What we collect, and what we don’t.

Last updated: — not published yet —

The short version: we ask for an email address and nothing else. This page explains the long version, because you have the right to know it and we’d rather write it plainly than hide it in legal noise.

Who is responsible

The Kraków Edit is run by [name of the data controller], Kraków, Poland. We are the data controller for everything described here. Write to [email protected] — a person reads it, and that person is the one who decides what happens to your data.

We have not appointed a Data Protection Officer, and we are not required to: this is a one-person project that does not monitor people at scale or process special categories of data.

What we collect

Your email address, and only if you type it into the form yourself. We don’t ask for your name, your country or your travel dates, and there is no field to give them to us.

Anonymous page statistics: which pages were opened and where the visit came from. No cookies, no fingerprinting, no cross-site tracking, and nothing that identifies you personally. That is also why this site has no cookie banner — there is nothing to consent to. If you follow a link to a form or a checkout hosted elsewhere, that service has its own rules, and its own cookie notice.

Server logs. Like every website, this one is served by a hosting provider that records technical data — IP address, browser, time of request — to keep the site up and to block abuse. We don’t read these logs to learn anything about you, and they are kept only briefly. The legal basis is our legitimate interest in a site that works and isn’t being attacked.

If you buy the edition, the payment is handled by our payment platform, not by us. They collect what a purchase legally requires — email, payment details, country for VAT. We see the order and your email address; we never see your card.

Why we keep it

The email address is used for one thing: sending you the guide and occasional emails about it. The legal basis is your consent — the unchecked box you ticked next to the form. For purchases, the basis is the contract between us and the tax records Polish law requires us to keep.

We do not profile you, score you, or make any decision about you automatically. There is no segmentation of the list, no behavioural targeting, and no advertising pixels on this site.

Who else sees it

Only the services that make this work. Each of them processes data on our instructions, under a data processing agreement:

Tally

Receives what you type into the form on this siteEuropean Union

[email service — to be chosen]

Stores the list and sends the letters—

Lemon Squeezy

Handles payments and acts as the seller of recordUnited States

Cloudflare

Serves this site and routes mail sent to our addressEuropean Union and United States

We do not sell, rent, swap or otherwise pass your address to anyone else — not to venues, not to advertisers, not to other projects. We would also hand over data if a Polish court or authority lawfully required it, which has never happened and which we would tell you about unless forbidden to.

Data that leaves Europe

Two of the services above operate from the United States: our payment platform and our hosting provider. That means some data — your email address and order details if you buy something, technical log data when you visit — is transferred outside the European Economic Area.

Those transfers rely on the safeguards the GDPR provides for them: certification under the EU–US Data Privacy Framework where the provider holds it, and the European Commission’s Standard Contractual Clauses otherwise. If you want to know exactly which mechanism applies to which provider, ask and we’ll tell you.

How long

Your email stays on the list until you unsubscribe, and it goes as soon as you do. Purchase records are kept as long as Polish tax law requires — currently five years from the end of the year in which the tax became due; we cannot delete those earlier even if you ask, and that is the one exception on this page. Server logs are kept briefly, in days rather than months. Page statistics are anonymous and aggregated, so there is nothing in them to delete.

Your rights

Under the GDPR you can, at any time and free of charge:

• ask for a copy of what we hold about you;
• have it corrected if it’s wrong;
• have it deleted;
• ask us to restrict what we do with it while a question is settled;
• object to us using it;
• receive it in a portable, machine-readable form, or have it sent straight to another provider;
• withdraw your consent — which does not undo what was lawful before you withdrew it.

Write to [email protected] and we will do it within a month, usually the same week. Every email we send also has an unsubscribe link, which is the fastest route out and needs no explanation to us.

If you think we have handled your data badly, you can complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa (uodo.gov.pl). You can also complain to the authority in the country where you live.

Children

This guide is written for adults planning a trip, and the list is not intended for anyone under 16. We don’t knowingly collect their data; if you believe a child’s address ended up on our list, tell us and we’ll remove it.

Changes

If this policy changes in a way that affects you, we will say so in the newsletter rather than quietly editing the page. The date at the top is always the date of the current version.