Privacy & cookie policy
This policy explains what personal data we process when you visit this website, why, on what legal basis, for how long, and what rights you have. It also covers cookies and similar storage. It is written to meet Articles 13 and 14 of the GDPR (Regulation (EU) 2016/679, in Polish: RODO) and the Polish Electronic Communications Law of 12 July 2024 (Prawo komunikacji elektronicznej, PKE).
§ 1. Who is the controller
The controller of your personal data (administrator danych osobowych) is:
Little Byte Studio sp. z o.o.Ludźmierska 26A, 34-400 Nowy Targ, Poland
Registry court: Sąd Rejonowy dla Krakowa-Śródmieścia w Krakowie, XII Wydział Gospodarczy Krajowego Rejestru Sądowego
Share capital: PLN 15,000
E-mail: contact@littlebyte.studio
We have not appointed a data protection officer. For anything about your data, write to the e-mail address above.
§ 2. Definitions
- GDPR: Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data.
- PKE: the Polish Act of 12 July 2024, Electronic Communications Law, whose Article 399 governs storing information on, and reading information from, your device (it replaced Article 173 of the former Telecommunications Law on 10 November 2024).
- Personal data: any information relating to an identified or identifiable natural person.
- Processing: any operation on personal data, such as collecting, storing, reading, using or deleting it.
- Visitor or you: any natural person using this website.
- EEA: the European Economic Area.
§ 3. How we process data
We follow the principles of Article 5 GDPR: we process data lawfully, fairly and transparently, only for the purposes listed below, only as much as those purposes need, we keep it accurate, we keep it no longer than necessary, and we protect it. This site has no accounts, no shop, no newsletter and no forms. The only ways we learn anything about you are the technical data your browser sends when it fetches pages, analytics you can accept or decline, and e-mails you choose to send us.
§ 4. Purposes, legal bases and retention
| Purpose | Legal basis | How long |
|---|---|---|
| Serving the pages you request and keeping the website secure and available (server logs: IP address, time, requested URL, browser identification, referring page, response status). | Article 6(1)(f) GDPR: our legitimate interest in running and protecting the website. | Up to 12 months, unless a log is needed as evidence of abuse or an attack. |
| Measuring how the website is used, in aggregate, with PostHog analytics (see § 11): pages viewed, clicks, outbound links, technical errors, device and browser, approximate location. | Article 6(1)(a) GDPR, your consent, given in the cookie banner; and Article 399 PKE for storing and reading the identifiers on your device. You can withdraw consent at any time (§ 11). | Analytics data is kept for up to 12 months from collection, then deleted. The identifiers on your device live as long as stated in the table in § 11. |
| Replying to e-mails you send us, including questions about collaborations, publishing or funding. | Article 6(1)(f) GDPR: our legitimate interest in answering correspondence; Article 6(1)(b) GDPR where the exchange leads to a contract. | Up to 12 months after the last message in the conversation; longer if the exchange turns into a contract, for as long as that contract and the related legal obligations require. |
| Establishing, exercising or defending legal claims. | Article 6(1)(f) GDPR: our legitimate interest in protecting our rights. | Until the relevant limitation period expires (as a rule six years under Article 118 of the Polish Civil Code, or three years for business-related claims). |
| Meeting legal obligations, such as keeping accounting records of a collaboration. | Article 6(1)(c) GDPR together with the specific law, for example the Polish Accounting Act. | As long as that law requires, usually five years from the end of the financial year. |
§ 5. What data we process
- Technical data sent by your browser: IP address, browser and operating system, screen and window size, language, the page you came from, the pages you visit and when.
- Analytics data, only after you accept analytics: the above plus a random visitor identifier stored on your device, clicks on page elements, clicks on outbound links (which link, which part of the page), and details of technical errors in our scripts (error message, where it happened, browser). PostHog discards your full IP address on arrival and keeps only a country and city level location derived from it.
- Correspondence data: your e-mail address, your name if you sign with it, and whatever you write to us.
Giving us data is voluntary. You can browse the site without accepting analytics and without contacting us. The technical data in the first point is needed to deliver pages at all.
§ 6. Who receives data
We do not sell personal data. We share it only with providers who process it on our behalf under data processing agreements as required by Article 28 GDPR, and with authorities when the law obliges us:
- netcup GmbH (Daimlerstraße 25, 76185 Karlsruhe, Germany), our hosting provider, with servers in the European Union;
- PostHog, Inc. (2261 Market Street #4008, San Francisco, CA 94114, USA), the analytics service, used only after your consent and configured to store data in its EU cloud region in Frankfurt, Germany;
- our e-mail provider, for correspondence;
- accounting and legal advisers, where a collaboration or a claim requires it;
- public authorities, courts and law enforcement, when they have a legal basis to request data.
