Skip to content
fitdamiano

Menu

EN: current languagePL

Privacy policy

In force from [TODO: Damian — publication date, e.g. 13 October 2026]. Version 1.

In short

  • This site sets no cookies and has no forms.
  • I count visits with a cookieless tool (Umami Cloud). I only see totals, not individual people.
  • Cloudflare delivers the site. On every visit it receives your browser's technical data, like any server does.
  • Videos from TikTok, YouTube and Instagram load only when you press play. From then on, those platforms' rules apply.
  • If you email me, I use your address only to talk to you.

Who is responsible for your data

The controller is [TODO: Damian — full name], who runs fitdamiano.pl. Contact for anything about your data: [TODO: Damian — email address, e.g. kontakt@fitdamiano.pl].

I haven't appointed a data protection officer. At this scale I'm not required to.

What happens when you open the site

Hosting and server logs: Cloudflare

The site runs on Cloudflare Pages (Cloudflare, Inc., USA). When you open it, your browser sends Cloudflare's servers what it sends to any website: your IP address, the date and time, the page address, the page you came from, and information about your browser and operating system. Cloudflare uses this to deliver the site and protect it from attacks. I don't use it to work out who you are.

  • Legal basis: my legitimate interest in a site that works and is secure (Article 6(1)(f) GDPR).
  • Cloudflare processes this data on my behalf under a data processing agreement.
  • Data may be transferred outside the European Economic Area, including to the USA. The basis is the European Commission's decision on the EU-U.S. Data Privacy Framework and standard contractual clauses.
  • How long: [TODO: Damian/PM — log retention under Cloudflare's agreement and settings].

[If Cloudflare ever shows you a verification screen (checking that you're human), it may set a technical cookie needed only for that check. — TODO: PM — keep this sentence only if Cloudflare cookies appear in production.]

Visit statistics: Umami Cloud

To know which pages and buttons work, I use Umami Cloud (Umami Software, Inc., USA; servers in the USA and the EU). Umami uses no cookies and stores nothing on your device. It records which page you open, where you came from, your country, device type, browser, operating system and browser language, and clicks on links to TikTok, Instagram and YouTube: which platform, from which page, which button. According to Umami the data is anonymised, so it contains no name, email address or IP address. I only see totals.

  • Legal basis: my legitimate interest in knowing what works on the site (Article 6(1)(f) GDPR). You can object (see below).
  • Umami processes this data on my behalf. Data region: [TODO: Damian — EU or USA, chosen when the account is set up; EU recommended].
  • How long: [TODO: Damian — retention period on the Umami Cloud plan].

[Alternative: if Plausible replaces Umami, this paragraph replaces the whole Umami section. "To know which pages and buttons work, I use Plausible Analytics (Plausible Insights OÜ, Estonia; data stored in the EU). Plausible uses no cookies and no browser storage. To count unique visits it creates a hash of the IP address, browser data and site name, with a salt that is changed and deleted every 24 hours. Neither the IP address nor the full browser data is stored. I only see totals." Same legal basis and right to object.]

Your language choice

If you switch language, the site remembers your choice in your browser's storage (localStorage). It isn't a cookie. It doesn't reach me or anyone else, and it stays on your device. I store it only because you ask for it by pressing the toggle, so under Polish electronic communications law it needs no consent. Clear this site's data in your browser to remove it.

Videos from TikTok, YouTube and Instagram

Until you press play, you only see a thumbnail served from my site, and nothing connects to the platform. When you press play, your browser connects to the platform's servers. The platform may then set its own cookies and process your data (including your IP address and browser data), and if you're logged in there, link the view to your account. From then on the platform's rules apply:

Legal basis: your consent, given by pressing play (Article 6(1)(a) GDPR). Without the click nothing loads. To withdraw consent, reload the page and don't press play. You can delete the platform's cookies in your browser settings.

Links to my profiles

The links to TikTok, Instagram and YouTube are ordinary links. Once you click, you're on the platform's site and its rules apply. In the statistics I only see that someone clicked a link, not who.

Email

If you email [TODO: Damian — email address], I process your address, your name if you sign the message, and what you wrote, so I can reply and keep the conversation going.

  • Legal basis: my legitimate interest in answering messages (Article 6(1)(f) GDPR), and for collaboration talks also steps before entering into a contract (Article 6(1)(b) GDPR).
  • Mail goes through Cloudflare Email Routing to a mailbox with [TODO: Damian — email provider, e.g. Google]. Both process it on my behalf.
  • How long: for as long as the conversation lasts, then [TODO: Damian — e.g. 12 months, unless it's needed longer, for example for a contract].
  • Giving your data is voluntary, but without an email address I can't reply.

Cookies

The site itself sets no cookies. Cookies can appear only if you press play on a platform video (see above).

Who receives data

I don't sell data and I don't show ads. Data is seen only by the companies that help me run the site:

  • Cloudflare, Inc.: hosting, site protection, email forwarding,
  • Umami Software, Inc.: visit statistics,
  • [TODO: Damian — email provider]: the mailbox.

Your rights

You have the right to:

  • find out what data I hold about you and get a copy,
  • have it corrected,
  • have it erased,
  • restrict how it's processed,
  • take it elsewhere, where I process it on the basis of consent or a contract,
  • object to processing based on my legitimate interest, for example the statistics,
  • withdraw consent (for videos), without affecting what happened before.

Email [TODO: Damian — email address]. I'll reply within a month, as the GDPR requires.

The statistics and logs contain nothing I could recognise you by, so I usually won't be able to tell which records relate to you (Article 11 GDPR).

You can also complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or to the data protection authority in the EU country where you live.

What I don't do

I don't profile you, make automated decisions about you, sell data or show ads.

Changes

If anything changes, for example the analytics tool, I'll update this page and the date at the top.