Version of: 2026-10-07
This is a translation. The Polish version is binding.
This policy explains which personal data Ozeplan processes, where they come from, for what purposes and on what legal bases, to whom we disclose them, how long we keep them and what rights you have.
1. Controller and contact
The controller is the service operator named at the end of this document. For personal data matters write to the operator e-mail address given at the end of this document or to the operator address given at the end of this document. The operator has not appointed a data protection officer.
2. Who is responsible for which data
Data a company enters into its enquiry tools (manual enquiries, notes, tasks) are processed by us on the company behalf as a processor; the company is their controller. After receiving an enquiry the crew becomes a separate controller of the data it needs to prepare an offer and perform the contract. A partner fulfilling an order is a separate controller for that order.
3. What data we process
This depends on how you use the service:
– account: e-mail address, name or display name, phone number, language, notification settings and quiet hours, date of last activity;
– company and crew: name, tax number, VAT register check result, base address (private), description, crew phone number, portfolio, credentials;
– enquiries and phone reveals: contact form data, date the number was revealed;
– investment room: messages, documents, photos (with EXIF and location removed), stages, formalities, service orders;
– reviews, content reports, prices submitted to the catalogue and imported price lists;
– technical data: IP address when accepting documents, for administrative actions and for security limits, device identifiers for push notifications, the administrative action log.
4. Where the data come from
You provide most data yourself. Some data come from others: companies (staff data in credentials, e-mail addresses of invited people, client data in manual enquiries), the Ministry of Finance VAT taxpayer register (company name and status), and Google or Apple when you sign in with them (e-mail, name).
5. Purposes and legal bases
We process data:
– creating and running the account, sign-in, two-step verification, notifications about activity in the service – performance of the contract (Art. 6(1)(b) GDPR);
– passing an enquiry to a crew, running the investment room, publishing a crew profile, the company and partner panels, the catalogue and price alerts – performance of the contract (b);
– telling a crew who revealed its number and when – the legitimate interest of the crew in calling back and our interest in preventing abuse (f);
– publishing reviews with the author first name and surname initial – the legitimate interest in reliable information for other clients (f);
– checking companies in the VAT register and checking credentials – the legitimate interest in preventing impersonation of companies (f);
– handling content notices, statements of reasons, complaints and appeals – legal obligations under Regulations 2022/2065 and 2019/1150 and the Polish Act on electronically supplied services (c);
– deleting accounts inactive for 24 months – the legitimate interest in not keeping unnecessary data (f);
– security, rate limits, the administrative action log, establishing and defending claims – legitimate interest (f);
– sharing documents with a partner for an order – your consent (a), which you may withdraw at any time without affecting the lawfulness of processing before withdrawal;
– view and contact statistics – collected without user identifiers, so they are not personal data.
6. Whether you must provide data; automated decisions
Your e-mail address is required for an account. A name and phone number are required to send an enquiry, and a tax number to register a company. Other data are optional.
We make no decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. We do not profile users. Price alerts follow only the settings you choose.
7. Recipients
Enquiry data go to the crew you write to. Investment room content is visible to its participants. A partner sees only the order and the documents you agreed to share. Public content (crew profile, portfolio, reviews) is visible to everyone.
We use providers who process data on our behalf or as separate controllers:
– Hetzner Online GmbH – servers and file storage in the European Union;
– Resend, Inc. – e-mail delivery (USA);
– 650 Industries, Inc. (Expo) – push notification relay (USA);
– Apple Inc. and Google LLC – push delivery, and separate controllers when you sign in with their accounts;
– OpenFreeMap – map tiles; your browser or app downloads the map directly, so the provider receives your IP address;
– OpenStreetMap Foundation (Nominatim) – address lookup for crew bases; the request is sent by our server, not your device (United Kingdom);
– Ministry of Finance – tax number check in the VAT taxpayer register;
– public authorities where the law requires.
8. Transfers outside the European Economic Area
Transfers to the USA rely on the European Commission decision of 10 July 2023 on the EU–US Data Privacy Framework for certified recipients, and otherwise on standard contractual clauses approved by the Commission. Transfers to the United Kingdom rely on an adequacy decision. A copy of the safeguards is available on request at the operator e-mail address given at the end of this document.
9. How long we keep data
– account data, enquiries, phone reveals and room content: until the account is deleted; accounts inactive for 24 months are deleted after a 30-day notice;
– after deletion we anonymise personal data; content the other party needs (e.g. room messages, reviews) stays without identifying data;
– IP addresses for security limits: in server memory only, at most 24 hours;
– server logs: deleted automatically when they reach their size limit, usually after a few days;
– push tokens: until sign-out, notifications are turned off or the account is deleted;
– statistics without personal data: about 13 months;
– document acceptances, content notices, moderation decisions and the administrative action log: for the limitation period – 6 years, or 3 years in relations with businesses, counted from the end of the calendar year;
– backups: up to 14 days.
10. Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability. You can download a full copy of your data as JSON in "Your data" and delete your account there. You may withdraw consent at any time without affecting the lawfulness of earlier processing.
Right to object. You may object at any time to processing based on legitimate interests (Art. 21 GDPR) by writing to the operator e-mail address given at the end of this document. We will stop unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the establishment, exercise or defence of legal claims.
You may lodge a complaint with the President of the Personal Data Protection Office (UODO), Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).
11. Security
Connections are encrypted. Private files have no public addresses and are released only to authorised people after an access check on every download. We remove metadata, including location, from photos. Administrators sign in with two-step verification and their actions are logged.
12. Data stored on your device
We store on your device only the data necessary for the services you request:
No consent is needed for these data (Article 399(3) of the Polish Electronic Communications Law). We use no third-party advertising or analytics cookies. You can delete the data in your browser or app settings; this signs you out and discards unsent messages. We send no marketing messages. Service notifications can be turned off in notification settings.
– sign-in session data (browser or app storage) – keeping you signed in, until sign-out or session expiry;
– chosen language and theme – remembering settings;
– the queue of unsent chat messages – delivering them when the connection returns, until sent or removed (after 7 days we ask you to decide);
– in the app: a push token when you turn notifications on.
13. Changes to this policy
Each version of the policy is dated. We will tell you about a significant change by e-mail and in the service before it takes effect.