Privacy Policy

This is a translation provided for convenience. In case of any discrepancy, the Polish version prevails.

This policy describes how we process personal data in the latweprawko.pl website (the "Service") and in the Łatweprawko mobile app for iOS and Android (the "App"). The Service and the App together make up the Platform; they use the same Account and the same servers, so the rules are shared, and the differences concerning the App are described in section 10. The terms Account and Package have the meaning given to them in the terms of service.

1. Controller and contact

The controller of personal data is PRESSWAY Bartłomiej Paluch, Zarzecze 268, 38-220 Dębowiec, tax identification number (NIP) 6852340178. For matters concerning personal data, write to kontakt@latweprawko.pl or use the Contact page. We are not obliged to appoint a data protection officer (Art. 37 of the General Data Protection Regulation (GDPR, Polish: RODO)) and we have not appointed one.

2. Where we get data from

• From you: when you register, make a purchase, in the settings, in error reports and in messages to us.
• Automatically while you use the Platform: answers to questions, answer times, exam results, technical data about the device and connection (IP address, browser or App version, operating system).
• From login providers (Google, Apple, Facebook): your account identifier with the provider, e-mail address and first name, when you log in through them.
• From the payment operator (ING Bank Śląski S.A.): the transaction identifier and status and the payment method used; we do not receive card or bank account details.
• From app stores (App Store, Google Play): the transaction identifier, the product and the status of the purchase or refund, when you buy a Package in the App. The stores do not pass on payment data or your address to us.
• From public registers: for a purchase for a company, once you enter the tax identification number (NIP), we retrieve the company name and address from the Ministry of Finance's register of VAT taxpayers (wykaz podatników VAT) and from the Central Register and Information on Economic Activity (CEIDG); we do not store the query, we store the data confirmed in the order.

Providing data is voluntary. A first name, e-mail address and password (or an external account) are a condition of the Account contract: without them you cannot create an Account. A first name and e-mail address are a condition of placing an order. The company name, tax identification number (NIP) and address for a purchase for a company are a statutory requirement (the rules on invoices): without them we cannot issue an invoice to a company. Consents (news, cookies) are entirely voluntary and refusing them does not restrict anything.

3. Purposes, legal bases and retention periods

Purpose	Data	Legal basis (GDPR)	How long
Account and provision of services: course, exams, statistics, signs, settings	first name, e-mail, password (hash only), language, category, answers and answer times, results, repetition model, marked signs, notification settings	contract (Art. 6(1)(b))	until the Account is deleted; detailed review of answers in an exam: 24 months (the summary remains in the history), learning session items: 12 months (counters and statistics remain)
Login via Google, Apple, Facebook	identifier with the provider, e-mail, first name, profile picture (if the provider passes it on)	contract (Art. 6(1)(b))	until the external account is unlinked or the Account is deleted
Account security: two-step verification, trusted devices, sessions, protection against abuse and limits	2FA secret and backup codes (encrypted), browser or device name, IP address, login time, session identifier, persistent login token, IP address hash for reports and demo exams	legitimate interest: protecting the Account and the Platform against unauthorised access and abuse (Art. 6(1)(f))	session: until logout or 2 hours of inactivity; persistent login ("Keep me logged in" and login via Google, Apple, Facebook): up to 400 days or until logout; trusted device: 30 days; administrative action log: 12 months; server logs: no longer than 12 months
Free mock exam without an Account	random demo session identifier (only a hash in the database), IP address hash, results and answers	legitimate interest: providing the demo and enforcing the limit (Art. 6(1)(f))	30 days from the last activity; after registration from the same browser, the results are transferred to the Account
Purchase of a Package in the Service, order and payment handling	first name, e-mail, invoice details (for a purchase for a company: name, tax identification number (NIP), address), chosen Package, amount, discount code, transaction identifiers and payment method from the operator, IP address of the order, content of the consents given	contract (Art. 6(1)(b))	orders and invoices: 5 years from the end of the calendar year in which the tax payment deadline for that sale expired (legal obligation, Art. 6(1)(c))
Purchase of a Package in the App (App Store, Google Play)	transaction and product identifier in the Store, purchase status, date, link to the Account	contract (Art. 6(1)(b))	as for orders: 5 years from the end of the calendar year in which the tax payment deadline expired
Invoices, sales records, accounting, taxes	data from the invoice and the order	legal obligation (Art. 6(1)(c)): the VAT Act (ustawa o VAT), the Tax Ordinance (Ordynacja podatkowa)	5 years from the end of the calendar year in which the tax payment deadline expired
Suggesting the company name and address from the tax identification number (NIP) for a purchase for a company	NIP entered in the form	contract, at your request (Art. 6(1)(b))	the query is not stored; the data you confirm in the order is stored
Complaints, withdrawal, refunds, answers to questions	content of the message, e-mail, order data	contract and legal obligation (Art. 6(1)(b) and (c))	until the matter is closed, and then until the limitation period for claims expires (6 years for a Consumer's claims against us, 3 years for our claims, counted to the end of the calendar year)
Reports of errors in questions and explanations	content of the report, context (exam, learning, page), Account (if logged in), IP address hash	legitimate interest: quality of content and protection against abuse of the form (Art. 6(1)(f))	24 months from the report
E-mails about the Account and the contract: address confirmation, password reset, codes, order confirmation with the terms of service, invoice, changes to the terms of service	e-mail, first name	contract (Art. 6(1)(b))	until the Account is deleted
Learning reminders (e-mail, push in the App)	e-mail, push token, time zone, progress data (when the last session took place, overdue repetitions)	contract: a Platform feature switched on and off in the settings (Art. 6(1)(b)); reminders concern only your learning and contain no offers or promotions	until switched off in the settings or the Account is deleted
News and offers	e-mail, first name, language	consent (Art. 6(1)(a) GDPR and Art. 398 of the Electronic Communications Law (Prawo komunikacji elektronicznej)) given in the Account settings, off by default; it can be withdrawn at any time	until consent is withdrawn
Visit statistics for the Service (Plausible)	page address, traffic source, country, device and browser type; without cookies and without a persistent identifier (a daily hash of the IP address and browser, deleted after 24 hours)	legitimate interest: measuring how the Service performs (Art. 6(1)(f))	only in aggregated form, indefinitely
Source of visits to the Service and attribution of registrations and purchases to our campaigns	parameters from the entry address (utm_source, utm_medium, utm_campaign, utm_content, utm_term: name of the campaign, ad group and keyword), information that the visit came from a click on a Google, Meta, TikTok or Microsoft ad (without the click identifier), the domain of the page you came from, and the landing page; stored in the session, with the Account (registration) and with the order, not passed on to advertising providers	legitimate interest: assessing the effectiveness of our campaigns on aggregated data (Art. 6(1)(f))	session: until it expires; with the Account: until it is deleted; with the order: as for order data
Analytics and advertising pixels (Google Analytics, Google Ads, Meta, TikTok)	identifiers from cookies, events (visits, registration, exam start, purchase), device data and IP address	consent (Art. 6(1)(a) GDPR and Art. 399 of the Electronic Communications Law) given in the cookie banner; it can be withdrawn in the footer of the Service	according to the Cookies page; consent is stored for 12 months
Delivery of question multimedia via a CDN	IP address and connection data in the CDN provider's logs	legitimate interest: fast and secure delivery of files (Art. 6(1)(f))	according to the provider's log retention, no longer than 12 months
Establishing, pursuing and defending claims, security audit	data from the rows above to the extent necessary	legitimate interest (Art. 6(1)(f))	until claims become time-barred

