Privacy notice

Last updated: 21 August 2026

This site collects as little as possible: an email address if you ask for the newsletter, what you tell me if you book a call, and aggregate analytics if analytics is switched on. Nothing is sold, and nothing is shared beyond the processors named below.

Who is responsible

The data controller is Vstorm sp. z o.o., operating https://antonikozelski.com and https://vstorm.co. For anything on this page — questions, requests, complaints — use Book a Call on this site and say it is a privacy request. That reaches the same team that runs the list; a personal inbox is not published here.

What is collected

• Your email address, if you submit the newsletter form. That is the only field that form asks for. A hidden anti-spam field is included; real people never fill it and it is not stored.
• What you enter when you book a call. The booking form asks for your name, your work email, how you found me, how big your organization is, the challenges you are dealing with, and what you need. You choose how much to write in the last two. It goes into the same CRM as the newsletter list, and it is read by me and by colleagues at Vstorm sp. z o.o. who would be involved in the work.
• Aggregate analytics, if analytics is enabled on the deployment you are reading. It is configured with IP anonymization and with consent mode defaulting to denied, so no analytics storage is written until consent is granted.
• Standard server logs, kept by the hosting provider for security and abuse prevention. These may include your IP address and user agent. I do not use them for profiling.

There is no account system, no advertising pixels, and no cross-site tracking on this site.

Lawful basis

Newsletter and analytics: consent — GDPR Article 6(1)(a). You give it by ticking the consent box and submitting the newsletter form, and, for analytics, by granting analytics consent. If you do not consent, you can read every page on this site anyway.

Booking a call: steps towards a contract — GDPR Article 6(1)(b). If you ask for a call, handling what you sent so the call can happen is the point of sending it, so it does not rest on consent and there is no consent to withdraw. What you can do instead is ask for the record to be deleted, and that is covered below. If a conversation does not lead anywhere and you are later contacted about something unrelated, that would be a different purpose resting on a different basis, and it would need your consent.

Withdrawing consent

You can withdraw consent at any time. Every newsletter email carries an unsubscribe link, and unsubscribing ends the processing immediately. You can also use Book a Call and ask to be removed. Withdrawing consent does not affect processing that already happened.

Booking a call does not put you on the newsletter. Those are two separate things and each needs its own opt-in.

Processors

Three third parties can touch this data.

• HubSpot (HubSpot, Inc.) — stores your email address, records your consent, sends the emails, and holds the booking form and everything you enter into it, including the calendar invitation.
• Google Analytics 4 — receives aggregate usage data, and only after you accept analytics cookies.
• OVHcloud — serves the site from a virtual server and keeps standard access logs.

Each of them acts on my instructions under a data processing agreement. Where a provider processes data outside the EEA, that transfer relies on the European Commission's standard contractual clauses.

Retention

• Newsletter address: kept until you unsubscribe or ask for deletion, then removed within 30 days.
• Booking form and call notes: kept for 24 months if nothing comes of the conversation, then removed. If we do end up working together, the record becomes part of the client relationship and is kept for as long as that lasts, plus whatever the tax and accounting rules require.
• Analytics: retained in aggregate for 2 months.
• Server logs: retained for 14 days, then discarded.

Your rights

Under the GDPR you have the right to:

• Access — ask what data I hold about you.
• Rectification — have inaccurate data corrected.
• Erasure — have your data deleted.
• Portability — receive your data in a machine-readable form.
• Objection — object to processing, and withdraw consent.
• Complaint — lodge a complaint with your national data protection supervisory authority.

To exercise any of these, use Book a Call and say it is a privacy request. I will respond within one month, as the regulation requires.

Changes

If this notice changes, the date at the top changes with it. Material changes to how newsletter data is handled will be announced in the newsletter itself.

This is a good-faith description of how the site actually works. It is not legal advice.