tonilacki.com
Privacy Policy
Effective date: 8 September 2026 · Version: 1.1
This Privacy Policy explains how Antoni Łącki, trading as Geneza Antoni Łącki, collects, uses, stores, and shares personal data in connection with the website tonilacki.com (the “Service”).
The Service provides articles, a newsletter and information about AI training and implementation services.
This Policy is written to comply with the EU General Data Protection Regulation 2016/679 (“GDPR”), the Polish Act on Personal Data Protection of 10 May 2018, and the Polish Act on Providing Services by Electronic Means of 18 July 2002.
1. Who is the Data Controller
The Data Controller of your personal data is:
Geneza Antoni Łącki
Jana Heweliusza 11/811, 80-890 Gdańsk, Poland
NIP: 6040209896
REGON: 381801667
Contact: al@antonilacki.com
For any privacy-related request, including access, rectification, deletion, or questions about this Policy, write to the email above. There is no separate Data Protection Officer. The Controller handles all requests directly.
2. What personal data we collect
We only collect data that is necessary to deliver the newsletter, run the website, and comply with the law. The categories are:
2.1 Data you give us directly
- Newsletter signup: email address, first name where requested, and your subscription and confirmation status. The English course waitlist requires an email address; first name is optional.
- Replies and messages: the content of any email you send to us, including any information you voluntarily share in surveys or feedback forms.
2.2 Data collected automatically
- Email engagement: opens, clicks, unsubscribes, bounces, and delivery timestamps, processed through Kit (see Section 4).
- Website analytics: online identifiers, browser and device type, operating system, page addresses without query parameters, referring origin and visit interactions, only after analytics consent. GA4 uses an IP address for approximate location but, according to Google, does not log it.
- Cookies and similar technologies: see Section 7.
2.3 Data we do not collect
The newsletter signup form does not request billing, payment or tax data. We do not ask for phone numbers, postal addresses, date of birth, or any special category of data under Art. 9 GDPR.
3. Why we process your data and the legal basis
| Purpose | Legal basis under GDPR Article 6 |
|---|---|
| Sending the newsletter and free lessons you subscribed to | Art. 6(1)(a): your consent, given through double opt-in |
| Optional website analytics and Meta ad measurement/audiences | Art. 6(1)(a): separate consent for each purpose |
| Responding to messages you send us | Art. 6(1)(f): legitimate interest in replying to inquiries |
| Defending or pursuing legal claims, if ever needed | Art. 6(1)(f): legitimate interest |
Because the primary legal basis is consent, you can withdraw it at any time by clicking “unsubscribe” at the bottom of any email or by replying to any email with the word “remove”. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
4. Who we share data with
We share data only with a small, trusted set of vendors who help us operate the newsletter and the website. Providers act under their applicable data-processing terms. Meta’s role for consented Pixel events is described in Section 7; it is not simply a newsletter processor.
| Processor | What they do | Data location |
|---|---|---|
| Kit (Kit Labs, Inc., formerly ConvertKit) | Email marketing platform. Stores your email, name, tags, and engagement events. Sends newsletters and automated welcome sequences. | USA. Transfer under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. |
| Google (Google Ireland Ltd.) | Google Workspace for our email inbox and internal documents. Google Analytics, where enabled, for website traffic reports. | EU and USA under EU-U.S. DPF. |
| Hosting and CDN provider | Serves the website, caches static assets, mitigates attacks. | EU and USA under EU-U.S. DPF. |
We do not sell, rent, or trade your personal data to anyone. We do not share the email list with third parties for their own marketing. We may disclose data only when required by a lawfully issued order from a Polish or EU authority, or when strictly necessary to defend our legal rights.
5. International transfers
Some of our processors, notably Kit, are based in the United States. In every case, transfers outside the European Economic Area are protected by at least one of the mechanisms required by Chapter V of the GDPR:
- The EU-U.S. Data Privacy Framework, for certified recipients;
- Standard Contractual Clauses approved by the European Commission;
- Your explicit consent, where applicable.
