1. Personal data administrator

The administrator of the personal data of the Application’s users is Bitnoise sp. z o.o., with its registered office at: Poznań, ul. Bednarska 1, Tax ID (NIP): 781 193 78 10.

2. Legal basis for processing

Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), the Polish Act of 10 May 2018 on the protection of personal data, and other applicable laws.

3. Scope of processed data

The Administrator may process the following data:

• first and last name,
• e-mail address,
• identification data of the employer and employee (including Tax ID, position),
• data on user activity within the Application (logs, schedules, work orders, certificates, training, etc.),
• absence data and data relating to the performance of work orders,
• location data (device geolocation), collected solely in connection with the performance and coordination of field work orders,
• data provided by Clients through the fault-reporting functionality.

4. Purposes of processing

Personal data is processed for the purpose of:

• performing the contract for the electronic provision of services (Art. 6(1)(b) GDPR),
• maintaining an account and enabling use of the Application,
• performing, coordinating, and verifying field work orders based on location data (device geolocation),
• fulfilling legal obligations (e.g. accounting and tax obligations),
• providing technical support and user service,
• monitoring the correct operation of the Application and improving its functionality,
• pursuing claims and defending against claims.

5. Sharing of personal data

Data may be transferred to entities cooperating with the Administrator in operating the Application (e.g. IT service providers, payment operators, hosting providers, analytics and advertising tool providers) on the basis of data processing agreements, in accordance with the GDPR. Data will not be transferred outside the European Economic Area unless appropriate safeguards are ensured (e.g. standard contractual clauses or a European Commission adequacy decision) — details concerning analytics and advertising tools are set out in section 10.

6. Data retention period

Data will be stored for the duration of the contract and the provision of services, and also after its termination for the purposes of:

• pursuing claims under the contract (until they become time-barred),
• fulfilling legal obligations (e.g. tax obligations, for 5 years),
• archiving, for a period no longer than 6 years.

7. Rights of the data subject

The data subject has the right to:

• access their data,
• rectify their data,
• erase their data (the right to be forgotten),
• restrict processing,
• data portability,
• object to processing,
• withdraw consent (where processing is based on it),
• lodge a complaint with the President of the Personal Data Protection Office.

8. Automated decision-making and profiling

The Administrator does not take automated decisions producing legal effects concerning users or similarly significantly affecting them.

If the user consents to cookies in the “Marketing” category, their data may be subject to profiling for the purpose of selecting the ads shown on Google advertising networks. That profiling produces no legal effects for the user and can be switched off at any time by withdrawing consent — see section 10.

9. Data security

The Administrator ensures appropriate technical and organisational measures to safeguard the processed data, in accordance with Art. 32 GDPR, including the use of encryption protocols, access passwords, monitoring systems, and server protection.

10. Cookies and analytics tools

The website and the Application use cookies and similar technologies. Cookies other than strictly necessary ones are only set once the user has given freely granted consent, on the basis of Art. 6(1)(a) GDPR and the provisions of the Polish Electronic Communications Law. Consent is collected through a banner shown on the first visit, split into independent categories that the user may accept separately.

Strictly necessary cookies — always used, without consent, because the site cannot work correctly without them. They do not identify the user and are not used for tracking:

• tf_cookie_consent — stores the user’s cookie decision (retention: 12 months),
• tf_cookie_banner_minimized — remembers that the banner was collapsed, for the duration of the browser session,
• tf-lang — remembers the selected language version (browser local storage).

Cookieless analytics (Umami) — the Administrator uses Umami, self-hosted on its own infrastructure within the European Economic Area. Umami sets no cookies, creates no persistent user identifiers and cannot track individuals across websites or across visits. It collects only anonymous aggregate data: page views, the page address, country, device type and traffic source. For that reason the tool operates regardless of consent, on the basis of the Administrator’s legitimate interest (Art. 6(1)(f) GDPR) in measuring the audience of its own website.

Analytics cookies (the “Analytics” category) — set only after consent is given. The Administrator uses Google Analytics 4, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). They are used to analyse how the site is used: which pages are visited, scroll depth, calculator usage and the effectiveness of the contact form. This category includes in particular:

• _ga — distinguishes individual users (retention: up to 24 months),
• _ga_<property identifier> — maintains session state (retention: up to 24 months).

Marketing cookies (the “Marketing” category) — set only after separate consent is given. They make it possible to show the Administrator’s ads on Google advertising networks to users who have previously visited the site (remarketing) and to measure how effective those ads are. This category includes the _gcl_* cookies (retention: up to 90 days) and covers processing for the purpose of personalising advertising.

If the user consents to none of the optional categories, Google’s scripts are not loaded at all and no request is sent to Google’s servers. Once consent is given, the Administrator applies Google Consent Mode v2, passing Google information about the scope of the consent granted, including consent to the use of data for advertising and ad personalisation.

Transfers outside the European Economic Area — the use of Google tools may involve transferring data, including IP addresses and identifiers stored in cookies, to Google LLC in the United States. Such transfers are based on the European Commission’s implementing decision of 10 July 2023 finding an adequate level of protection under the EU–U.S. Data Privacy Framework, in which Google LLC participates, supplemented by standard contractual clauses approved by the European Commission.

Withdrawing and changing consent — the user may change the scope of their consent or withdraw it entirely at any time using the “Cookie settings” link in the site footer. Withdrawal does not affect the lawfulness of processing carried out before it. Once consent is withdrawn, the cookies set under that category are deleted and the corresponding scripts stop collecting data.

Independently of the above, the user may change their browser’s cookie settings at any time, including blocking cookies entirely or deleting those already stored.

11. Changes to the Privacy Policy

The Administrator reserves the right to make changes to this Policy. Users will be informed of any material changes electronically or through the Application. The current version of the Policy will always be available in the Application.

12. Contact with the Administrator

For matters relating to the processing of personal data, please contact the Administrator at the e-mail address: kontakt@taskforce.guru