Privacy and cookie policy

Data controller

The controller of your personal data is Sebastian Jurczak, a sole trader registered at ul. Wąska 117, 22-670 Bełżec, Poland, tax ID (NIP) 9211943476. For any matter concerning personal data, write to kontakt@jurczak.fit.

This policy covers jurczak.fit and its subpages, including the English version. It does not cover external services linked from the site (Instagram, LinkedIn, jurczak.pro), each of which has its own rules.

Data you share with me once we start training together (health questionnaire, measurements, training and nutrition plans) is covered by a separate notice you receive at the start of our cooperation. This website does not collect it.

What data I process and why

Contact form. You provide your first name, contact details (e-mail address or phone number) and your message. I use them to reply and, where relevant, to arrange a first meeting or consultation. Legal basis: Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and Article 6(1)(f) GDPR (my legitimate interest in handling correspondence). The message is sent to my mailbox by e-mail and is not stored in any database on the site.

If you mention your health in the message (for example back pain or an injury), this is special category data. I process it only because you provide it yourself, in order to answer your question, on the basis of your explicit consent given by sending the message (Article 9(2)(a) GDPR). You can withdraw consent at any time by writing to me, and I will delete that information. If you prefer, describe the problem at our first meeting instead.

Direct contact. If you e-mail, text or call me, I process the data you provide on the same basis and for the same purpose.

Server logs. The hosting provider records the IP address, date and time of the request, the page visited and browser information in technical logs. This serves the security and stability of the site (Article 6(1)(f) GDPR). I do not combine these logs with form data or use them to identify visitors.

Visit statistics. After your consent, Google Analytics 4 collects pseudonymous data about how the site is used: pages visited, traffic source, device and browser type, approximate location (country, city) and time on page. I use it to see which content works. Legal basis: your consent (Article 6(1)(a) GDPR and the electronic communications rules on cookies). Details in the cookies section.

Providing form data is voluntary, but without it I cannot reply to your message. Consent to statistics is entirely voluntary and does not affect how the site works.

How long I keep data

• Form, e-mail and text correspondence: until the matter is closed, and then for no longer than 3 years from the last contact (limitation period for potential claims). After that I delete the message.
• If we start working together, correspondence becomes part of the cooperation records and is kept for as long as tax and accounting law requires.
• Server logs: short term, according to the hosting provider's policy, without my involvement.
• Google Analytics data: 14 months from collection, after which Google deletes it automatically. Aggregated reports (without identifiers) may be kept longer.

Cookies and other browser technologies

The only tool on this site that sets cookies is Google Analytics 4, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). It runs only after you click "Accept" in the banner. Until then no Google script is loaded and no cookies are set (Google Consent Mode v2, basic mode, with all consent types defaulting to denied). Declining is as easy as accepting and does not limit the site in any way.

After consent, Google Analytics sets the following cookies:

• _ga - a random identifier that distinguishes browsers, valid for 2 years,
• _ga_<property id> - keeps session state and counts page views, valid for 2 years.

How consent works and how to withdraw it

The site remembers your banner decision (accept or decline) in localStorage under the key "cookie-consent" for 12 months so it does not ask on every visit. After that the banner appears again.

You can withdraw consent at any time: click "Cookie settings" in the footer and choose "Decline". Google Analytics then stops and the site removes its _ga cookies. You can also clear site data in your browser settings. Withdrawal does not affect the lawfulness of processing before it.

In Google Analytics I have Google Signals and ads personalization switched off, I never pass form data to Google, and GA4 does not store full IP addresses. I do not use statistics for advertising or to identify individual people.

Beyond that, the site uses no advertising pixels, maps, video players, chat widgets or social plugins. Fonts are served from my own server, so visiting the site does not connect you to Google Fonts.

Who receives the data

I do not sell data or share it for marketing. Only the providers that technically run the site come into contact with it:

• Vercel Inc. (USA) - hosting and the function that sends the contact form. Vercel participates in the EU-US Data Privacy Framework and uses the European Commission's standard contractual clauses, which form the basis for transfers outside the European Economic Area.
• OVHcloud - provider of the mailbox that receives form messages. Servers located in the European Union.
• Google Ireland Limited (Ireland) - Google Analytics 4, only after your consent. Data may also be processed by Google LLC in the USA under the EU-US Data Privacy Framework and standard contractual clauses. Google's policy: policies.google.com/privacy.
• Public authorities, where required by law.

Your rights

You have the right to:

• access your data and obtain a copy,
• rectify your data,
• erase your data,
• restrict processing,
• data portability (to the extent I process data under Article 6(1)(b) GDPR or consent),
• object to processing based on my legitimate interest,
• withdraw consent at any time (for statistics: Cookie settings in the footer), without affecting the lawfulness of processing before withdrawal,
• lodge a complaint with the President of the Polish Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or with your local supervisory authority.

Profiling and automated decisions

I do not profile visitors or make automated decisions about them.

Changes to this policy

This version applies from 2026-10-26. Changes are published on this page with a new date. If a change affects how form data is processed, I will also update the notice under the form.