Privacy policy

I run this site on my own, so I am also the person responsible for the data that passes through it. Below I explain what happens to that data: what I collect, why, who I entrust it to and what you can do about it. I have tried to keep it plain but complete, in line with the GDPR, that is Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

Who is responsible for your data

The controller of personal data collected through tripweekend.pl is Marcel Łuczak, the author of TripWeekend.

Contact for anything related to your data: tripweekend.marcel@gmail.com.

Correspondence address: Storgata 59, 0182 Oslo, Norway.

I have not appointed a data protection officer, as I am not required to. You write to me directly.

What I collect, in short

• Newsletter: your email address, plus your IP address and the date of sign-up as proof of consent.
• Contact form: your name, email address and the content of your message.
• Every visit: your IP address and standard technical details recorded in the server logs.
• Cookies: a record of the choice you made on the consent banner and, if you agree to it, an affiliate cookie that attributes clicks on flight links.

I do not collect special categories of data, I do not profile you and I do not make automated decisions about you. Providing any data is voluntary, it is simply that without an email address I cannot send you the newsletter, and without a message I cannot answer your question.

Newsletter

When you sign up for the newsletter, your email address goes to MailerLite, the tool I use to keep the list and send the emails. It is operated by MailerLite Limited, based in Ireland, and the data may also be processed in the United States under the EU-US Data Privacy Framework.

The legal basis is your consent (Article 6(1)(a) GDPR). Along with the email address I store the IP address and the date of sign-up. That is the proof that consent was actually given, which Article 7(1) GDPR requires me to keep.

You can withdraw your consent at any time by clicking the "unsubscribe" link at the bottom of any email, or by writing to the address above. Withdrawing consent does not affect the lawfulness of the emails sent before you did so.

The newsletter is not advertising for third parties. I write about travel, about new posts on the blog and about what is happening with the project.

Contact form

The form on the contact page collects three things: your name, your email address and your message. The message lands in my inbox, and the delivery itself is handled by Resend, Inc., based in the United States.

The legal basis is my legitimate interest (Article 6(1)(f) GDPR), namely answering your enquiry and keeping up the correspondence. If you include extra details in the message, I process them to the extent needed to reply. Please do not send sensitive information through the form, such as health data or document numbers.

When a message is submitted I check the IP address and the number of requests coming from it, to limit spam and abuse. That is also my legitimate interest (Article 6(1)(f) GDPR).

Hosting and server logs

The site runs on infrastructure provided by Vercel Inc., based in the United States. The servers record standard logs: IP address, date and time of the request, the page requested, browser and operating system. This data serves to keep the site running, to debug errors and to keep it secure, which is my legitimate interest (Article 6(1)(f) GDPR). I do not combine the logs with other data and I do not use them to build profiles of visitors.

Cookies and affiliate links

On your first visit you will see a banner asking for consent to cookies. Until you answer it, no marketing scripts are started.

• Essential. I remember the choice you made on the banner in your browser storage (localStorage). That way I do not ask again on every visit. This information stays in your browser and does not identify you.
• Affiliate and marketing. Once you click "Accept", I load the Impact affiliate tag (Impact Tech, Inc., based in the United States). It sets a marketing cookie that lets a click on a Skyscanner link, and any booking that follows, be attributed to this site. If you choose "Essential only", the script is never loaded.

The legal basis for anything beyond essential cookies is your consent (Article 6(1)(a) GDPR and the Polish electronic communications law). You can change your choice at any time using the "Cookie settings" button in the footer. You can also delete cookies and clear site data in your browser settings.

The site embeds the Skyscanner flight search widget, loaded from widgets.skyscanner.net. While the widget is displayed, your browser connects to Skyscanner's servers. Skyscanner acts as an independent controller of that data and may set its own cookies on the terms described in its privacy policy.

Some of the flight links are affiliate links. If you book a ticket after clicking one, I receive a commission and you pay exactly the same price as you otherwise would. The partner does not give me your personal data, only aggregate statistics on clicks and transactions.

Who I share data with

I use tools that process data on my behalf, or for their own purposes if you consent to that:

• MailerLite Limited (Ireland): running the list and sending the newsletter.
• Resend, Inc. (United States): delivering messages from the contact form.
• Vercel Inc. (United States): hosting and server logs.
• Impact Tech, Inc. (United States): measuring clicks on affiliate links, only after you consent to marketing cookies.

Beyond that, data may be disclosed to authorities entitled to request it under the law. I do not sell data and I do not share it for other companies' advertising.

Transfers outside the European Economic Area

Some of the providers listed above are based in the United States, so your data may be processed there. Transfers rely on the European Commission's adequacy decision under the EU-US Data Privacy Framework or, where a provider is not certified under it, on the standard contractual clauses approved by the European Commission.

How long I keep data

• Newsletter: until you unsubscribe or withdraw consent. After that, all that remains is the record that you opted out, so that I do not email you again.
• Contact form: up to 12 months after the correspondence ends, unless a longer period is needed to establish, exercise or defend legal claims, or is required by law.
• Server logs: for as long as they are needed for debugging and security, in line with the hosting provider's retention rules.
• Cookies: for the lifetime of each cookie. Your saved consent stays in your browser until you change it or clear the site data.

Your rights

In connection with the processing of your data you have the right to:

• access your data and receive a copy of it (Article 15 GDPR),
• have inaccurate or incomplete data corrected (Article 16 GDPR),
• have your data erased (Article 17 GDPR),
• restrict the processing (Article 18 GDPR),
• receive and port data you provided on the basis of consent or a contract (Article 20 GDPR),
• object to processing based on my legitimate interest (Article 21 GDPR),
• withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, write to tripweekend.marcel@gmail.com. I reply as fast as I can, and no later than one month from your request.

If you believe I am handling your data unlawfully, you can lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland. You can also complain to the authority in the country where you live or work.

Links to other services

The blog and the flights section link out to external sites, among them Skyscanner and my profiles on Instagram, YouTube, TikTok and Facebook. Once you follow such a link, the rules of that site's owner apply instead of this policy. They are worth checking, as they may differ from mine.

Security

The connection to the site is encrypted with a TLS certificate, so data from the forms is not sent in the clear. I am the only person with access to the inbox and the tools your data reaches, and I use them only as far as running the site requires.

Changes to this policy

If I change the tools, the scope of the data I collect or the purposes of processing, I will update this document and change the last updated date at the top of the page. It is worth a look before you sign up for the newsletter after a longer break.