§ 7. Transfers outside the EEA
We process data in the EEA: the website is hosted in the European Union, and PostHog analytics data is stored in Frankfurt, Germany. PostHog, Inc. is a US company and may access that data as our processor; such access is covered by the standard contractual clauses adopted by the European Commission (Decision (EU) 2021/914), which are part of PostHog's data processing agreement, with the supplementary measures described there, and, for as long as PostHog, Inc. holds a valid certification, by the EU-US Data Privacy Framework. If our e-mail provider stores messages outside the EEA, the same safeguards apply. You can ask us for a copy of the safeguards in use at the address in § 1.
§ 8. Your rights
Under the GDPR you have the right to:
- access your data and get a copy (Article 15);
- rectification of inaccurate data (Article 16);
- erasure, the "right to be forgotten" (Article 17);
- restriction of processing (Article 18);
- data portability, for data processed on the basis of consent or a contract (Article 20);
- object to processing based on our legitimate interests, on grounds relating to your particular situation (Article 21);
- withdraw consent at any time (Article 7(3)). Withdrawal does not affect the lawfulness of processing carried out before it. For analytics, use "Cookie settings" in the footer of any page.
To exercise a right, e-mail contact@littlebyte.studio or write to the postal address in § 1. We answer within one month; for complex or numerous requests that period may be extended by two further months, and we will tell you if so. Where the data we hold about you is only an anonymous analytics identifier, we may be unable to link it to you without your help, as allowed by Article 11 GDPR.
§ 9. Right to complain
You have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live, work or where the alleged infringement happened. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
§ 10. Profiling and automated decisions
We do not profile visitors and we make no decisions about you by automated means. Analytics data is used only in aggregate, to understand how the site as a whole is used.
§ 11. Cookies and similar technologies
Under Article 399 PKE we may store information on your device, or read information already stored there, only when it is strictly necessary to provide a service you asked for, or with your consent. This site uses two kinds:
- Strictly necessary: your light or dark theme choice, and the record of your answer in the cookie banner. These need no consent, hold no identifier and are never sent anywhere.
- Analytics (PostHog): set only after you accept analytics in the banner. They hold a random identifier so repeat visits from the same browser count as one visitor, and a session identifier.
| Name | Kind | Purpose | Lifetime |
|---|---|---|---|
theme | Necessary, local storage | Remembers light or dark mode. | Until you clear your browser data. |
lbs-consent | Necessary, local storage | Remembers whether you accepted or declined analytics, and when. | 12 months, then we ask again. |
ph_phc_…_posthog | Analytics, cookie and local storage | PostHog visitor identifier, session identifier and a few settings. | Cookie: 12 months. Local storage: until you decline or clear your browser data. |
ph_phc_…_posthog (session storage) | Analytics, session storage | Current session details. | Until you close the tab. |
__ph_opt_in_out_… | Necessary, local storage | Set only if you decline after having accepted: tells the PostHog script to stay off. | Until you clear your browser data. |
What PostHog records once accepted: page views, clicks (which element, its text and position, never what you type), clicks on the social and project links, technical errors in our scripts, browser and device information, and a country and city level location from your IP address, which is then discarded. We do not use session recording, heat maps, surveys or feature flags on this site.
Your choice. The banner appears before anything is stored. "Accept analytics" starts PostHog; "Decline" leaves it off and the site works exactly the same. You can change your mind at any time with "Cookie settings" in the footer; declining after accepting stops collection and removes PostHog's cookie and storage from your device. If your browser sends a Global Privacy Control signal, we treat it as a refusal and do not show the banner. You can also block or delete cookies in your browser settings.
Script and event data are loaded from and sent to PostHog's EU servers at eu.i.posthog.com and eu-assets.i.posthog.com; no other third-party scripts run on this site.
§ 12. Security
The site is served over HTTPS. We collect little, keep it briefly, restrict who can access our analytics project and e-mail, use processors bound by Article 28 agreements, and review these measures as the site changes.
§ 13. Changes to this policy
We may update this policy when the law, our tools or the site change. The current version, with its date, is always at https://littlebyte.studio/privacy. If a change affects what analytics collect, the banner will ask for your consent again.
§ 14. Contact
Questions about privacy: contact@littlebyte.studio, or by post to Little Byte Studio sp. z o.o., Ludźmierska 26A, 34-400 Nowy Targ, Poland.