Privacy policy

delta240mvt · last updated: 30 October 2026

This policy explains how I process the data of people who visit delta240mvt.com, read the portal and the blog, subscribe to the newsletter and use the shop features. It also covers cookies and browser storage.

You can read the portal without an account and without consenting to analytics. The newsletter requires separate consent and confirmation of your email address. This policy applies to this portal, not to the separate applications presented in the portfolio, such as InstaScaler, FRINTER or KURCZOKER.

1. Controller and contact

The data controller is Przemysław Filipiak, operating under the delta240mvt brand. Correspondence address: ul. Maków Polnych 12a, 61-606 Poznań, Poland.

For privacy matters and exercising your rights, write to hello@delta240mvt.com, and for newsletter matters to newsletter@delta240mvt.com. You can also use delta240mvt@gmail.com. I have not appointed a Data Protection Officer; I handle data matters personally.

2. What data I process and why

Displaying the site, security and contact

The server receives the IP address, the time and address of the request, information about the response and technical headers, which may contain details of the browser, the operating system and the referring page. They are needed to deliver the page, keep it available and detect errors and abuse. The legal basis for providing the requested service is Article 6(1)(b) GDPR, and for protecting the site and diagnostics Article 6(1)(f) GDPR, that is the legitimate interest in keeping the portal running securely.

When you send an email, I process the return address, the content, attachments, signature details and delivery information. I handle ordinary correspondence under Article 6(1)(f) GDPR, the legitimate interest in replying and resolving requests. I handle enquiries about entering into or performing a contract, to the extent necessary, under Article 6(1)(b) GDPR. Providing data is voluntary, but without a return address and a description of the matter I may not be able to reply.

Blog comments

Commenting on the blog and in other sections of the portal is disabled site-wide. The portal does not display a comment form, does not collect commenters’ data (such as name, email address, comment text or comment author cookies) and does not load external Gravatar avatars next to posts. For questions about articles, repositories or materials, you can write directly to the email address given in section 1.

Shop, account and orders

The portal runs on WordPress and WooCommerce. When you use the cart, the selected products and a session identifier are processed. Order features may require your first name, last name, email address and billing details, and depending on the order also a phone number, company name or tax ID (NIP). Order items, amounts, statuses, order notes and correspondence are stored. For existing accounts, this also includes login details, the profile and order history. Public registration on the “Moje konto” (My account) page is currently disabled.

The legal basis for handling the cart, the account and performing the contract is Article 6(1)(b) GDPR. I process tax records and legally required settlements under Article 6(1)(c) GDPR, in connection with the applicable tax laws. Data needed to establish, pursue or defend claims is processed under Article 6(1)(f) GDPR. Providing data marked as required is necessary to complete the given action; it does not mean consent to the newsletter.

Status as of the date of this update: Stripe payments and Google Calendar bookings are not enabled, and the purchase of workshops is blocked. I currently do not collect card data through these integrations or pass booking data to Google. Enabling them will require up-to-date information about the processing and terms of sale. The mere presence of an offer or a Stripe entry in the cookie register does not mean that payments work.

3. Newsletter

The newsletter contains practical content about AI, projects and automation, as well as information about my workshops and products. Subscribing is voluntary: you tick the consent box and confirm your address with a link in an email (double opt-in). Without confirmation, the subscription is not completed. I do not add anyone to the newsletter merely for visiting the site, contacting me by email or making a purchase.

I process the email address, the form source, the consent version, the time of the request and information about confirmation and unsubscribing. Brevo (Sendinblue) handles the sign-up and sending. It records deliveries and bounces and, depending on the message and email settings, also opens and clicks. This helps assess deliverability and interest in the content; the readings may be inaccurate because of the email client’s privacy protection mechanisms.

