Last updated: November 15, 2026
This policy explains what personal data compactworkshop.com (“Compact Workshop”, “we”, “us”) processes, why, for how long, who receives it and what rights you have. You do not need an account or have to submit contact details to read our guides. Technical data is processed when your browser connects to the site. Optional analytics runs only with your consent, wherever you visit from.
1. Who is responsible for your data
The controller of your personal data is Kasper Nierzwicki, a private individual based in Poland (European Union), who runs compactworkshop.com.
For privacy questions and requests about your data, use our contact page. You do not need to accept analytics to contact us.
2. Summary
| Activity | Data | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Operating and protecting the website (server logs) | IP address, date and time, page requested, referring page, browser user agent, status code | Art. 6(1)(f) – legitimate interest in running and securing the site | Up to 7 days |
| Contact form | Name, email address, subject, message | Art. 6(1)(f) – legitimate interest in handling correspondence; Art. 6(1)(c) for handling statutory data-protection requests | 12 months after we receive it (backup copies: up to 7 days longer) |
| Analytics (Google Analytics 4) | Pseudonymous cookie identifiers, pages viewed, referring site, device and browser information, approximate location | Art. 6(1)(a) – your consent | Cookies: default expiry 2 years (see section 7); user-level and event-level data: 14 months (our Google Analytics data-retention setting). This setting does not limit standard aggregated reports. |
| Admin login protection | IP address and username of failed login attempts to our admin area | Art. 6(1)(f) – legitimate interest in security | Up to 30 days |
| Your cookie choice | “Accepted” or “rejected” and the date, stored in your browser | Art. 6(1)(f) – legitimate interest in remembering and applying your privacy choice; browser storage is necessary for this preference | 12 months |
3. Hosting and server logs
The website runs on a virtual private server rented from OVHcloud, located in a data centre in France (European Union). OVHcloud acts as our data processor (hosting provider).
Like most websites, our web server automatically records each request in technical logs: your IP address, the date and time, the page or file requested, the referring page, your browser’s user agent and the response status. We use these logs only to deliver the site, detect errors and protect it against attacks. These logs are deleted automatically after no more than 7 days. This also applies to technical requests made when you use the contact form: excluding IP addresses from saved messages does not prevent the web server from recording requests.
Backups. To be able to restore the website after a failure, we make a daily backup of the website database and files. Because stored contact-form messages are part of the database, they are also contained in these backups. Backups are kept on the server and on a computer controlled by the website owner, and each backup is deleted automatically after no more than 7 days. A message deleted from the website therefore disappears from all backups within 7 days.
4. Contact form
If you write to us through the contact form, we process the name, email address, subject and message you enter to handle your inquiry. Our legal basis for ordinary correspondence is our legitimate interest in reading and responding to messages (Article 6(1)(f) GDPR). For requests to exercise data-protection rights, our basis is compliance with our obligations under the GDPR (Article 6(1)(c)).
You choose whether to contact us; there is no legal or contractual obligation to use the form. Fields marked as required must be completed to submit it. We need a usable email address if you want a reply and enough information to understand your inquiry. Please do not include sensitive or unnecessary personal information.
Contact Form 7 and Flamingo save messages in our WordPress database on the OVHcloud server. The form does not send messages by email. IP addresses and browser user-agent details are removed from the saved message records. We do not use your email address for newsletters or marketing. Messages are deleted automatically 12 months after receipt. You can also request earlier deletion, subject to the conditions for that right described in section 10.
5. Analytics (Google Analytics 4) – only with your consent
We use Google Analytics 4 to understand how people use our guides and to improve them. Unless you have given consent by choosing “Accept”, we do not load Google Analytics or send analytics requests to Google. If you choose “Reject” or leave the banner unanswered, Google Analytics does not run. A stored choice from an earlier visit remains valid for 12 months; you can change it at any time. Refusing analytics does not restrict access to our guides or contact form.
If you accept, Google Analytics sets the cookies listed in section 7 and processes information about your visit: pseudonymous identifiers, the pages you view, the referring website, device and browser information and approximate location. According to Google’s explanation for EU, Swiss and UK users, Analytics uses IP addresses to derive approximate location and then discards them before logging. This is not a claim that the entire analytics dataset is anonymous, and it does not apply to our own server logs. We have disabled Google signals and advertising personalisation, we do not use Google Analytics for advertising, and we do not combine analytics data with other information about you.
