Privacy Policy

The personal data controller is:
Patron
ul. Rodzinna 9/13 53-029 Wrocław
NIP: 577-167-37-39
REGON: 931989846
Email: biuro@grupabiwakowa.pl
The controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)

 

The administrator of the data for the Account created in the Application and on the Website remains Patron. With respect to in-app purchases, the Google Play (Google Ireland Ltd.) and Apple App Store (Apple Distribution International Ltd.) stores act as separate data controllers, in accordance with their own privacy policies.

Personal data are processed for the purpose of:

• creating and managing a user account,
• enabling the use of application features,
• enabling the publication of places, comments, photos and other content,
• displaying maps and places near the user,
• ensuring application security,
• preventing abuse,
• analyzing application performance,
• displaying advertisements,
• handling user reports.
• processing payments for the Premium Account purchased via the Website, issuing and storing invoices, and handling complaints and refunds.

Personal data are processed on the basis of:

• Art. 6(1)(b) GDPR – for the purpose of providing services,
• Art. 6(1)(f) GDPR – for the purpose of ensuring the security and proper functioning of the application,
• Art. 6(1)(a) GDPR – where consent has been given, in particular regarding advertisements or optional features.
• Art. 6(1)(c) GDPR – compliance with the Administrator's legal obligations, in particular those arising from tax and accounting regulations (invoices, settlements)

The controller may process the following data:

Account Data

• email address,
• username,
• user identifier,
• external account identifier (Google, Facebook, Apple).

When logging in via external providers, the controller receives only the data necessary to identify the user.

Billing data (purchases via the Website)

• first and last name
• company name
• address
• tax ID (NIP, optional)
• information about the purchased package and amount. 

The Administrator does not store full payment card data – this is handled by the payment provider.

Data Published by the User

The user may voluntarily publish:

• camping spots,
• comments,
• photos,
• descriptions,
• locations of places.

This data may be publicly available to other users.

Location Data

The application may process the user's location data for the purpose of:

• displaying the user's position on the map,
• enabling the addition of a new place.

Location is saved on the server only when the user voluntarily adds a place. For premium users, session data may be saved, including:

• approximate location,
• IP address,
• user-agent.

This data is stored for a maximum of 90 days.

Technical Data and Logs

The controller may process technical data such as:

• IP address,
• device identifier,
• operating system,
• application version,
• user-agent,
• error logs.

The IP address may be recorded in particular during:

• logging in,
• adding comments,
• using the application.

Logs are stored for a maximum of 90 days. Backups are stored for a maximum of 14 days.

The application and website may use:

• cookies,
• device identifiers,
• advertising identifier (Android Advertising ID, Apple IDFA),
• session tokens,
• similar technologies.

These technologies are used for the purpose of:

• ensuring the proper functioning of the application,
• maintaining the user session,
• analyzing application performance,
• displaying advertisements,
• preventing abuse.

The user may restrict or disable the advertising identifier in their device settings.

The application may send push notifications to inform the user about new features, places, application activity and other relevant information related to the use of the Service.

For this purpose, a unique notification identifier assigned to the user's device may be processed (e.g. Firebase Cloud Messaging token or Apple Push Notification token).

Push notifications are sent only with the user's consent, which can be withdrawn at any time in the device or application settings.

The notification token may be stored until the user account is deleted, the application is uninstalled, or consent to receive notifications is withdrawn.

The application uses Google AdMob to display advertisements. Google may use:

• advertising identifier,
• IP address,
• device information,
• information about application usage.

Data is processed in accordance with Google's privacy policy.

The application uses analytics tools:

• Firebase Analytics,
• Google Analytics.

These tools help analyze how the application is used and improve its performance.

Data may be processed by the following entities:

• ADMIN.NET.PL S.C. – backend server hosting
• Google LLC – Firebase Analytics, Google Analytics, Google AdMob
• Stripe Payments Europe, Ltd. (Ireland) together with its affiliates, including Stripe, Inc. (USA) – payment processing for purchases on the Website.
• Google Ireland Ltd. and Apple Distribution International Ltd. – with respect to in-app purchases, they process payment data as separate controllers, in accordance with their own privacy policies.
• RevenueCat, Inc. (USA) – subscription management and validation of in-app purchases (processes the app user identifier, subscription status and history, device identifiers and IP address).
• Mapbox Inc. – map services
• OpenStreetMap Foundation – map data

These entities process data in accordance with applicable law.

Data may be transferred outside the European Economic Area, in particular to Google LLC and Mapbox Inc. The transfer takes place in accordance with appropriate legal safeguards, in particular Standard Contractual Clauses.

Data provided to the payment provider (Stripe) and to the subscription management provider (RevenueCat) may be transferred to the USA on the basis of the Standard Contractual Clauses approved by the European Commission and, to the relevant extent, the EU-U.S. Data Privacy Framework.

Data is stored for the following periods:

• account data – until account deletion,
• logs – up to 90 days,
• backups – up to 14 days,
• session data of premium users – up to 90 days.
• Billing data and invoices – 5 years counted from the end of the calendar year in which the tax obligation arose (tax and accounting regulations).

The user may delete their account:

• from within the application, or
• by sending a message to kontakt@grupabiwakowa.pl

Data is deleted immediately or within 14 days.

Providing data is voluntary but necessary to use the application.

The user has the right to:

• access to data,
• rectification of data,
• erasure of data,
• restriction of processing,
• objection to processing,
• data portability,
• lodging a complaint with the President of the Personal Data Protection Office.

The application allows login via:

• Google,
• Facebook,
• Apple.

During login, the controller receives basic user identification data, such as email address and user identifier.

Content published by the user is voluntary and may be publicly available.

The controller applies appropriate security measures, including:

• SSL/TLS encryption,
• server security,
• access control,
• minimization of processed data.

Data is not used for automated decision-making that produces legal effects concerning the user.

The controller may update this privacy policy. The user may be informed of changes via the application or website.

For matters relating to personal data, you may contact us at: kontakt@grupabiwakowa.pl