Last updated: October 9, 2026
This site is run by one person, and it collects as little about you as it reasonably can. There are no advertising trackers, no third-party analytics scripts, no social media pixels, and no cookie banner, because there is nothing here that would require one.
This policy explains what is collected, why, how long it is kept, and what you can ask me to do about it.
1. Who is responsible for your data
Data controller: Szymon Kwiatkowski, a natural person based in Warsaw, Poland, who runs the website szymonexplores.com and the photography work behind it as unregistered business activity (działalność nierejestrowana).
Contact for privacy matters: privacy@szymonexplores.com
Article 13 GDPR requires the controller’s identity and contact details. Both are given above, and every request sent to that address is answered by me personally. If you need a postal address for a formal request, ask and I will provide one.
I have not appointed a Data Protection Officer, as the scale of processing does not require one under Article 37 GDPR.
2. What is collected, and why
2.1 Newsletter subscription
What: your email address, the date and time you subscribed, a record of your consent, and the page you subscribed from (for example home or portfolio).
Why: to send you the newsletter you asked for, and to keep proof that you asked for it, as GDPR requires. The page you subscribed from tells me which writing people find worth subscribing to; it is not used to profile you.
No name is collected. The signup form asks for an email address and nothing else.
Legal basis: your consent, under Article 6(1)(a) GDPR. You give it by ticking the consent box, which is never pre-ticked, and confirming via the email that follows (double opt-in).
Processor: MailerLite (UAB MailerLite, Vilnius, Lithuania), an email service provider within the European Union. Your address is stored on their infrastructure so the newsletter can be sent.
Retention: until you unsubscribe. You can do this from the link at the bottom of every issue, without asking me. After unsubscribing, a minimal record of the withdrawn consent may be kept for 12 months to demonstrate compliance, then deleted.
2.2 Contact form and email
What: your name, email address, subject, message, and the inquiry type you selected.
Why: to read your message and reply to it.
Legal basis: Article 6(1)(b) GDPR where your message concerns a licensing request, a commission, or another pre-contractual matter; otherwise Article 6(1)(f), my legitimate interest in answering correspondence addressed to me.
Important: contact form submissions are not stored in the website database. They are sent directly to my email inbox and live there, like any other email you might send me.
Retention: correspondence is kept for as long as it is useful for the matter it concerns, and in any case no longer than 24 months after our last exchange, unless accounting law requires otherwise (for example, records connected to a sale).
2.3 Server logs
What: your IP address, browser and device type (user agent), the pages requested, referring page, and timestamps.
Why: these are recorded automatically by the web server. They are used to keep the site available and secure: diagnosing errors, and identifying abuse such as brute-force login attempts or scraping.
Legal basis: Article 6(1)(f) GDPR, my legitimate interest in operating a secure and functioning website.
Retention: 90 days, after which logs are rotated and deleted. The period is long enough to investigate a problem that is noticed late, and no longer.
2.4 Anti-abuse rate limiting
What: a keyed hash of your IP address, made with a secret known only to this site, together with a count of recent newsletter signup attempts.
Why: to stop bots from flooding the subscription form.
Legal basis: Article 6(1)(f) GDPR, legitimate interest in protecting the site from abuse.
Retention: ten minutes, then automatically discarded. The original IP address is not stored in this record.
2.5 Analytics
No analytics service is running on this site at the moment. Each photograph keeps a simple view count, a single number used to order the portfolio, which records nothing about who viewed it.
If analytics are added, they will be Umami, a privacy-focused tool run on this site’s own server. It sets no cookies, does not follow you across other websites, and records only aggregate figures such as page views, referring sites, country, and broad device type. This section will be updated before it is switched on.
2.6 Comments
Comments are disabled across the entire site. No commenter names, email addresses, IP addresses, or avatars are collected, because there is nowhere to submit them.
2.7 People who appear in photographs
Some photographs here show people in public places. A recognizable person in a photograph is personal data, and so can be the date and location recorded with the image.
Why: the photographs are published as creative and documentary work. Legal basis: Article 6(1)(f) GDPR, my legitimate interest in publishing that work, weighed against your rights and your freedom to object.