Google Analytics is provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), acting as our data processor. Google may also process data in the United States. Google states that it relies on the EU–U.S. Data Privacy Framework for covered transfers to Google LLC in the United States. This framework is covered by a European Commission adequacy decision. For other relevant transfers where an adequacy framework does not apply, Google describes the use of the European Commission’s Standard Contractual Clauses as appropriate safeguards. More information: Google’s data transfer information and Google Privacy Policy.
You can ask us for information about the transfer safeguards and how to obtain a copy, using the contact details in section 1.
You can withdraw your consent at any time by clicking Cookie settings (also in the footer of every page) and choosing “Reject”. We then disable further Google Analytics measurement on this site and delete the site’s _ga analytics cookies from your browser. This does not itself erase data already sent to Google; see section 10 for requests about existing data. Withdrawal does not affect the lawfulness of consent-based processing before withdrawal.
6. Google Search Console
We use Google Search Console to see how our pages appear in Google Search (for example, which search terms led to clicks). Our Search Console setup adds no visitor-side script or cookies to this website. We use its search-performance reports to understand our visibility in Google Search; this is separate from optional Google Analytics measurement.
7. Cookies and similar technologies
Ordinary visitors who do not accept analytics receive no cookies from our website. If you choose Accept or Reject, we remember that choice using local storage, which is a different way to save information in your browser. This section covers both cookies and local storage:
| Name | Type | Purpose | Duration | Set when |
|---|---|---|---|---|
cw_consent | Browser local storage (Compact Workshop) | Remembers whether you accepted or rejected analytics | 12 months | After you click Accept or Reject |
_ga | First-party cookie (Google Analytics) | Distinguishes visitors for statistics | Default expiry: 2 years | Only after you click Accept |
_ga_<container-id> | First-party cookie (Google Analytics) | Keeps session state for statistics | Default expiry: 2 years | Only after you click Accept |
The Analytics cookie names use _ga and a property-specific _ga_ suffix. Google publishes default durations in its cookie list. Expiry may be renewed on later visits, and browsers can shorten cookie lifetimes. Cookie expiry is different from Google’s retention of user-level and event-level data, stated in section 2. Standard aggregated reports are not governed by that same retention setting.
After the stored privacy choice expires, we ask again before running analytics. You can also delete cookies and site storage through your browser settings; clearing the stored choice may cause the banner to appear again. Site administrators who log in to WordPress also receive WordPress login cookies; ordinary visitors do not.
8. Admin login protection
To protect our admin area against password-guessing attacks, a security plugin temporarily records the IP address and the username used in failed login attempts and blocks repeated attempts. This affects only people who try to log in to the admin area. The log is cleared automatically at least every 30 days.
9. Who receives your data
- OVHcloud – hosting of the website and its database (processor).
- Google – Google Analytics, only if you accept analytics (processor).
We do not sell or rent personal data, we do not show ads, we do not share data with advertisers, and we do not use automated decision-making or profiling with legal or similarly significant effects. We may disclose data if we are legally required to do so.
10. Your rights
Under the GDPR, you can request access to your personal data, correction, deletion or restriction of processing, subject to the conditions for each right. Portability applies where processing is automated and based on consent or a contract. You can withdraw analytics consent at any time through Cookie settings.
You can object to processing based on our legitimate interests on grounds relating to your particular situation (Article 21 GDPR). We must then stop that processing unless a legally permitted reason to continue applies. To exercise your rights, contact us as described in section 1. We respond without undue delay and normally within one month. If the GDPR permits an extension because a request is complex or there are several requests, we explain the reason and extension within that first month. We may ask for additional information only where necessary to verify your identity.
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work, or where you believe an infringement occurred. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl.
If you visit from outside the EU, you may have similar rights under your local law. We do not sell or share personal information for cross-context behavioural advertising.
11. Children
Our workshop guides are intended for adults. Please do not send personal information about children through the contact form. If you believe a child has provided us with personal information, contact us so we can assess and address it.
12. Changes to this policy
We update this policy when our website or our use of personal data changes. Before using personal data for a new purpose, we provide information about that purpose and any other required information. If the new use requires consent, we ask for it before starting that use. Updating this page does not itself provide consent. The date at the top shows the current version.