Version 1.1 / 2026-11-08 · effective from 2026-11-08
This policy explains what data we process when you use Prymitywna Kuchnia, subscribe to the newsletter or contact the controller. It also explains website analytics and the settings stored on your device.
1. Controller and contact details
The controller of your personal data is Marcin Fiedziukiewicz, trading as Muchmuchmore.pl Marcin Fiedziukiewicz, ul. Sarmacka 1A lok. 125, 02-732 Warszawa, Poland, tax identification number (NIP) 6252066220, business registration number (REGON) 240886756.
For questions about personal data or the newsletter, email marcin@biuletynmedyczny.pl or write to the postal address above. The website is at prymitywnakuchnia.pl.
2. What data we process and why
Reading the website and keeping it secure
When you connect, the server receives technical data, including your IP address, the time of the request, the address of the page requested, browser and device information and the response code. These data may appear in hosting logs. We use them to display the website, diagnose errors and prevent abuse. Our legal basis is the controller’s legitimate interest in keeping the website operational and secure under Article 6(1)(f) of the General Data Protection Regulation (GDPR).
Newsletter with recipes and cooking tips
We process your email address, the types of messages you select, subscription status, dates of signup, confirmation, preference changes and unsubscription, the source of the signup and the versions of the documents you accepted. We provide the newsletter service you requested under Article 6(1)(b) GDPR. We send commercial email within the scope of your consent under Article 398 of the Polish Electronic Communications Law.
Additional offers
If you give separate consent, we use your email address to send occasional offers related to Prymitywna Kuchnia, such as the controller’s own e-books, products or culinary events. The legal basis for processing is your consent under Article 6(1)(a) GDPR. Email contact also requires consent under Article 398 of the Polish Electronic Communications Law. You can decline and still receive recipes and use the website.
Confirmations and accountability
We keep the text and versions of declarations, how they were submitted, and records of address confirmation and withdrawal of consent. The newsletter form stores the IP address as an HMAC digest generated with a secret key. This pseudonymises the address without rendering it anonymous. We also record the technical outcomes of delivery attempts, such as acceptance by the mail transport, an error or a skipped message. We use these records to demonstrate proper handling, prevent abuse and establish, exercise or defend legal claims under Article 6(1)(f) GDPR. To the extent that we fulfil the legal duty of accountability, the basis is Article 6(1)(c) in conjunction with Articles 5(2) and 7(1) GDPR.
Contact and complaints
If you write to the controller, we process the address you provide, your message and any other information you choose to give so that we can respond and handle your enquiry. The basis is Article 6(1)(f) GDPR or, where correspondence concerns a contract or steps before it is concluded, Article 6(1)(b) GDPR. Article 6(1)(c) GDPR also applies where we fulfil legal obligations, such as handling a consumer complaint.
Website analytics
With your separate consent, we use Google Analytics 4 to understand visits and how people use the blog’s features. The data include browser identifiers, pages visited, events, device information and approximate location. The basis is Article 6(1)(a) GDPR and consent to access your device under Article 399 of the Polish Electronic Communications Law. See section 6 for details.
3. Voluntary signup and how it works
- Providing your email address is voluntary but necessary to receive the newsletter. You do not need to provide it to read public recipes.
- Signup requires you to verify the address using the email and to confirm on the website. This limits unauthorised subscriptions. Submitting the form alone does not trigger mailings to an unconfirmed address.
- Consent to additional offers and consent to analytics are independent of each other. Neither is implied by accepting the Website and Newsletter Terms.
- You can change the types of newsletter emails you receive or unsubscribe at any time using a link in a message or by contacting the controller. To change your analytics consent, use the analytics settings button (“Ustawienia analityki”) on the website.
- Withdrawing consent does not affect the lawfulness of earlier processing. Nor does it automatically erase records we may continue to process on another appropriate basis, such as evidence needed to show how we handled a complaint or an unsubscribe request.
4. Who may process or receive data
- OVHcloud, the provider of hosting, database and email services used to run the website and send messages.
- Google, in particular Google Ireland Limited and the entities involved in providing Google Analytics, for analytics enabled with your consent.
- Organisations that help the controller maintain its systems or provide legal support, only to the extent necessary for the task and on an appropriate legal basis.
- Authorities entitled by law to receive the data.
Providers that process data on our behalf do so under appropriate agreements. We do not sell the newsletter mailing list or make it available to other brands for their own marketing. The newsletter plugin does not send subscribers’ email addresses to Google Analytics.
Using Google Analytics may involve transfers outside the European Economic Area, including to the United States. Google cites adequacy decisions, including the EU–US Data Privacy Framework within the scope of its current certification, and, where appropriate, standard contractual clauses as bases for such transfers. See Google’s information on data transfers for details of the safeguards and how to obtain a copy. You can also ask the website controller which mechanism applies.
5. How long we keep data
- Active subscription. For as long as you use the newsletter, until you unsubscribe or the service ends. We use data for additional offers until you withdraw the relevant consent, subject to the necessary records described below.
- New, unconfirmed subscriber profile. Generally up to 30 days after signup. The confirmation link is valid for 48 hours. Deletion runs as a scheduled system task.
- Delivery attempt log in the plugin. Generally up to 180 days, after which entries are cleared in batches. The list of queued jobs and their processing history may remain with subscription data for the accountability period described below.
