Privacy and cookie policy

1. Data controller

The controller of your personal data is:

Dariusz Małojło
ul. Magnolii 7, 43-385 Jasienica, Poland
Tax ID (NIP): 5471988924
Email: kontakt@dariuszmalojlo.pl
Website: dariuszmalojlo.pl

2. What data I process and why

2.1 Contact form

When you send a message through the contact form, I process your name and email address. The purpose is to reply to your message and — if your message calls for it — to provide a service. Legal basis: Art. 6(1)(b) GDPR (steps taken before entering into a contract) or Art. 6(1)(f) GDPR (legitimate interest — replying to correspondence). I keep the data for as long as needed to handle your enquiry and the related accounting, and no longer than 3 years after our last contact.

The form is run by an external platform, Formspree (Formspree Inc., USA). Data is transferred on the basis of standard contractual clauses (Art. 46 GDPR). Formspree privacy policy: formspree.io/legal/privacy-policy.

2.2 Newsletter

If you subscribe to the newsletter, I process your email address to send you messages about DMCO sessions, courses and events. Legal basis: Art. 6(1)(a) GDPR (your consent). You can withdraw your consent at any time by clicking the “unsubscribe” link in any message or by writing to kontakt@dariuszmalojlo.pl.

The newsletter is run by the MailerLite platform (UAB MailerLite, Lithuania). MailerLite privacy policy: mailerlite.com/legal/privacy-policy.

2.3 Payments — Paynow

If you pay online — through a form on the website or through a payment link sent by email — you will be redirected to the Paynow website (mBank S.A.). You give your transaction details (name, card or account details) directly to Paynow — Paynow is then an independent controller of your data. I receive a payment confirmation together with the registration details you entered yourself in the sign-up form — without your card details and without your online banking login details. Paynow privacy policy: paynow.pl/polityka-prywatnosci.

2.4 Analytics — Google Analytics 4

If you consent to analytics cookies, I use Google Analytics 4 (Google LLC, USA) to analyse traffic on the website. GA4 collects anonymised data about the pages you visit, the length of your visit and where you came from. The data is processed on the basis of Art. 6(1)(a) GDPR (your consent). You can withdraw your consent at any time — see section 4. Google privacy policy: policies.google.com/privacy.

2.5 Registration and purchases with online payment

If you use a form on the website to register for an event, book a one-to-one session, buy a recording or an online course, or pay for the Regular Breath Practice, I process your first name and email address and — when the form asks for it — also your surname. I also process the details of your order: the name of the service, its date (if it has one), the amount, the payment ID and its status.

Legal bases: Art. 6(1)(b) GDPR — concluding and performing the contract (taking part in an event or session, access to a recording or course, payment for the Regular Breath Practice); Art. 6(1)(c) GDPR — accounting and tax obligations; Art. 6(1)(f) GDPR — my legitimate interest in knowing who takes part in practice held in a physical space (this applies to in-person events and sessions).

Giving this data is voluntary, but it is necessary to conclude the contract. Without it I cannot confirm your registration or payment, or provide the recording or course.

I keep registration data for 12 months — from the day of the event or session, and for recordings, online courses and payments for the Practice from the day of payment — and then delete it. If access to a recording or course lasts longer, I keep the data for as long as the access lasts. Data needed for tax purposes is kept for the period required by law — 5 years from the end of the year in which the tax obligation arose.

The data is stored on the hosting provider’s servers within the European Economic Area. Only I have access to it, after authentication. I do not pass it on to anyone except the payment operator and my accounting office, to the extent required by law.

The terms of participation, payment and withdrawal from the contract are set out in the Terms of service.

3. Your rights

You have the right to:

• access your data and receive a copy of it,
• rectify (correct) your data,
• erase your data (“the right to be forgotten”),
• restrict processing,
• data portability,
• object to processing,
• withdraw your consent — without affecting the lawfulness of processing carried out before the withdrawal.

To use these rights, write to kontakt@dariuszmalojlo.pl. I will reply without undue delay, and no later than within 30 days.

You also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

4. Cookies

What are cookies?

Cookies are small text files that your browser saves on your device. They let the website work properly and — if you consent — let me analyse traffic.

Which cookies do I use?

Category	Example	Purpose	Basis
Essential	Cloudflare Turnstile	Protecting the form against spam (bot detection)	Legitimate interest — always on
Functional	dmco_cookie_consent	Remembering your choice in the cookie banner	Legitimate interest — always on
Essential	dmco_zapis	After returning from a Paynow payment: shows which payment the confirmation page refers to. Valid for 1 hour, contains no personal data	Legitimate interest — always on
Analytics	Google Analytics 4 (_ga, _gid)	Traffic statistics — number of visits, sources, pages	Your consent — required before they run

How can you manage cookies?

On your first visit a cookie banner appears — you can accept or decline analytics cookies. You can change your decision at any time by clicking the “Cookie settings” link in the footer of the website.

You can also manage cookies directly in your browser (settings → privacy). Turning off essential cookies may stop the contact form from working properly.

5. Transfers of data outside the EEA

Formspree (USA) and Google (USA) may process data outside the European Economic Area. This takes place on the basis of standard contractual clauses approved by the European Commission (Art. 46 GDPR), which ensure an adequate level of protection.

6. Data security

I use technical and organisational measures appropriate to the risk — HTTPS encryption, limited access to data and working only with trusted processors.

7. Changes to this policy

If there are significant changes, I will announce them on the website or — if you subscribe to the newsletter — by email. The current version is always available at dariuszmalojlo.pl/en/privacy-policy/.