Privacy policy

Who is responsible

DevPeer Tomasz Posłuszny is the controller of personal data collected through devpeer.net, and I am the only person who reads your messages. For anything on this page, including every request listed under Your rights, write to tom@devpeer.net.

What I collect

• Contact form. The name, company, email address and message you type. It posts to my own AWS function, which forwards it to my inbox; nothing goes into a database. Filling it in is entirely up to you — no law or contract obliges you to give me any of it. I do need an email address to be able to reply; without one there is nothing I can do with the message.
• Analytics. Which pages you open, the link that referred you, and your browser, device type and language, recorded by PostHog on its EU Cloud (servers in Germany). It is deliberately set up to store nothing on your device — no cookie, no local storage — and PostHog is configured to discard your IP address rather than keep it, so one visit cannot be linked to the next and there is nothing in it I could use to work out who you are. Session recording is off: I am not watching your screen.
• Whether you opened the booking page. The only click this site records. If you press one of the “Book a call” buttons, it notes that you pressed it and which of the three — the one in the hero, the one in the menu bar, or the one in the mobile menu — so that I can tell which of them is worth keeping. It is not tied to you, and the booking page itself is Google's and has its own privacy policy. No other button, link or field on this site is recorded, and nothing you type is.
• Rough location. This comes with the analytics above rather than being a separate exercise. PostHog discards your IP address, but before it does, it works out roughly where the request came from — country, region, city and time zone, and on some requests a postal code and the coordinates of that area rather than of you. That is the only location data there is, it is combined with nothing else, and it goes no further than PostHog's servers and my own dashboard.
• Server logs. When Amazon Web Services serves you this page or handles your message, it records ordinary request data — IP address, time, what was requested, browser string. I use it to keep the site up and to spot abuse. I do not analyse it and I do not join it to anything else.

No advertising networks, no cross-site tracking, no profiling, no automated decisions, nothing sold, and nothing handed to anyone for their own purposes. This page loads no fonts, scripts or images from anyone else's servers, so opening it tells no third party anything about you.

Why, and on what legal basis

• To answer you and scope possible work — steps taken at your request before a contract, GDPR Art. 6(1)(b).
• To see which pages get read, roughly which places they are read in, and whether the site is fast enough, and to keep it available and free of abuse — my legitimate interests in running my own site, GDPR Art. 6(1)(f).
• To keep invoices and the records that go with them, if we end up working together — a legal obligation under Polish tax and accounting law, GDPR Art. 6(1)(c).

Who else sees it

• PostHog — analytics, on my instructions, on EU servers. PostHog Inc. is based in the United States and its staff can reach those servers for support; its data processing agreement covers that with the European Commission's standard contractual clauses, and I will email you a copy if you ask.
• Amazon Web Services — hosting for this site and for the function that forwards your message to my inbox.
• Google — Google Workspace hosts my mailbox, so your message sits there. Google handles it as my processor, on my instructions, under its Cloud Data Processing Addendum. That involves data reaching the United States, covered by the European Commission's 2023 adequacy decision for the EU–US Data Privacy Framework, to which Google LLC is certified.

Those are all of the recipients — nobody else gets anything.

How long I keep it

• Contact messages — in my mailbox while we are talking and for up to 24 months after our last exchange, then deleted. If we end up working together, invoices and their records are kept for as long as tax law requires.
• Analytics events, including the rough location — for as long as PostHog retains them on my plan, then they are deleted. I keep no separate copy.
• Server logs — rotated out by Amazon Web Services on the retention window set for my account. I keep no separate copy.

Your rights

Under the GDPR you can ask me for a copy of your data, or to correct it, delete it, restrict it, or hand it to you in a portable file. Email tom@devpeer.net — there is no form and no fee — and I will act within one month, or tell you inside that month if a request is complicated enough to need the extra two months the law allows.

Separately, and this one is easy to miss: the analytics, the rough location that comes with them, and the server logs run on legitimate interest, so you have a standalone right to object to them at any time under Art. 21(1), and you never have to give a reason. The switch above is that objection for analytics. For the server logs, email me — though I will say now that I will usually keep logging requests, because that is how I keep the site up and spot abuse, and if I decide to keep them I will write back and explain why.

You can also complain to a supervisory authority — the one where you live or work, or mine, the President of the Personal Data Protection Office (UODO) in Warsaw.

Changes

If this policy changes, the date at the top changes with it. Anything material gets spelled out here rather than buried.

Questions? Ask me directly.