A copy of the relevant safeguards can be requested by email at any time.
6. How long we keep your data
- Active subscribers: for as long as you remain subscribed to the newsletter.
- Unsubscribed emails: kept on a suppression list for up to 24 months, so we do not accidentally contact you again, then deleted.
- Email conversations: up to 3 years after the last reply, unless a longer period is needed for legal reasons.
- Website analytics: detailed event data for 2 months and user data for 14 months, with the user period reset on new activity. Aggregate reports may remain longer. Consent records and the consent cookie are retained for 180 days.
7. Cookies and tracking
Essential cookies remember your decision. Optional Google Analytics loads only after analytics consent. Meta Pixel loads only after separate marketing consent on selected AI offer pages. No LinkedIn or YouTube advertising pixel is enabled by this setup. Rejecting optional cookies does not prevent newsletter signup. Google Signals, Google advertising personalisation and automatic Meta matching of form data are disabled.
Use Cookie settings in the footer to change or withdraw consent. Our cookie policy lists cookies, providers, purposes, durations, consent records, Meta’s role and international transfers. Meta Platforms Ireland Limited receives consented website events for ad measurement and audience creation and may link them with your Meta account. Collection and transmission are subject to the Meta Controller Addendum; Meta’s further processing is described in its own privacy policy.
8. Your rights under GDPR
As a data subject in the EEA, you have the following rights, free of charge, in relation to your personal data:
- Right of access (Art. 15) to obtain a copy of your personal data and information about how it is processed.
- Right to rectification (Art. 16) of inaccurate or incomplete data.
- Right to erasure (Art. 17), known as “the right to be forgotten”.
- Right to restriction of processing (Art. 18) in specified circumstances.
- Right to data portability (Art. 20) to receive your data in a structured, commonly used, machine-readable format.
- Right to object (Art. 21) to processing based on legitimate interest, including direct marketing, which we will always honour.
- Right to withdraw consent at any time, without affecting past lawful processing.
- Right not to be subject to fully automated decisions producing legal effects (Art. 22). We do not make such decisions.
To exercise any of these rights, email al@antonilacki.com. We will respond within one month, as required by Art. 12(3) GDPR. If your request is complex, we may extend the deadline by two additional months and will notify you of the extension.
9. Right to lodge a complaint
If you believe your data has been processed unlawfully, you have the right to lodge a complaint with the Polish supervisory authority:
Urząd Ochrony Danych Osobowych (UODO)
ul. Stawki 2, 00-193 Warszawa, Poland
Website: uodo.gov.pl
We would, however, appreciate the chance to address your concerns before you go to UODO. Please write to us first.
10. Children
The Service is not directed to children. We do not knowingly collect personal data from anyone under the age of 16. If you believe that a child has provided us with personal data, please contact us and we will delete it promptly.
11. Security
We take reasonable technical and organizational measures to protect your data: encrypted transport (TLS), strong passwords, access controls and applicable data-processing agreements. No system is ever perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the UODO within 72 hours, as required by Art. 33 GDPR, and, where required, notify you directly.
12. Profiling and automated decision-making
We use Kit’s segmentation and tagging features to send more relevant content based on topics you have clicked on. This is basic marketing segmentation, not profiling with legal effects. You can opt out at any time by unsubscribing, or by replying to any email asking us to remove your tags.
13. Changes to this Policy
We may update this Policy from time to time. The “Effective date” at the top of the page always reflects the latest version. For material changes, we will notify active subscribers by email at least 14 days before the change takes effect. When paid products launch, this Policy will be expanded and you will be notified in advance.
14. Contact
Questions, requests, or complaints about this Policy or about how we handle your data:
Geneza Antoni Łącki
Jana Heweliusza 11/811, 80-890 Gdańsk, Poland
Email: al@antonilacki.com