Privacy policy
Version of 5 September 2026
1. Who we are
The data controller is Head Pills Dmytro Barinov, a business registered in Wrocław, Poland (postal code 54-438), trading as HeadPills. Contact: [email protected]. This policy applies to this website and to the way we handle data in client projects, and it follows the General Data Protection Regulation (GDPR).
2. What data we collect
Contact form. When you write to us through the form we receive what you typed: your website or company name, your email address, your message, and the topic or estimate you selected on the site. The form is delivered to our mailbox by Web3Forms (see section 4).
Email and calls. If you email us or we speak on a call, we keep the correspondence and the notes needed to prepare a quote and run the project. Calls are recorded only with a notice at the start.
Client projects. In a project we may process data inside your systems (a website, a CRM, a mailbox, a calendar) on your instructions and on accounts in your name. In that case you are the controller and we act as a processor under the contract; a data processing agreement is available on request.
Website visits. Our hosting provider records technical logs (IP address, browser type, requested page, time) to deliver the site and protect it from abuse. We use Google Analytics 4 to count visits and see which pages are read, and only after you allow it in the banner shown on your first visit; if you press “Only essential” or ignore the banner, no analytics script is loaded. Google processes that data on our behalf under its data processing terms; we do not use it for advertising. What it stores and for how long is listed on the cookies page. We run no advertising trackers.
3. Why we use it and on what basis
- To answer your message and prepare a quote: steps taken at your request before a contract (Article 6(1)(b) GDPR).
- To run a project and issue invoices: performance of a contract and legal obligations in accounting and tax law (Articles 6(1)(b) and 6(1)(c)).
- To keep the site secure and available: our legitimate interest (Article 6(1)(f)).
- To publish a case study or a review with your company name: your consent, which you can withdraw at any time (Article 6(1)(a)).
4. Who we share it with
| Recipient | What for | Where |
|---|---|---|
| Web3Forms | Delivers form submissions to our mailbox | EU/US, under their privacy terms |
| Cloudflare | Hosts this website and serves it through its network | Global network, EU data-protection commitments |
| Email provider | Stores our correspondence | EU |
| Accountant | Invoices and tax records | Poland |
| Contractors named in your quote | Design, development, content for your project, under confidentiality | EU, Ukraine |
We do not sell personal data and we do not share it with advertisers. Where a recipient is outside the European Economic Area, transfers rely on the European Commission’s standard contractual clauses or an adequacy decision.
5. How long we keep it
Enquiries that do not become a project: up to 12 months from the last message, then deleted. Project correspondence and files: for the duration of the project and up to 3 years after handover, so we can answer questions about the work. Invoices and accounting records: as long as Polish tax law requires (currently 5 years from the end of the tax year). Server logs: up to 30 days.
6. Your rights
You can ask us to access, correct, delete or export your data, to restrict or object to processing, and you can withdraw consent at any time without affecting what was done before. Write to [email protected]; we answer within a month. You can also complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.
7. Cookies and local storage
The site sets no cookies of its own. If you allow analytics in the banner, Google Analytics sets its standard cookies, which expire after two years; without your consent no analytics script is loaded and no such cookie is set. The site keeps two items in browser local storage: your answer to the analytics banner and whether you switched the site’s sound on or off; neither is sent to us. You can change your analytics choice on the cookies page. The full list of what is stored, why and for how long is there.
8. Security
The site is served over HTTPS. Access to our mailbox and project tools is protected with strong passwords and two-factor authentication where the provider offers it. In client projects we ask for the narrowest access that lets the work happen and we return or delete access at handover; the rules are described on the trust page.
9. Changes to this policy
We update this page when the way we handle data changes. The version date at the top tells you when. Older versions are available on request.
10. Contact
Head Pills Dmytro Barinov, Wrocław, Poland. Email: [email protected].