1. Who is responsible
The controller is Viktar Pikulik, using Row & Rule as a project and portfolio name and based in Poland. Row & Rule is not presented as an incorporated company.
Privacy questions and rights requests may be sent to viktar@rowandrule.com.
2. Information processed
The website does not contain an account system, checkout, newsletter form or server-side enquiry form.
- Written enquiries: your name, email address, organisation, message and any information you voluntarily include when you email Row & Rule.
- Technical information: hosting and security infrastructure may process IP address, browser, device, timestamps, requested pages and security events to deliver and protect the website.
Please do not send passwords, live access keys, financial account data, special-category personal data or confidential production datasets in an initial enquiry.
3. Browser-local brief
The Process Brief is assembled locally in your browser. Its contents are not transmitted to Row & Rule when you type or select “Build my process brief”. If you select the email button, your own email application opens with the brief prepared in a draft message; the message is sent only if you choose to send it.
4. Purposes and legal bases
- To read and answer an enquiry and, where requested, take steps toward a possible written engagement: steps at your request before a contract and legitimate interests in handling professional correspondence.
- To operate, secure and diagnose the website: legitimate interests in providing a reliable and secure public site.
- To keep records needed for legal obligations or the establishment, exercise or defence of legal claims.
No solely automated decision with legal or similarly significant effects is made about you.
5. Recipients and transfers
Information may be processed by website hosting and security providers, the business email provider and technical service providers acting under their own terms or on documented instructions. It may also be disclosed to professional advisers or public authorities where reasonably necessary or legally required.
Some infrastructure providers may process information outside the European Economic Area. Where applicable, transfers should rely on an adequacy decision, approved contractual safeguards or another lawful mechanism.
Personal information is not sold and is not added to a marketing list.
6. Retention
An enquiry that does not become a project is normally retained for no longer than 12 months after the last meaningful contact. Records connected with an engagement, payment, dispute or legal obligation may be kept longer for the applicable statutory period. Technical logs are retained according to operational need and the hosting provider’s retention schedule.
7. Your rights
Depending on the circumstances, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.
You may also complain to the competent supervisory authority. In Poland this is the President of the Personal Data Protection Office (UODO).
8. Security and changes
Reasonable technical and organisational safeguards are used, but no internet transmission or storage method can be guaranteed completely secure. This notice may be updated when the website, providers or processing practices change; the effective date above will be revised.
This notice describes the website’s current, limited data flow. A production project involving client data requires a separate written data boundary, access model and, where applicable, data-processing terms.