Sending the newsletter and the related assessment of interest in it are based on consent, Article 6(1)(a) GDPR; I send commercial information in accordance with Article 398 of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej). Protecting the form, keeping proof of consent and honouring unsubscribes are based on Article 6(1)(f) GDPR: the legitimate interest in preventing abuse and demonstrating that subscriptions are handled correctly.

You can unsubscribe with the link in the footer of each email or by writing to newsletter@delta240mvt.com. Withdrawing consent does not affect the lawfulness of earlier processing. Newsletter consent is separate from cookies: you can subscribe without consenting to site analytics. Brevo is handled by the server; the form does not need a Brevo tracker in the browser. More information is available on the page sign-up and data information.

4. Analytics and ad measurement

After you consent to the “Analytics” category, the portal starts PostHog to measure page views, clicks on the topic of the day, topic zones, the offer and projects, page scrolling, use of the search (without the query text), and newsletter form and cart events. It processes pseudonymous browser and session identifiers, the page address without query parameters, the event type and selected parameters, e.g. a product identifier or scroll percentage, as well as the device type, browser, operating system, screen size, the domain of the page you came from (without the full address) and campaign tags (utm). The purpose is to improve the portal’s content and usability; the legal basis is Article 6(1)(a) GDPR.

The configuration disables session recording, automatic capture of all interactions and the creation of personal profiles. I do not pass email addresses, names, typed search queries or form fields to events. Storing the IP address as an analytics property is disabled; the provider still technically handles the IP address when connecting. Pseudonymous identifiers are not completely anonymous data.

The European PostHog ingestion endpoint has been selected. You can withdraw consent in the cookie settings: this stops further collection of events by this integration and starts the removal of available PostHog data in the browser. It does not undo requests already sent; you can request deletion of related data on the server by email.

After the same analytics consent, I start Google Analytics 4 (Google Ireland Limited) to count visits and the effectiveness of paths, including newsletter sign-ups and purchases. Google Signals and ad personalisation are disabled, and the page address is sent to GA4 without query parameters other than campaign tags. More: how Google safeguards data in Google Analytics.

After you consent to the “Advertising” category, I start the Meta Pixel (Meta Platforms Ireland Limited), a separate one for the Polish and the English version of the portal. It is used to measure the effectiveness of ads on Facebook and Instagram and to target ads at people who have visited the portal. It sends page views and the following events: viewing an offer, adding to cart, starting an order, subscribing to the newsletter and a purchase (value and currency). I do not pass email addresses, phone numbers or other contact details. The legal basis is Article 6(1)(a) GDPR. For the collection and transmission of this data I am a joint controller with Meta (Controller Addendum); further processing is described in the Meta Privacy Policy. You can withdraw consent to the “Advertising” category independently of analytics.

I do not sell data or make decisions based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.

5. Cookies and browser storage

Cookies are small pieces of information stored on your device. The portal also uses localStorage and the browser’s session storage. Necessary storage handles, among other things, the cart, sign-in and remembering your consent decision. To the extent necessary to provide the requested service, the exemption in Article 399(3) of the Polish Electronic Communications Law applies; additional technologies that require consent are started after you choose the relevant category.

You can change your choice with the “Cookie settings” link in the footer of every page. You can reject the optional categories or customise them and save your preferences. Simply entering the site and scrolling do not constitute consent. Necessary cookies may also contain identifiers linked to a person; I do not automatically treat them as anonymous.

