privacy

This site belongs to Agnieszka Anna Brzeska, trading as Neshh, based in Paphos, Cyprus. I am the controller of anything you share here. You can reach me at neshh.web@gmail.com.

I keep this simple, because the site is simple. There are no accounts, no shop, no advertising, and nothing here follows you anywhere else.

What I collect

This site collects your details in two ways, and in both cases you type them in yourself.

The contact forms: your name, your email address, what you write in your message, and which page you wrote from. The mentorship form adds a single optional question about what brings you to mentorship, and the collaborations form asks who you work for — in every case, only what you choose to fill in. I use all of it to reply to you and, if we come to work together, to arrange that work.

Please don’t put health or medical details in a form. Their place is in our conversation, not on a web page. If you include them anyway, I treat them as shared with your explicit consent, use them only to reply to you, and they are deleted with the rest of your message.

The newsletter: if you sign up, your first name and your email address, plus a note that the sign-up came from the newsletter and not from a message. I use it to send occasional news about explorations and dates.

You can also reach me directly — by email, on WhatsApp or on Instagram. If you do, I have whatever you choose to send, and those services handle it under their own terms, not mine.

My hosting provider keeps the usual technical logs (your IP address and browser type, for example) for security and to keep the site running. They are not used to identify you.

Cookies and visitor statistics

This site sets no cookies. That is why there is no cookie banner.

I do use a simple visitor counter called Umami, run by Umami Software, Inc. The servers holding this data are in the European Union, and there is a data processing agreement in place. It records which pages are opened, roughly which part of the world a visit came from, and what kind of device was used. It places nothing on your device and keeps no identifier. It cannot recognise you from one visit to the next, and it cannot follow you to any other site. To tell a repeat visit apart within the same day, it works out a value from your IP address and your browser — regenerated every day, and never stored next to anything that identifies you. If your browser asks not to be tracked, nothing is recorded at all. I use this to know which pages people actually read, and nothing more. My lawful basis is my legitimate interest in understanding how the site is used (Article 6(1)(f) GDPR). You can object at any time by writing to me.

Why I am allowed to use your data

When you send an enquiry, I process your details because you asked me to reply (Article 6(1)(b) GDPR — steps taken at your request before entering into a contract). Keeping the site secure, and understanding how it is used, are both legitimate interests (Article 6(1)(f)).

The newsletter rests on your consent (Article 6(1)(a)), given when you signed up. You can withdraw it whenever you like — write to me and I will take you off the list. Withdrawing it does not undo anything I did while I had it.

Keeping invoicing and accounting records is a legal obligation rather than a choice (Article 6(1)(c)), which is why that retention period is longer than the others.

How long I keep it

Enquiries are kept for 12 months from your last message, then deleted.

If we work together, the records needed for invoicing and accounting are kept for 6 years, because Cypriot tax law requires it.

Newsletter sign-ups are kept until you ask to be taken off the list.

The form service keeps its own copy of each submission until I delete it. I delete messages there once I have replied, and in any case within 30 days. It also keeps the sender’s IP address, and the approximate location it derives from it, for 12 months, to filter spam.

My hosting provider’s technical logs are kept for as long as that provider keeps them — weeks rather than years.

Who has access to your data

No one, apart from the services that run the site and the mailbox:

• Formspark, the form service that carries what you send me. It is run by Trampoline Software SRL in Belgium, receives everything a form contains, stores it on servers in Ireland and Germany — inside the European Economic Area — and forwards it to my inbox, under a data-processing agreement with me. A few of the suppliers Formspark itself uses are outside the EEA; Formspark lists each one, and the safeguard that covers it, at formspark.io/legal/subprocessors.
• Google, my email provider. My inbox is an ordinary Google account, so email may be stored and processed outside the EU, under Google’s own terms rather than a contract I have signed with them.
• Railway, my hosting provider, which keeps the technical logs described above.
• Umami, the visitor counter, operated by Umami Software, Inc. on servers in the European Union, under a data processing agreement with me.

I do not sell your data or pass it to anyone else.

Your rights

At any time you can ask me for access to the data I hold about you, to correct it, to delete it, to restrict its use, or to receive a copy in a portable form. You can also object to its use. If you object to marketing, that objection is absolute — I stop, and I don’t ask why. Write to neshh.web@gmail.com and I will answer within a month.

If you think I have handled your data badly, you can complain to the Office of the Commissioner for Personal Data Protection of Cyprus (dataprotection.gov.cy).

Changes

If anything here changes, I will update this page and the date at the top.