Privacy and cookies policy

Data controller and contact

The controller of your personal data is Kamil Kmetyk, trading as Dark Fox Kamil Kmetyk, Biała Góra 107, 97-505 Dobryszyce, Poland, tax ID 5941594885. Send privacy questions and data requests to kontakt@darkfox.pl.

What data do we process, and why?

The site does not provide user accounts or a contact form. Contact takes place by email. If you send a message, you provide your email address, its contents, any attachments and other data you choose to include. We use these to handle your enquiry and discuss potential cooperation.

Handling an HTTP connection gives the infrastructure access to the IP address, request time and URL, and information sent by the browser. What is logged and how long it is retained depends on the hosting configuration. The application may write error logs to help diagnose faults.

Enquiries aimed at entering into a contract are handled under Article 6(1)(b) GDPR. Other correspondence and security rely on the controller's legitimate interests (Article 6(1)(f) GDPR). Analytics requires consent (Article 6(1)(a) GDPR).

Technical cookies and browser storage

Laravel uses session and request protection mechanisms. Session cookies and XSRF-TOKEN support the application's operation and security, not advertising. Session validity is determined by the site configuration; it is currently 120 minutes of inactivity.

Your analytics choice is stored in this browser's localStorage under the key darkfox.analytics-consent.v1, with a validity period of 180 days. This is local storage, not a cookie sent with every request. You can clear it in your browser settings; the panel will then ask for your choice again.

The site uses system fonts and does not download external fonts. Visiting an external project or app store is subject to that service's privacy rules. This policy covers byfox.eu, not every linked app.

Google Analytics with your consent

Google Analytics 4 only starts after you choose “Allow analytics” or a previous valid consent is read. Without consent, the site does not download the Google Analytics script or send events to it.

With your consent, Google receives information about pages visited, your device and browser, and interactions including opening project galleries and viewing screenshots. Connecting to Google also transmits your IP address. The code sets the analytics cookie prefix to byfox and their lifetime to 180 days. Cookie lifetime does not determine how long data is retained in Google Analytics.

Google Signals and advertising personalisation signals are disabled in the integration settings. Consent for advertising storage, advertising user data and advertising personalisation remains denied.

The service is provided by Google. Information about data received from websites is available in Google's policies. The service may involve processing data outside the EEA.

Changing or withdrawing consent

Select “Privacy and cookies” in the footer, then “Essential only” to decline analytics or withdraw consent. The code blocks further measurement and removes accessible analytics cookies with the prefix byfox. If analytics was already running, the page will reload without it. Your choice is synchronised across tabs in the same browser.

Withdrawing consent does not affect the lawfulness of earlier processing or automatically delete data already sent to Google. Browser settings let you separately clear cookies and local storage.

Google advertising

The current website does not load AdSense advertising scripts or display ads. The ads.txt file does not activate ads or constitute consent to data processing.

If advertising is enabled, the policy must first describe the actual data processing, providers and advertising settings. Before serving personalised ads to audiences in the EEA, the United Kingdom and Switzerland, we must implement a Google-certified CMP supporting IAB TCF. The current panel only handles analytics consent and does not replace such a platform.

Your data protection rights

Within the scope of the GDPR, you may request access to, rectification, erasure or restriction of your data, and data portability where applicable. You can withdraw consent and object to processing based on legitimate interests. Contact the controller at the email address provided for data enquiries. You may also lodge a complaint with the President of Poland's Personal Data Protection Office.

Providing data in a message is voluntary, but without a return address or information about your enquiry we may be unable to respond. This website's code does not use automated profiling to make decisions with legal effects on users.

How long do we retain data?

• Correspondence: messages have no fixed automatic deletion deadline. They may remain in the mailbox as a record of an enquiry or cooperation. Continued retention depends on the purpose of correspondence, the course of cooperation and any need to establish, pursue or defend claims. You can request erasure; requests are assessed in light of legal obligations and grounds for continued processing.
• Technical logs: the controller does not delete logs manually. Their retention period depends on server, hosting and application configuration, including any automatic rotation or removal of older records. Logs support security, error diagnosis and incident investigation. You can contact the controller about data relating to a specific connection.
• Google Analytics 4: we use the default retention period of 2 months for detailed user and event data. New activity may reset user identifier retention in accordance with GA4 settings. This limit does not apply to standard aggregated reports. The rules are described in the Google Analytics retention documentation.
• Analytics choice and analytics cookies: 180 days. Consent validity is checked before analytics starts; when it expires, the site asks for your choice again.

Service providers and data recipients

We use the following services to run the website, handle correspondence and provide analytics:

• WEBH.pl — website hosting provided by ultimahost.pl Szeliga sp. j. The infrastructure provider may process technical connection data and data stored on the server as part of operating and securing the service.
• Zoho Mail on zoho.eu — email service. The service processes message contents, attachments and sender and recipient data. The mailbox uses Zoho's European data centre.
• Google Analytics — measurement of visits and interactions, enabled with your consent.

Data may also be disclosed to authorised authorities where required by law. Providers' access depends on the service they deliver.

Processing outside the European Economic Area

Using Google Analytics may involve processing data outside the EEA, including in the USA. Google describes its transfer safeguards, including adequacy decisions, the EU–US Data Privacy Framework and standard contractual clauses, in its data transfer policies. The document also explains how to obtain a copy of the safeguards.

Zoho stores zoho.eu mailbox data in the EU. According to the provider, certain technical support situations may allow people outside the EEA, particularly in India, to access data. Zoho describes its use of standard contractual clauses and additional safeguards in its privacy and data transfer information. You can also contact the controller for information about how your data is processed.

Policy scope and updates

This policy applies to byfox.eu. It will be updated when data processing, services or consent mechanisms change. Last updated: 27 October 2026.

Legal basis: GDPR, in particular Articles 6, 13 and 15–22.