• cookieyes-consent: the consent categories you chose, up to 365 days.
• woocommerce_cart_hash, woocommerce_items_in_cart: handling changes to and the contents of the cart, until the end of the browser session.
• wp_woocommerce_session_*: linking the browser to the cart on the server, as a rule 2 days for a guest and 7 days after signing in.
• wordpress_test_cookie, wordpress_logged_in_*: checking cookies and keeping you signed in, for the session, and up to 14 days if you choose to stay signed in.
• wp-settings-*, wp-settings-time-*: interface preferences of a signed-in user, up to one year.
• _ga, _ga_*: Google Analytics 4 after analytics consent, up to 2 years (the browser may shorten this period).
• _fbp, _fbc: Meta Pixel after advertising consent, up to 90 days; _fbc only when arriving from a Meta ad.
• ph_*_posthog: a pseudonymous identifier for analytics after consent, up to 365 days, refreshed while you use the site.
• ph_*, __ph_opt_in_out_* (localStorage, sessionStorage): after analytics consent, PostHog stores the identifier, session, window and consent state there. Local storage has no expiry date, and session storage disappears when the tab is closed; withdrawing consent removes both kinds of entries.
• lastExternalReferrer, lastExternalReferrerTime, multiFbc (localStorage): after advertising consent, the Meta Pixel remembers the last external referring page and Meta ad click identifiers; withdrawing consent removes them.
• d240_purchase_ga_*, d240_purchase_meta_* (localStorage): a marker that a purchase has already been reported to GA4 or Meta, so it is not counted twice; stored only after consent to the given category and removed when that consent is withdrawn.
• Cart storage (wc_cart_hash_*, wc_fragments_*): WooCommerce may keep auxiliary data and cart fragments in local or session storage; they are replaced when the cart is updated and removed together with site data, and session storage expires when the tab session ends.

An asterisk stands for a variable part of the name. Not every entry appears on every visit; this depends on the features and consents. A detailed register with categories and durations is available in the cookie panel. Stripe entries marked as planned do not mean they are currently used.

You can also delete site data in your browser settings. Deleting or blocking necessary cookies may sign you out and remove the link to your cart; deleting the CookieYes decision will make the site ask for consent again. This does not automatically delete correspondence or data stored on the server.

6. Providers and recipients of data

• SEOHOST Sp. z o.o.: WordPress hosting, the shop database, backups, logs and the hello@delta240mvt.com and newsletter@delta240mvt.com mailboxes. SeoHost privacy policy (in Polish).
• Brevo / Sendinblue: newsletter sign-up, confirmation, sending and unsubscribe handling, and message event data. Brevo privacy policy.
• PostHog Inc.: portal analytics after consent, to the extent described in section 4. PostHog privacy policy and data processing agreement.
• Google Ireland Limited: Google Analytics 4 after analytics consent, to the extent described in section 4.
• Meta Platforms Ireland Limited: Meta Pixel after advertising consent, to the extent described in section 4. Meta privacy policy.
• Google Ireland Limited / Google LLC: handling correspondence if you write to delta240mvt@gmail.com. This mailbox uses Gmail under the Google privacy policy; this is not a statement that I use Google Workspace.
• Cloudflare, Inc.: DNS for the domain, that is routing domain names to the right server. The portal is hosted at SeoHost; it is not an application hosted on Cloudflare Pages or Workers. Cloudflare privacy policy.

Infrastructure providers process data within the scope of their services and use subprocessors. For services provided on my instructions they act as processors, and for their own purposes set out in their policies they may act as separate controllers. Merely using the WordPress and WooCommerce software does not mean that the whole customer database is transferred to their makers.

Data may be received by authorised persons providing technical, accounting or legal services, only to the extent needed for the task, and by competent authorities where the law requires it.

Links to Facebook, Instagram, TikTok, LinkedIn, GitHub and projects lead to separate services. Once you go there, their privacy rules apply. The portal does not collect your Instagram messages, tokens of connected accounts or KURCZOKER game saves.

7. Transfers outside the EEA

Providers may use international infrastructure and support, including in the USA. The European PostHog ingestion endpoint is not a guarantee that every operation of all providers stays in the European Economic Area.

When data is transferred outside the EEA, safeguards appropriate to the given operation are used: European Commission adequacy decisions, including the EU–US Data Privacy Framework for the entities it covers, or the European Commission’s standard contractual clauses, together with the required supplementary measures. The mechanisms are described in the PostHog DPA, Brevo documents, Google’s data transfer frameworks, the Meta policy and the Cloudflare DPA. Write to the controller to get information about the safeguards that apply to your data and how to obtain a copy of them.

