Personal data

Who collects the data, and what for

The data controller is Hania Derej. For anything concerning personal data, write to kontakt@haniaderej.com.

Email addresses are collected for one purpose: to send the newsletter with news about new music and concerts. They are used for nothing else, and they are never sold or shared for marketing.

What exactly is stored

The email address, the chosen language (Polish or English), the date of sign-up and of confirmation, and a shortened IP address from both moments — without the last part, so it points to a town rather than a person. Those two dates and two addresses are the proof that consent was given; without them we could not demonstrate it.

We do not collect names, we do not check whether a letter was opened, and we do not count clicks. The letters carry no tracking pixels and no redirects through anyone else's servers.

On what basis

On the basis of your consent — Article 6(1)(a) GDPR. You give it in two steps: by entering your address in the form and by clicking the link in the letter that follows. Without that second step the address never reaches the list and deletes itself after seven days.

Sending commercial information by electronic means is done with the consent required by Polish electronic communications law.

For how long

Until you withdraw your consent. Unsubscribing deletes the address — it does not mark it inactive, it removes it. What remains is an irreversible fingerprint from which the address cannot be reconstructed, and which is enough to keep you from being put back on the list by a bulk import.

Sign-ups nobody confirmed disappear after seven days.

Who the data is passed to

The list of addresses lives on our own server and is not run by any outside company. To deliver a single letter we use a mail service acting as a processor under a data processing agreement — it sees the address at the moment of sending and may not use it for anything else.

The addresses on the newsletter list are not transferred outside the European Economic Area. Visit statistics are a separate matter — what Google Analytics collects, and where it goes, is described in the "Cookies" section at the end.

How the data is protected

The addresses sit in a file outside the site directory and are encrypted with a key kept separately. They never reach the code repository or the backups of the site's content. The whole site and the panel run over HTTPS.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable form. You may withdraw your consent at any time — every letter carries a link that takes you off the list in one click, with no login and no questions asked.

You may also lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.

Cookies

The site uses Google Analytics to know how many people visit, which pages they read and where they arrive from — a search engine, social media, or somebody's link. No names and no email addresses are collected along the way, and these counts are never joined up with the newsletter list; the two are separate things that meet nowhere.

None of it happens without your consent. On a first visit a bar with the question stands at the foot of the screen, and until you answer — or if you answer “no” — Analytics does not start at all; not even its script is in the page. Refusing costs you nothing: the site works exactly the same, you simply do not appear in the statistics. You can change your choice at any time. Change your choice

Once you agree, Analytics stores two cookies in your browser, _ga and _ga_E3781XGNMD, both lasting two years. They serve to recognise that the same browser has come back — without them two visits by one person would count as two people. The data goes to Google Ireland Limited and may be processed on servers outside the European Economic Area, under the Data Privacy Framework.

Withdrawing consent works from that moment onwards: the tag stops loading, but cookies written earlier stay in your browser — no site has access to another domain's cookies, so we cannot delete them for you. You remove them in your browser settings, or block them for good with any ad blocker or with Google's own opt-out add-on.

Beyond that two cookies of our own remain, neither of which tracks anything, so neither needs consent. lang records the language you pick with the PL / EN switch — there is nothing in it but two letters, pl or en. consent remembers your answer to the cookie question, so that it is not asked again on every page; it lives six months, and then the question comes back.