Privacy notice

Who controls your information

The controller is Krzysztof Chwalek, a UK sole trader trading as Chwalek Agency.

Email: hello@chwalekagency.com

What we process and why

• Enquiries and prospective clients: identity, contact details, organisation, correspondence and information you choose to provide, to respond to an enquiry and take steps towards a contract.
• Clients and suppliers: contact, contractual, service-delivery, billing and transaction records, to perform contracts, manage the business and meet legal obligations.
• Website security: technical request and server-log information, where necessary to operate, secure and diagnose the website.
• Website analytics: device, browser and interaction data through Google Analytics 4, but only after consent.
• Bookings: details submitted through the Google Calendar appointment schedule, to arrange and manage a requested call.

Depending on the activity, the lawful basis is taking steps at your request before a contract, performing a contract, complying with a legal obligation, consent, or a documented legitimate interest that is not overridden by your rights.

Analytics and consent

GA4 is disabled by default. It may load only after you choose analytics in the consent controls. Advertising storage and personalisation remain disabled. You may change your choice through “Privacy settings” in the footer.

GA4 uses Measurement ID G-CB1J90KLQ3.

The Analytics property is managed in the dedicated Chwalek Agency UK account. Google Signals and advertising personalisation are disabled, and there are no Google Ads links.

Analytics data sharing for Google products and services, modelling contributions and business insights, and business recommendations is switched off. Technical support access is enabled so Google support can help resolve service issues.

Service providers and recipients

Information may be shared only where necessary with service providers supporting hosting, analytics, communications, booking, professional advice and business administration, or with authorities where legally required.

The booking page offers a Google Calendar appointment schedule. It connects to Google only when you choose “Load Google Calendar” or follow the external booking link. Google then receives technical connection data, such as your IP address and browser information, and may use its own cookies. Information you enter into the schedule is processed through Google to provide the booking. Loading the calendar is separate from analytics consent. You can select “Unload calendar” to remove the embedded calendar; this does not delete data or cookies already held by Google. See Google’s Privacy Policy and our calendar cookie information.

Cloudflare Pages provides hosting and content delivery. Cloudflare processes technical traffic information, including IP addresses and routing information, to deliver and protect the service. Processing may take place outside the UK and EEA. The website does not implement its own visitor-request log store. See Cloudflare's Privacy Policy.

Cloudflare retains technical information according to the purposes for which it is processed, security needs and legal obligations. These criteria, rather than a single fixed period for all traffic data, are described in its privacy policy.

Bookings use a Google Workspace account. First name, surname and email address are required; company website, company size and how we can help are optional. No additional connected booking services are configured. Our booking retention periods are listed below.

Within the business, only Krzysztof Chwalek has access to booking details; there are no other shared users, co-hosts or Workspace administrators with access. Google processes the information to provide the service.

International transfers

Google and Cloudflare operate international infrastructure, including in the United States. Their published transfer safeguards include the Data Privacy Framework for eligible transfers and standard contractual clauses, with UK provisions where applicable. Further details are available in Google’s analytics transfer information, the Google Workspace data processing terms and Cloudflare’s data processing addendum. Contact us if you would like information about the safeguards relevant to your data.

The business is established in the United Kingdom and serves people in the UK and Poland. Where a provider processes information outside the UK or EEA, an applicable adequacy decision or approved contractual and supplementary safeguards will be used.

The controller currently relies on the occasional-processing exemption in Article 27(2) GDPR and has not appointed an EEA representative. This position must be reviewed if EEA processing becomes regular, large-scale, higher-risk or expands through ongoing analytics, CRM, newsletters, remarketing or outreach.

How long information is kept

Information is kept only as long as needed for the stated purpose, to establish or defend legal claims, and to satisfy accounting or other legal requirements. Our retention periods are:

• enquiries and unsuccessful proposals: 12 months after the last meaningful contact or proposal expiry;
• cancelled or unattended bookings: 6 months;
• completed introductory-call booking details: 12 months;
• client contracts and project records: up to 6 years after the relationship ends;
• invoices and accounting evidence: 6 years, or longer where a legal obligation requires it;
• Cloudflare-managed technical and security information: subject to the provider's purpose-based and legal retention criteria;
• GA4 event data: 2 months; user data: 14 months. The user-data retention period restarts when new activity is recorded for that user, so repeat visits can extend retention. These controls do not apply to most standard reports based on aggregated data;
• complaints and disputes: for the duration of the matter and then, where necessary, up to 6 years.

These periods are reviewed when the purpose, provider configuration or legal requirements change. Information may be erased or anonymised sooner when it is no longer needed.

Your rights

Depending on the circumstances, you may request access, correction, erasure, restriction, portability or objection, and may withdraw consent at any time without affecting earlier lawful processing. You may also complain to the UK Information Commissioner’s Office. People in Poland may also contact the Polish data protection authority.

There is currently no automated decision-making producing legal or similarly significant effects.

Future marketing

Newsletters, CRM-based marketing, remarketing and cold outreach are not active website features. Before any is introduced, this notice and the consent mechanism will be updated and the applicable UK and Polish electronic-marketing rules will be assessed.