8. How long I keep data

• Correspondence: for the time needed to handle the matter, and then up to 12 months after it is closed, unless a specific message has to be kept because of a contract, a legal obligation or claims.
• Newsletter: until consent is withdrawn or the newsletter ends. After unsubscribing, limited proof of consent and an entry blocking sending may remain for as long as they are needed to honour the unsubscribe or resolve claims. I do not use them for further marketing. An unconfirmed sign-up is used only to handle the confirmation, protect against abuse and resolve any complaint about the sign-up; it is not an active subscription.
• Comments: commenting on the portal is disabled and the portal does not store data from a comment form.
• Account: for as long as it is maintained, until it is deleted, except for information required separately for settlements or claims. I keep order data for the time needed to handle the contract and complaints and for the applicable period of tax obligations and limitation of claims. Tax documents are kept, as a rule, for 5 years from the end of the year in which the tax payment deadline expired, taking into account events that affect the running of that period. This does not mean that all account data is kept for that period.
• Analytics: data linked to a browser identifier is kept for the time needed to compare content use and assess changes to the portal; once that purpose ends, it is deleted or anonymised. Withdrawing consent stops new collection; a deletion request also covers data collected earlier, where it can be linked to you. The cookie lifetime described in section 5 is not a deadline for automatically deleting events from the server. In Google Analytics 4, event-level and user-level data is kept for 14 months (a service setting) and then deleted automatically; only aggregated reports remain. Meta keeps the data sent by the Meta Pixel under the terms described in its privacy policy.
• Form protection: the newsletter limit for an email hash applies for 5 minutes, and for an IP hash for 15 minutes. The expiry of a block does not mean the entry is immediately physically removed from database copies.
• Logs and backups: for the period needed to detect and investigate incidents and restore a working service. Data in backups is subject to the provider’s backup replacement or deletion cycle; it is not a source of further marketing after unsubscribing. Data needed in specific proceedings may remain until they end and the applicable time limits expire.
• Data requests: for the time needed to handle them and to demonstrate that GDPR obligations were met, and in the event of a dispute for the period necessary to resolve it.

I apply purpose limitation and data minimisation. The obligation to keep a billing document does not automatically extend the storage of all correspondence or newsletter consent.

9. Your rights

Under the GDPR, you can request access to your data and a copy of it, rectification, erasure or restriction of processing. The right to data portability covers data you provided, processed by automated means on the basis of consent or a contract, where the conditions of Article 20 GDPR are met.

You can object to processing based on legitimate interest on grounds relating to your particular situation. I will stop such processing unless I demonstrate compelling legitimate grounds that override your rights or grounds related to claims. An objection to direct marketing is unconditional. You can withdraw consent at any time, without affecting the lawfulness of earlier actions.

Send your request to hello@delta240mvt.com or to the correspondence address in section 1. Handling of rights is based on Article 6(1)(c) GDPR in connection with Articles 12–22 GDPR. I will reply without undue delay, as a rule within one month. If, in line with the GDPR, an extension of up to two further months is necessary, I will inform you of the reason within the first month. Where there are reasonable doubts, I will ask only for the data needed to confirm your identity.

You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). Information about rights and lodging complaints is published by UODO (in Polish). You do not need my consent beforehand.

10. Security and changes

The portal uses HTTPS. I restrict access to data, protect authentication credentials and use backups. Do not send passwords, card details, identity documents or special categories of data in forms or messages; they are not needed to use these features.

The content and offer are aimed at adults; I do not run campaigns collecting children’s data. If you believe a child has provided data that requires action, contact me.

I publish the current version on this page with the date of the change. When features, providers or purposes change, I will update the policy, and where new consent is required, I will ask for it before such processing. This document describes privacy; it does not replace the terms of sale.