Privacy Policy

1. Data controller

The controller of personal data processed in the Stancje Olsztyn service is Uzupelnij nazwe operatora (firma albo imie i nazwisko), Uzupelnij adres siedziby / adres korespondencyjny. Contact for data protection matters: uzupelnij@twoja-domena.pl.

2. What data we collect

• Account data: email address, full name or display name, optional phone number, a hashed password, and preferred interface language.
• Listing data: listing content, photos, approximate or exact location (geographic coordinates), price and other offer details.
• Technical data: session data stored in the database, login timestamps.

3. Purpose and legal basis for processing

• Providing the service (registration, login, publishing and searching listings) - Art. 6(1)(b) GDPR (performance of a contract).
• Sending email notifications about listings matching saved searches - Art. 6(1)(a) GDPR (consent given when saving a search).
• Ensuring the security of the service and preventing abuse - Art. 6(1)(f) GDPR (legitimate interest of the controller).

4. Recipients of data

Data may be shared with providers supporting the operation of the service:

• hosting and database providers,
• the email delivery (SMTP) provider,
• OpenStreetMap / Nominatim / OSRM - solely for address geocoding and route calculation requests, without transmitting any data that would identify an account.

5. Data retention

Account data is kept until it is deleted by the user or by the service administrator. Listings expire automatically after the chosen validity period, and if not refreshed, are permanently deleted along with their photos 30 days after expiring or being archived.

6. User rights

Users have the right to access, rectify, delete, and restrict the processing of their data, the right to data portability and to object, as well as the right to lodge a complaint with the relevant data protection authority (in Poland: the President of the Personal Data Protection Office).

7. Cookies

The service uses a strictly necessary session cookie, used to keep users logged in and to remember the chosen interface language - this does not require separate consent. If Google AdSense ads (see point 8) or Google Analytics (see point 9) are active on the service, additional cookies and similar technologies may be used to personalize ads and measure traffic - their use requires the user's consent.

8. Advertising (Google AdSense)

The service may display advertising through the Google AdSense program, operated by Google Ireland Limited. Google and its advertising partners may use cookies and similar technologies to show ads tailored to the user's interests and to measure their performance, processing data such as device identifiers, IP address and activity history across services that use Google ads.

• Users from the European Economic Area and the United Kingdom are shown a consent message (Google Funding Choices), where they can consent to ad personalization, limit it to non-personalized ads only, or manage their preferences at any time.
• Detailed information on Google's data processing and ad settings management: policies.google.com/technologies/ads and adssettings.google.com.
• The legal basis for processing data for advertising purposes is the user's consent (Art. 6(1)(a) GDPR); withholding consent does not restrict access to the service's content.

9. Analytics (Google Analytics)

The service may use Google Analytics (Google Ireland Limited) to analyze traffic and how the service is used, for statistical purposes. Google Analytics uses cookies and similar technologies to collect aggregated data about user activity (e.g. pages visited, time spent, approximate country/city-level location).

• Data collected by Google Analytics is not used by the service administrator to identify a specific person.
• Detailed information on Google's data processing: policies.google.com/privacy. You can opt out of Google Analytics by installing the opt-out add-on provided by Google.
• The legal basis for processing data for analytics purposes is the user's consent (Art. 6(1)(a) GDPR).

10. Security

User passwords are stored in hashed form (bcrypt). It is recommended to access the service over an encrypted (HTTPS) connection.

11. Changes to this policy

This policy may be updated from time to time. The current version is always available at this address.