- History of declarations, acceptances and subscription management. For as long as needed to demonstrate proper handling and to establish, exercise or defend legal claims, taking applicable limitation periods into account. After unsubscription the data are no longer used to send campaigns. We review the records periodically and delete information that no longer serves a legitimate purpose. Some categories can be deleted before the longest possible period expires.
- Suppression of further mailings. After a profile is deleted, we may retain a minimal record consisting of an HMAC digest of the email address, the date and the reason for the block. This honours the unsubscribe request and prevents unauthorised re-enrolment. We keep the record while the newsletter operates and it is needed for that purpose, and reassess that need during reviews. It is still pseudonymous data and is not an address used for marketing contact.
- Correspondence and complaints. Until the matter is closed, and then only to the extent necessary for the applicable period for exercising or defending claims or fulfilling a legal obligation.
- Hosting logs. In the provider’s rotating archive for the retention cycle of the relevant OVHcloud service. They are then overwritten or deleted as part of that cycle. Extracts needed to investigate a specific incident or safeguard a legal claim may be kept until the matter is closed and the applicable limitation period expires.
- GA4 analytics. For user-level and event-level data, we set retention at 2 months, without restarting the period when a user is active again. Google deletes expired data as part of a monthly process. This period is separate from the lifetime of cookies and does not cover standard aggregate reports, which we do not use to identify individuals.
Backup data remain until the end of the applicable backup rotation cycle. Backups are used to restore the system after a failure and are not an additional mailing list. When restoring the system, we honour recorded unsubscribe requests and restrictions to prevent unauthorised mailings from resuming.
6. Cookies, browser storage and Google Analytics
Cookies are small pieces of information stored by your browser. The website also uses localStorage and sessionStorage, which allow the browser to remember settings or the state of a feature. Storage necessary for a feature you explicitly choose or for security is separate from optional analytics.
| Mechanism | Purpose and scope | Retention or method of removal |
|---|---|---|
pk.analytics.consent.v1 — localStorage | Remembers whether you accepted or declined analytics and the date of that choice. It is not a newsletter subscriber identifier. | Your choice is honoured for 180 days. The website then asks again. The entry itself may remain until a new choice replaces it or you clear your site data. |
_ga and _ga_TNYH7YE730 | Google Analytics cookies that distinguish browsers and sessions, used after you consent to analytics. | Up to 2 years by default, potentially renewed with activity. The browser may delete them earlier, or they may be removed after you withdraw consent. You can also delete them in your browser settings. |
prymitywna-kuchnia.display.v1 — localStorage | Remembers your chosen appearance for the website. | Until you change the setting or clear the site data. |
pk-used-v2-* and pk-shopping-v2-* — localStorage | Remember on your device which ingredients you have ticked off and which shopping list items you selected for a particular recipe. | Until you reset the feature or clear the site data. |
| Technical WordPress mechanisms | Handle browser compatibility and, in the administration panel, login and security. Reading recipes does not require an administrator account. | Depending on the mechanism, until the browser session ends, you log out or you clear the site data. |
Google Analytics starts after you select the option to accept analytics (“Zgadzam się na analitykę”). You can decline (“Bez analityki”) and continue using the recipes. To change your choice, use the analytics settings button (“Ustawienia analityki”) on the website. Withdrawing consent stops further collection by the module. It does not automatically remove data already transmitted.
Measurement covers page views and selected actions, such as switching language, changing the appearance or following a link to Biuletyn Medyczny. The module removes query parameters and fragments from the page URLs it transmits. Google Signals and ad personalisation are disabled in this configuration. Consent to analytics does not imply consent to the newsletter or email offers.
For more information about the provider’s processing, see how Google uses information from sites and apps.
You can manage cookies and site storage in your browser settings. Clearing data may reset your analytics choice, appearance settings and saved reader tools. Changing browser settings alone does not replace the option to withdraw consent on the website.
7. Newsletter tracking, profiling and external links
Our newsletter plugin does not add tracking pixels to detect email opens or track clicks on email content. We record signup confirmations, preference changes and unsubscriptions to carry out your choices. These records are not advertising measurements.
We do not make decisions about subscribers based solely on automated processing that would produce legal effects or similarly significant effects for them. Newsletter recipients are selected according to the types of messages they have chosen.
Share buttons may open an external service or app, such as WhatsApp or a social network. When you choose such a feature, you also use the provider’s service under its terms. The controller is not responsible for the content of external websites’ policies and fulfils its own obligations to users in accordance with the law.
8. Your rights
Within the limits set by the GDPR, you have the right to access your data and receive a copy, to rectification, erasure and restriction of processing, and, where the statutory conditions are met, to data portability.
If we process your data on the basis of a legitimate interest, you may object on grounds relating to your particular situation. You may object at any time to processing for direct marketing. You may withdraw consent as easily as you gave it, without affecting the lawfulness of earlier processing.
Send your request to marcin@biuletynmedyczny.pl. To protect your data, we may ask for information necessary to verify that the request comes from someone entitled to make it. We generally respond within one month. If the law allows an extension, we will tell you why and give you the new deadline.
If you believe the processing infringes the law, you may lodge a complaint with the President of the Polish Personal Data Protection Office. You do not have to complain to the controller first.
9. Policy updates
We publish the current policy on this page with its date and version number. We notify you of material changes to the purposes, recipients or methods of processing before applying them. If a change requires new consent, merely publishing a new document does not replace it. To enquire about the version in force when you subscribed, contact the controller.