Privacy policy
Effective from 14 October 2026
On this website you can send me an enquiry about a drum, order a drum from a hide of your choice, or simply write me a message. Below I explain in plain words what happens to your data.
Who is the data controller
The controller is Paweł Małkowski – Lepsza Strona Djembe drum workshop, Poland.
What data I collect
Only what you type into the form yourself:
- first name,
- phone number and/or e-mail address,
- preferred way of contact,
- the content of your message and which drum, hide, frame or size you are asking about.
The website has no customer accounts, stores no payment data and uses no cookies for tracking or advertising.
Purpose and legal basis
- To answer your enquiry and talk with you about a drum – based on your consent (Art. 6(1)(a) GDPR).
- To reserve a drum or hide for you and fulfil the order, if you decide to go ahead – because this is necessary to conclude and perform the contract (Art. 6(1)(b) GDPR).
- To meet tax and accounting obligations after selling a drum – Art. 6(1)(c) GDPR.
I make no automated decisions about you and do not profile you.
You can withdraw your consent at any time – just send an e-mail or call. Withdrawal does not affect what I did before.
Who receives the data
I do not sell data or share it with anyone for marketing. I do, however, use a few technical services without which the website would not work:
- Supabase – the database where enquiries are stored (servers in the European Union, Frankfurt); it also keeps technical logs, including IP addresses,
- CallMeBot and WhatsApp (Meta Platforms, USA) – forward a notification with the content of your enquiry to my phone,
- Resend (USA) – sends me an e-mail notification (if enabled),
- Google Firebase Cloud Messaging (Google, USA) – delivers the notification about your enquiry to the app on my phone; the content is encrypted and Google cannot read it,
- GitHub Pages (GitHub/Microsoft, USA) – the server hosting the website; it keeps technical logs, including IP addresses,
- Google Fonts (Google, USA) – the website's fonts; they load as soon as the page opens, so Google learns your IP address,
- YouTube (Google, USA) – videos; they load only after you click, in a mode without tracking cookies.
Companies marked “USA” process data outside the European Economic Area. This is based on an adequacy decision of the European Commission (EU-US Data Privacy Framework) – for companies that have joined it – or on standard contractual clauses approved by the European Commission.
If I reply to you via WhatsApp, Messenger or e-mail, the conversation continues in those apps and is subject to their rules.
How long I keep data
Until your enquiry is dealt with, and then no longer than 12 months (in case you come back with another question about the same drum) – unless you buy a drum; then I keep the sales data for as long as the law requires (e.g. tax and warranty rules).
Your rights
You have the right to:
- access your data and receive a copy,
- rectification,
- erasure,
- restriction of processing,
- data portability,
- withdraw consent at any time,
- object to processing (Art. 21 GDPR),
- lodge a complaint with a data protection supervisory authority – for example in your country of residence, or in Poland with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).
Just write to pmalkowski@op.pl or call.
Do I have to give my data
No, it is voluntary. Without a name and a phone number or e-mail, however, I cannot reply to you. You can also always write to me directly – via Messenger, Instagram, WhatsApp – or call.
This translation is for information; the Polish version is binding.