GDPR Information Notice
1. Controller identity
The data controller is Tomasz Rey, operating under the brand Pelayo Consultores, Warsaw, Poland.
Contact: tom@pelayoconsultores.com
2. Legal bases for processing
| Processing activity | Legal basis (GDPR Art.) |
|---|---|
| Responding to contact enquiries | Art. 6(1)(b) - pre-contractual measures |
| Fulfilling product purchases | Art. 6(1)(b) - contract performance |
| Retaining tax and invoice records | Art. 6(1)(c) - legal obligation |
| Sending requested information | Art. 6(1)(a) - consent |
3. Data subjects' rights
Under GDPR Chapter III, you have the following rights:
- Access (Art. 15): obtain confirmation of whether your data is processed and receive a copy
- Rectification (Art. 16): correct inaccurate personal data
- Erasure (Art. 17): request deletion where no legal basis for continued processing exists
- Restriction (Art. 18): limit processing in specified circumstances
- Portability (Art. 20): receive your data in a structured, machine-readable format
- Object (Art. 21): object to processing based on legitimate interests
- Withdraw consent (Art. 7(3)): at any time, without affecting prior processing
To exercise any right, email tom@pelayoconsultores.com. We will respond within 30 days. Complex requests may be extended by a further 60 days with notification.
4. Right to lodge a complaint
You have the right to lodge a complaint with the Polish supervisory authority:
Urzad Ochrony Danych Osobowych (UODO)
ul. Stawki 2, 00-193 Warsaw, Poland
uodo.gov.pl
5. Data minimisation
We collect only what is necessary for the specific purpose stated at the point of collection. No profiling or automated decision-making is carried out that produces legal or similarly significant effects.
6. Retention periods
| Data type | Retention period | Basis |
|---|---|---|
| Email correspondence | 3 years | Legitimate interest |
| Purchase and invoice records | 5 years | Polish tax law (Art. 70 Ordynacja podatkowa) |
| Consent records | Until consent withdrawn + 1 year | Legal obligation (GDPR Art. 7) |
7. Third-party processors
- Gumroad, Inc. - payment and product delivery processor. Gumroad operates under its own privacy policy and maintains SCCs for EU-US transfers.
- Google LLC - Google Fonts CDN. Font files are loaded client-side; no personal data is transmitted to Google by this site.
8. Contact
tom@pelayoconsultores.com
www.pelayoconsultores.com