Last updated: 28 October 2026.
1. Data controller
The controller of personal data processed through bodypainter.eu is Żaklina Małolepsza (Świetliki). Contact: zaklina.malolepsza@gmail.com. Tax ID (NIP): 6922404588. Address: Bystrzycka 69c, 54-215 Wrocław.
The technical side of the website (hosting, visit statistics, abuse prevention and server logs) is handled by Artur Kuś, acting as a data processor in that scope. Contact: kusartur@gmail.com.
2. Data processed
- Security and abuse prevention: the IP address is used temporarily by a general request rate-limiting mechanism.
- Protection against bulk copying of pages: when traffic from an IP address looks like automated copying of the site (e.g. requesting an address disallowed in robots.txt or very many pages in a short time), we record the IP address, the browser identifier (User-Agent), the time and the page address in a security log, and the IP address may be blocked temporarily.
- Server logs: the proxy server records every request in a log: the IP address, date and time, the address of the page or file (with parameters), the response code and size, the referring page (Referer), the browser identifier (User-Agent) and the addresses in the X-Forwarded-For header if sent; its error log records the IP address and a description of the error. The logs are used only for security and fault diagnosis (the controller's legitimate interest, Article 6(1)(f) GDPR).
- Visit statistics: the server counts visits from the requests the browser sends anyway to fetch a page or file — without scripts, cookies or identifiers stored in the browser. Only aggregate counters are stored: the total number of visits to each page in each language version, the daily number of page visits, the hourly total of visits to the website, the number of requests for other addresses (e.g. the sitemap, robots.txt, files) and, in galleries, the number of views of each picture. Addresses are stored without parameters. The IP address is used only so that the same page is not counted again within one hour, and the browser identifier (User-Agent) only to skip known bots; neither is stored in the counters. When you press a link, the browser may start fetching the page a fraction of a second earlier (prefetch) so that it opens faster — such a fetch counts as a visit to that page. Pages the browser prepares in the background on its own (prerender) are not counted.
3. Purposes and legal bases
- ensuring the security of the website and preventing abuse — the controller's legitimate interests, Article 6(1)(f) GDPR,
- counting visits and analysing aggregate content popularity (e.g. a list of the most read pages), maintaining and developing the website — the controller's legitimate interest, Article 6(1)(f) GDPR,
4. Retention
- an IP address used by the general request rate-limiting mechanism remains in server memory for up to 15 minutes and is not written to disk,
- proxy server logs (request log and error log) are deleted automatically after 14 days,
- entries in the log of protection against bulk copying of pages (IP address, User-Agent, time, page address) are kept for 30 days; a temporary IP block lasts 15 minutes and is held in server memory only,
- an IP address used to prevent repeated counting of the same page remains only in server memory, is deleted automatically after 1 hour and is not written to disk; the browser identifier is checked on the request and not stored,
- hourly visit totals are deleted after 26 hours and daily page visit counts after 28 days; deletion runs automatically every hour regardless of traffic, including in archived statistics files from earlier periods. Total page visit counters and counters of other addresses may be retained indefinitely because they contain no IP addresses or user identifiers,
5. Cookies and local storage
The website does not use analytics or advertising cookies.
6. Your rights
To the extent provided by the GDPR, you have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on legitimate interests. Requests can be sent to zaklina.malolepsza@gmail.com.
Visit counters contain no IP addresses or identifiers, so the visits of a particular person cannot be singled out in them, and the IP address leaves server memory after one hour. You can object to the counting at the address above.
You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office.
7. Automated decision-making
Personal data is not used for profiling or for decisions based solely on automated processing that produce legal or similarly significant effects.
8. Contact
Privacy questions can be sent to zaklina.malolepsza@gmail.com.
For technical matters about the website itself, you can also write to kusartur@gmail.com.
Return to the home page
