PRIVACY POLICY (GDPR)

Last updated: 2026-03-15

1. Data Controller

The controller of your personal data is VXN Marcin Gański, NIP: 589-188-66-04, REGON: 221944780, based at ul. Myśliwska 33F lok. 125, 80-283 Gdańsk, Poland. For any data protection inquiries, please contact: [email protected].

2. What data do we process and why?

The Application processes your data for the following purposes:

• Service Provision (registration and login): Email address, name (or pseudonym), hashed password, social media identifiers (if logging in via Google/Apple/Facebook).
  Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).
• Communication and Notifications: Device tokens (FCM) for Push notifications, email address for authorization codes.
  Legal basis: Performance of a contract and legitimate interest of the Controller (Art. 6(1)(b) and (f) GDPR).
• Group Data (UGC): Content of posts, polls, comments, children's names, fundraiser status, and photos. The Controller processes this data on behalf of Users solely for the technical maintenance of the Application.
• Analytics and App Improvement: Anonymous data on how the Application is used.
  Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).

3. Data Recipients and Transfer outside the EEA

To operate the Application, we use trusted providers to whom we may outsource data processing:

• Contabo GmbH: Database and API server hosting (servers located within the European Economic Area - EEA).
• home.pl S.A.: Email infrastructure for system notifications (servers in Poland).
• Google Ireland Limited / Apple Distribution International / Meta Platforms Ireland Limited: Social login, analytics (Google Analytics), and Push notifications (Firebase).

Note on transfers: Some US-based providers (e.g., Google, Meta) may transfer some technical data outside the EEA. This is always done based on Standard Contractual Clauses (SCC) approved by the European Commission or within the Data Privacy Framework.

4. Data Security (Privacy by Design)

We implement the highest security standards to protect your privacy. Passwords and key contact/identification data in the database are cryptographically encrypted, and searching is performed using blind indexes, minimizing the risk of exposure in the event of a security breach.

5. Your Rights

Under the GDPR, you have the following rights:

• The right to access your data and obtain a copy.
• The right to rectify (correct) your data.
• The right to erasure (the right to be forgotten) – you can do this yourself in the App Settings.
• The right to restrict processing.
• The right to object to processing.
• The right to lodge a complaint with a supervisory authority (e.g., the President of the Personal Data Protection Office in Poland).

6. Data Retention

We store your data until you delete your account in the Application. Upon deletion, your authentication data is permanently removed, and content you generated (posts, comments) may be anonymized (assigned to a "Deleted User" account) to maintain the integrity of communication history for other Class members.