Skip to content

Legal

Privacy policy

How Open BJJ collects and uses personal data, who receives it and what your rights are.

This policy explains what personal data Open BJJ processes, why, on what legal basis and for how long, as required by the General Data Protection Regulation (GDPR).

1. Who we are

The controller of your personal data on Open BJJ (https://www.open-bjj.com) is Kornel Dubieniecki.

For anything about your data, write to contact@open-bjj.com.

2. Visiting the site

When you open a page, our hosting and network providers process technical data to deliver it, keep the site secure and diagnose errors.

  • Data: IP address, date and time, requested address, referrer, browser and device information.
  • Legal basis: legitimate interest, Art. 6(1)(f) GDPR
  • How long: server logs for a short time, usually no longer than 30 days

3. Contacting us

When you email us, we use your message and contact details to reply and handle your matter.

  • Data: email address, name if given, content of the message.
  • Legal basis: legitimate interest, Art. 6(1)(f) GDPR
  • How long: until the matter is closed, then as long as claims related to it can be raised

4. Newsletter

If you subscribe, we send you emails about new content and updates of the site. You confirm the subscription with a link (double opt-in), and every email has an unsubscribe link.

  • Data: email address, optional name, time and source of sign-up and confirmation, subscription status.
  • Legal basis: consent, Art. 6(1)(a) GDPR
  • How long: until you unsubscribe or withdraw consent; we keep a record of the consent and its withdrawal while claims can be raised

Sending you commercial information by email requires your consent under the rules on electronic communications. You can withdraw it at any time; this does not affect emails sent before.

5. Analytics

With your consent we use the tools listed below to measure how the site is used. They store cookies or identify you only after you accept them in the cookie banner.

  • Data: cookie identifiers, visited pages, events, approximate location, device and browser data.
  • Legal basis: consent, Art. 6(1)(a) GDPR
  • How long: Google Analytics 4: Event data is kept for 2 or 14 months, as set in our Google Analytics data retention setting; cookies expire after 2 years. PostHog: Kept for as long as our PostHog retention setting allows, then deleted.

Details are in our cookie policy.

6. Who receives the data

We do not sell personal data. We share it only with providers that process it on our behalf under data processing agreements, and with authorities when the law requires it.

  • Vercel (Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA): Hosting the website, delivering pages and running server functions such as forms. Location: EEA and USA (global edge network). Safeguard: EU–US Data Privacy Framework and Standard Contractual Clauses. Privacy policy.
  • Vercel Web Analytics (Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA): Cookie-free, aggregated visit statistics. Visitors are not identified across days. Location: EEA and USA. Safeguard: EU–US Data Privacy Framework and Standard Contractual Clauses. Privacy policy.
  • Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): Statistics on how pages are used, so we can improve the content. Location: EEA and USA. Safeguard: EU–US Data Privacy Framework and Standard Contractual Clauses. Privacy policy.
  • PostHog (PostHog, Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA): Product analytics: which features and pages are used and where people drop off. Location: USA. Safeguard: Standard Contractual Clauses (Art. 46(2)(c) GDPR). Privacy policy.
  • Listmonk (self-hosted by us): Managing subscriptions and sending emails you asked for (newsletter, alerts). Location: Our own server.

7. Transfers outside the EEA

Some providers process data outside the European Economic Area, mainly in the USA. We use them only with the safeguards GDPR requires: the EU–US Data Privacy Framework adequacy decision for certified companies, or Standard Contractual Clauses approved by the European Commission. You can ask us for a copy of these safeguards.

  • Vercel: EU–US Data Privacy Framework and Standard Contractual Clauses
  • Vercel Web Analytics: EU–US Data Privacy Framework and Standard Contractual Clauses
  • Google Analytics 4: EU–US Data Privacy Framework and Standard Contractual Clauses
  • PostHog: Standard Contractual Clauses (Art. 46(2)(c) GDPR)

8. Your rights

You have the right to:

  • access your data and get a copy of it
  • have inaccurate data corrected
  • have your data erased
  • restrict processing
  • receive your data in a portable format
  • object to processing based on legitimate interest, including direct marketing
  • withdraw consent at any time, without affecting processing before the withdrawal

To use them, write to contact@open-bjj.com. We answer within one month.

You can also lodge a complaint with the supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa.

9. Is providing data required?

Providing data is voluntary, but some services cannot work without it, for example we cannot send a newsletter without an email address. Where the law requires data, such as for invoices, we say so in the form. We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.

10. Changes

We update this policy when the site or the law changes. The date at the top shows the latest version. See also our terms of use.