Privacy policy
Effective November 4, 2026
This explains what personal data we handle, where it comes from, what we do with it and what you can do about it. We do not sell personal data.
1. Who is responsible for your data
The data controller is:
One Div Krzysztof Hejna, trading as Header Works
Piecewska 25/25, 80-288 Gdańsk, Poland
Tax ID (NIP / VAT): PL9571165383
Email: chris@headerworks.com
We are a sole proprietorship registered in Poland, so the EU General Data Protection Regulation (GDPR) applies to what we do, even though our customers are in the United States. We have not appointed a data protection officer. Write to the email address above about anything in this policy.
2. What we collect, why, and on what legal basis
| Whose data | What we collect and where from | Why we use it | Legal basis (GDPR) |
|---|---|---|---|
| Website visitors | IP address, browser details, pages requested and times, recorded automatically by our hosting provider. | To run, secure and fix the website. | Legitimate interests, Art. 6(1)(f) |
| People who request a preview | Name, email, business name, website, trade, city, what you tell us about the business and, if you give it, your mobile number, all from you. A scrambled form of your IP address, recorded automatically. | To build your preview and send it; to follow up about it; to stop the form being abused. | Steps at your request before a contract, Art. 6(1)(b); legitimate interests for follow-ups, Art. 6(1)(f) |
| Businesses we contact first (see section 3) | Business name, phone, address, website, Google rating and review count, and a work email and, where listed, a contact’s name, job title and phone. The list we receive can also include public social profile links and estimates of company size. From public sources (section 3). | To build a preview of a new website and email it to you. | Legitimate interests, Art. 6(1)(f) |
| Clients | Name, business and contact details, messages and change requests, photos and content you send, billing records. From you and our payment provider. We never see or store full card numbers. | To provide the service, take payment, support you and meet legal duties. | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| People booking a demo | Name, email, company and the time you choose. From you. | To hold the optional demo call you asked for. | Steps at your request before a contract, Art. 6(1)(b) |
| People who opt in to texts | Mobile number, your consent and when you gave it, and message history. | To send the texts you asked for; to keep proof of consent and honor STOP requests. | Consent, Art. 6(1)(a), which you can withdraw at any time; legitimate interests for proof and opt-out records, Art. 6(1)(f) |
You do not have to give us your data, but we cannot build a preview or provide the service without the basics, such as a way to reach you.
3. If we contacted you first
We look for local service businesses that might benefit from a new website, build a preview for them, and email them a link. If you received an email like that, here is what happened:
- Where we got your details: your business’s public Google Maps listing, your business website and other public web sources. We use a data provider, Outscraper, to collect them. It also checks that the email address can receive mail.
- What we hold: the business details listed in section 2. This can include personal data if your work email or your name is public, or if the business carries your name. We delete the raw list we received within 30 days and keep only what we need to contact you.
- What we show: your preview uses facts from your public listing. It is hidden from search engines and sits at a private link with a random code. It uses placeholder photos and text, and it comes down about two weeks after our first email. We never publish a personal email address on it.
- Why we believe we may do this: we rely on our legitimate interest in offering our services to businesses, by short and relevant messages about their business, to their published work contact details.
You can object at any time, and we will stop. Reply “no” to any of our emails or write to chris@headerworks.com. We will delete your details and keep only the minimum needed so we never contact you again: your email address and business listing reference, on a do-not-contact list.
4. Customers of businesses using Header Works
When you ask a business for a quote through a website we run, that business decides what happens with your details and is the controller of your data. We handle it on its behalf as a processor. That covers your name, contact details, address, project details and messages, plus a scrambled form of your IP address to stop the form being abused. Questions and requests about this data should go to that business first. If you contact us, we will pass your request on and help it respond.
5. Automated tools and AI
We use software, including AI models, to help draft website copy, make requested site changes and write replies to leads. A person is accountable for how it is set up. We do not use it to make decisions that have legal or similarly significant effects on you. We use our AI provider under commercial terms that do not let it train its models on this data.
7. Transfers outside the European Economic Area
Most of the providers above are in the United States. When your data leaves the EEA, we rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission’s standard contractual clauses. Email us if you would like a copy of the relevant safeguards.
8. How long we keep it
| Data | How long |
|---|---|
| Businesses we decided not to contact | Deleted within 30 days of collecting them |
| Businesses we contacted, no reply or no deal | Up to 24 months after our last message, then deleted except for a do-not-contact entry |
| Do-not-contact list | As long as we do outreach, so we keep honoring your request |
| Preview requests that do not lead to a deal | 12 months |
| Client account, content and messages | While you are a client, then 30 days for you to request a copy, then deleted from active systems within 90 days |
| Invoices and billing records | As long as tax law requires, generally 5 years from the end of the relevant tax year |
| Records needed for a dispute or legal claim | Until it is resolved and the limitation period has passed |
| Text message consent and opt-out records | For as long as we text you, and up to 5 years after, so we can prove consent and honor opt-outs |
| Server logs | According to our hosting provider’s standard retention, typically days to weeks |
9. Your rights
Under the GDPR, you have the right to:
- see the data we hold about you and get a copy
- correct it if it is wrong
- have it deleted or restricted in certain cases
- receive data you gave us in a portable format, where the law provides this
- object at any time to our use of your data based on legitimate interests, including for direct marketing, where we must stop
- withdraw consent at any time, which does not affect what we did before
Email chris@headerworks.com. We reply within one month. We may need to confirm who you are first. It is free unless a request is clearly excessive.
You can also complain to the Polish data protection authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland, or to the authority where you live. We would appreciate the chance to fix it first.
US residents: some US states give residents their own privacy rights, such as access, deletion and opting out of sale. You can use the same email address whichever state you live in, and we will not treat you differently for doing so. We do not sell personal data or use it for targeted advertising.
11. Text messages
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Opt-in data and consent will not be shared with any third parties, except the messaging providers and subcontractors that deliver the messages for us. Our text message terms have the rest of the details.
12. Security
We use encrypted connections, access controls, private database tables that public keys cannot read, and two-factor authentication on our key accounts. No system is perfectly secure. If a breach is likely to put your rights at risk, we will notify the regulator and you as the law requires.
13. Children
Our services are for businesses, not for anyone under 18. We do not knowingly collect children’s data.
14. Changes to this policy
When we change this policy, we update the date at the top. If a change is significant, we will tell clients by email before it applies.