Your choice: if you recognize yourself and would like a photograph removed, or its location details taken off, write to privacy@szymonexplores.com with a link to the page. Every request is reviewed promptly, and removing the photograph or its location details is the normal outcome. Photographs in which a child is the main subject are removed on a parent’s request without question.
3. Cookies and browser storage
This website sets no tracking, advertising, or analytics cookies.
There is no cookie consent banner because there is nothing to consent to.
Three narrow exceptions are worth naming honestly:
- Administrator sessions. If you log in to the site as an administrator (which, realistically, is only me), WordPress sets session cookies that are strictly necessary to keep you logged in.
- Appearance preference. If you switch the site between light and dark appearance, that preference may be remembered by your own browser. It stays on your device and is never transmitted to me.
- Security checks. Cloudflare, which protects this site, may set a short-lived cookie when it needs to tell people apart from automated traffic. It is strictly necessary for that purpose and is never used to track you.
Fonts, scripts, and stylesheets are all served from this website’s own server, through Cloudflare as described below. Nothing is loaded from Google Fonts or from any external script host.
4. Who else can see your data
Your data is never sold, rented, or traded. It is shared only with the service providers needed to run the site, each acting as a processor under a data processing agreement:
| Provider | Purpose | Location |
|---|---|---|
| MailerLite (UAB MailerLite) | Newsletter delivery | European Union (Lithuania) |
| Hetzner Online GmbH | Website hosting | European Union (Germany) |
| Cloudflare, Inc. | DNS, security, content delivery, email routing | Global; EU-US Data Privacy Framework and Standard Contractual Clauses |
| Google LLC (Gmail) | Mailbox receiving email forwarded from szymonexplores.com addresses | Global; EU-US Data Privacy Framework and Standard Contractual Clauses |
| Brevo | Delivery of transactional email | European Union (France) |
| Backblaze, Inc. | Encrypted offsite backups of the website | European Union (Netherlands) |
Data may also be disclosed where I am legally required to do so, for example in response to a lawful request from a public authority.
5. Transfers outside the European Economic Area
The infrastructure above is chosen to keep data within the EEA wherever possible. Where a provider processes data outside the EEA, most relevantly Cloudflare, and Google as the provider of the mailbox that receives email sent to my domain addresses, the transfer is covered by the European Commission’s Standard Contractual Clauses, together with the provider’s own supplementary safeguards.
6. Your rights
Under the GDPR you have the right to:
- access the personal data held about you, and receive a copy;
- rectify data that is inaccurate or incomplete;
- erase your data (“the right to be forgotten”);
- restrict processing in certain circumstances;
- portability: receive your data in a structured, machine-readable format;
- object to processing carried out on the basis of legitimate interests;
- withdraw consent at any time, where processing is based on consent. This does not affect the lawfulness of processing carried out before withdrawal.
To exercise any of these, write to privacy@szymonexplores.com. I will respond within one month, as required by Article 12(3) GDPR.
For the newsletter specifically, you do not need to write to me at all: the unsubscribe link at the bottom of every issue removes you immediately.
Right to complain. If you believe your data has been handled improperly, you may lodge a complaint with the Polish supervisory authority:
Prezes Urzędu Ochrony Danych Osobowych (UODO)
ul. Stawki 2, 00-193 Warszawa, Poland
uodo.gov.pl
7. Children
This site is not directed at children, and I do not knowingly collect personal data from anyone under 16. If you believe a child has submitted personal data here, please contact me and I will delete it.
8. Security
The site is served over an encrypted connection (HTTPS). Access to the administration area is restricted and protected by strong authentication. Security headers, including a Content Security Policy, are applied to reduce the risk of injection and clickjacking attacks. Backups are encrypted and stored separately.
No system is perfectly secure, but the amount of personal data held here is deliberately small, which is itself the strongest protection I can offer you.
9. Changes to this policy
If this policy changes materially, the updated version will be published on this page with a new “last updated” date. Where the change affects how your data is used, and I hold your email address for the newsletter, I will tell you in an issue rather than changing things quietly.
10. Contact
Szymon Kwiatkowski
szymonexplores.com
privacy@szymonexplores.com
Questions about using or licensing the photographs are covered on the licensing page.