Woman In Red

Privacy Policy

Last updated: 24 October 2026

1. Who is responsible for your data

The controller of your personal data is Woman in Red Dorota Kozlowska, a sole proprietorship (jednoosobowa działalność gospodarcza) registered in the Polish Central Register and Information on Economic Activity (CEIDG).

We have not appointed a Data Protection Officer, as the law does not require one for our activity. For any privacy question, write to the email address above.

2. What data we process, why, and on what legal basis

Contact form and email enquiries

Data: your name, email address, the service you are interested in, the content of your message, and any data you choose to include in it.

Purpose and legal basis: to reply to your enquiry and, at your request, to prepare an offer before a contract (Art. 6(1)(b) GDPR). For general questions not related to a contract, our legitimate interest in answering messages sent to us (Art. 6(1)(f) GDPR).

Retention: for as long as needed to handle your enquiry. If a contract follows, the rules for clients below apply.

Clients and contracts

Data: contact details of the people representing our clients, and the data needed to plan, perform and invoice an engagement.

Purpose and legal basis: performing the contract (Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR where we deal with a client's employee rather than the client), meeting our accounting and tax obligations (Art. 6(1)(c) GDPR), and establishing or defending legal claims (Art. 6(1)(f) GDPR).

Retention: for the duration of the contract and then for the period required by Polish tax and accounting law, and until any claims become time-barred.

Personal data processed during a security engagement (for example in a phishing simulation) is processed on behalf of the client under a separate data processing agreement, not under this policy.

Website operation and security

Data: IP address, date and time of the request, the page requested, browser and device information, recorded automatically by our hosting provider.

Purpose and legal basis: delivering the website and protecting it against abuse and attacks, our legitimate interest (Art. 6(1)(f) GDPR).

Retention: for the period set by our hosting provider's logging.

3. Cookies, local storage and tracking

This website does not use cookies, analytics or advertising trackers, and does not load content from third-party services when you open a page. Blog posts and podcast episodes shown on the site are fetched by our own server, so your browser does not contact YouTube or other services until you click a link to them.

If you click the PL/EN language button, your choice is saved in your browser's local storage so the site remembers it. This setting never leaves your device, and you can delete it at any time in your browser settings.

4. Who receives your data

We share personal data only with service providers that process it on our behalf and on our instructions (processors), or where the law requires it:

  • Cloudflare, Inc.: website hosting, content delivery and server functions.
  • Web3Forms: delivers contact form messages to our mailbox.
  • Our email provider: email hosting.
  • Our blog hosting provider: hosting of blog.woman-in-red.com.
  • Public authorities, when we are legally required to provide data.

5. Transfers outside the European Economic Area

Cloudflare, Inc. is based in the United States. Transfers to Cloudflare rely on the EU-US Data Privacy Framework and on the European Commission's Standard Contractual Clauses.

6. Your rights

You have the right to:

  • access your data and receive a copy of it;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict the processing of your data;
  • data portability, where processing is based on a contract and carried out by automated means;
  • object at any time to processing based on our legitimate interest (Art. 6(1)(f) GDPR), on grounds relating to your particular situation.

To exercise any of these rights, email dorota@woman-in-red.com. We will reply within one month.

You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

7. Do you have to give us your data?

No. Providing data is voluntary, but without an email address we cannot reply to your enquiry, and without the data needed for a contract we cannot provide our services.

8. Automated decisions

We do not make decisions based solely on automated processing, including profiling.

9. Links to other websites

Our site links to other services, such as LinkedIn, YouTube, Twitch, Discord, Sessionize and our blog. When you follow a link, the privacy policy of that service applies.

10. Changes to this policy

We will update this page when our processing changes. The date at the top shows the latest version.