered office in Kraków, which stores the website, database and mailbox;
• Google Ireland Limited and Google LLC, in connection with reCAPTCHA;
• accounting and IT service providers, if this is necessary for cooperation with you or for the operation of the website;
• public authorities, where required by law.

Transfers outside the European Economic Area

Data related to the contact form, the database and email are stored by our hosting provider in the European Economic Area. Data collected by Google reCAPTCHA may be transferred to the United States. Google LLC participates in the EU-U.S. Data Privacy Framework, and transfers are also covered by the standard contractual clauses approved by the European Commission.

How long we keep data

• Inquiries and correspondence: for as long as needed to handle your inquiry and continue our conversation, and no longer than 12 months after our last contact, unless we conclude a contract.
• Data related to a contract: for the duration of the contract and then until claims become time-barred, and accounting documents for the period required by tax law.
• Rate-limiting data (IP address and submission times): no longer than 15 minutes after a submission attempt.
• Security log of the contact form: up to 30 days.
• Server logs: for the period set by the hosting provider.

Your rights

You have the right to:

• access your data and receive a copy of them (Article 15 GDPR);
• rectify your data (Article 16 GDPR);
• have your data erased (Article 17 GDPR);
• restrict processing (Article 18 GDPR);
• data portability, where processing is based on a contract and carried out by automated means (Article 20 GDPR);
• object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Article 21 GDPR).

To exercise your rights, write to biuro@paweljarosz.pl. We will reply without undue delay and in any case within one month. If you believe that your data are processed unlawfully, you have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.

Changes to this policy

We may update this policy when the website or the way we process data changes. The current version is always published on this page.

Last updated: 13 October 2026.