Last updated 6 September 2026.
1. Who I am
I am Monika Stawasz, carrying on business as Monika Stawasz AI Governance, a sole trader registered in the Polish business register (CEIDG). NIP 7722340803 (VAT ID PL7722340803), REGON 366100761.
Address: ul. Zbójnicka 31D lok. 9, 92-104 Łódź, Poland.
Email: monika@stawasz.ai.
Telephone: +48 510 774 882.
I have not appointed a data protection officer. Where I process personal data on behalf of a client during an engagement, the client is the controller and its data processing agreement applies, not this notice.
2. What I do with personal data
| What and why | Legal basis | How long |
|---|---|---|
| Contact. I answer email, telephone calls and LinkedIn messages. That means your name, your email address or telephone number, and whatever you tell me in the call or message, which may include information about other people at your organisation. | Art. 6(1)(b) GDPR where you would yourself be a party to the engagement you are asking about. Otherwise Art. 6(1)(f), my legitimate interest being to answer professional enquiries. | Until the matter is closed, then until related claims are time-barred, as a rule 3 years for claims connected with business activity (Art. 118 Civil Code). |
| Site security. The hosting provider records access logs: IP address, time of request, page requested, browser and referrer. | Art. 6(1)(f), my legitimate interest being to keep the site running and detect abuse. | Set by the hosting provider, which holds these logs as my processor. I have no access to them and cannot shorten the period. |
| Engagements. Agreeing and delivering work, including data about the contact people on the client’s side. | Art. 6(1)(b) where the client is a natural person, including a sole trader. Art. 6(1)(f) as to contact people and to clients that are companies, my legitimate interest being performance of the contract. | For the term of the engagement, then until claims are time-barred. |
| Invoicing and tax. | Art. 6(1)(c), read with the Accounting Act of 29 September 1994 and the Tax Ordinance of 29 August 1997. | 5 years from the end of the year in which the tax fell due, and for accounting records from the start of the year following the financial year. |
I get this data from you, or, where you are named as a contact person, from your employer or from my client.
Giving me your data is voluntary. Without an email address or telephone number I cannot reply, and without the details a contract and an invoice need I cannot take the work on.
3. Who else sees it
- Netlify, Inc., San Francisco, United States, which hosts the site and holds the access logs. Processor under Netlify’s data processing agreement. Privacy statement: netlify.com/privacy
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which provides my email (Google Workspace). Processor under Google’s data processing terms. Privacy policy: policies.google.com/privacy
- An accounting office established in Poland, which keeps my books and files my tax returns.
- LinkedIn Ireland Unlimited Company, if you write to me on LinkedIn. It processes your message as a controller in its own right, under its own privacy policy.
- Public authorities, where the law requires disclosure.
That is the whole list. I do not sell personal data and do not disclose it for anyone else’s marketing.
4. Data leaving the EEA
Netlify, Inc. is in the United States and is certified under the EU-U.S. Data Privacy Framework. Transfers rest on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). Netlify’s agreement provides for the standard contractual clauses under Commission Implementing Decision (EU) 2021/914 if that decision ceases to apply.
Google Workspace is contracted with Google Ireland Limited. Google LLC, in the United States, may act as a sub-processor. Google LLC is certified under the same framework, with the standard contractual clauses behind it.
For the documents behind these transfers, including a copy of the contractual clauses, write to monika@stawasz.ai.
5. Security
The site is served over TLS. My email and files sit in Google Workspace with multi-factor authentication. I share those accounts with no one.
6. Your rights
You can ask me for access to your data and a copy of it (Art. 15 GDPR), for correction of anything inaccurate (Art. 16), for erasure (Art. 17), for restriction of processing (Art. 18), and for your data in a machine-readable form to pass to someone else, where I hold it under a contract and process it by automated means (Art. 20).
You can also object, on grounds relating to your situation, to anything I do on the basis of legitimate interest (Art. 21(1)).
Nothing described here runs on consent, so there is no consent to withdraw.
Write to monika@stawasz.ai. I answer within one month of receiving the request. If a request is complex I may take up to two months more, and will tell you inside the first month if that happens.
If you think I am handling your data unlawfully, you can complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. I am established in Poland, so that is the competent authority. If you live or work in another EEA state, you can also go to the authority there.
7. Cookies
This site stores nothing on your device and reads nothing from it. It sets no cookies. There are no analytics tools, no marketing pixels, no third-party scripts, and no embedded video, maps or fonts. Everything is served from this site. That is why you see no consent banner.
8. What I do not do
No profiling and no decisions about you taken solely by automated means (Art. 22 GDPR). I do not collect special category data under Article 9. No newsletter and no electronic direct marketing. No contact form on the site.
9. Changes
If what I do changes, for example if I add analytics, a contact form or a new provider, I will update this notice and the date at the top. The Polish version, linked in the footer, says the same thing.