After an Account is deleted, the Account data is anonymised (we replace the first name and e-mail with placeholder values and delete the password, external accounts and push tokens), learning data together with the answer log is deleted, and exam results remain without any link to a person and without an IP address, solely for aggregated statistics. Orders and invoices are kept for the period required by tax law.

4. Profiling and automated decisions

The question selection algorithm (FSRS) analyses your answers in order to schedule repetitions and estimate your chance of passing. It works solely for learning purposes, does not assess you as a person and does not produce legal effects. We do not make decisions about you based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Advertising tools operating with your consent may profile you for advertising purposes with their providers; this is described on the Cookies page.

We do not pass users' data to artificial intelligence tools. AI tools support only the editorial team's work on the content of questions, explanations and translations, and every suggestion is approved by a human.

5. Recipients of data

We entrust or disclose data only to entities that are needed for the Platform to operate. Entities marked (P) process data on our behalf under a data processing agreement (Art. 28 GDPR); the others are separate controllers or joint controllers within their own scope.

• Hosting and infrastructure (P): the provider of the server on which the Platform runs (a data centre in the European Union); Cloudflare, Inc. (USA) for storing question multimedia, PDF invoices and backups and as a content delivery network.
• Payments in the Service: ING Bank Śląski S.A., ul. Sokolska 34, 40-086 Katowice, as the operator of the ING Pay gateway. The bank is a separate controller of the payer's data as regards executing the payment; the rules are described in its terms and its information on data processing. We issue invoices in the ING Księgowość service (ING Usługi dla Biznesu S.A., ul. Chorzowska 50, 40-121 Katowice) (P).
• App stores: Apple Distribution International Ltd. (Hollyhill Industrial Estate, Cork, Ireland) and Google Commerce Limited (70 Sir John Rogerson's Quay, Dublin 2, Ireland) as separate controllers settling purchases in the App on their own terms; we receive only the transaction confirmation.
• External login: Google Ireland Limited, Apple Distribution International Ltd., Meta Platforms Ireland Limited, when you choose to log in through them (separate controllers as regards their accounts).
• Push notifications in the App (P): Expo (650 Industries, Inc., USA) as an intermediary service that stores the device token and the content of the notification only until it is delivered, and Apple (APNs) and Google (FCM) as providers of notification systems.
• E-mail (P): the provider of the e-mail sending service that delivers our messages.
• Statistics (P): Plausible Insights OÜ (Tartu, Estonia), cookieless analytics, data on servers in the European Union.
• Analytics and advertising with consent: Google Ireland Limited (Google Analytics 4, Google Ads) is a separate controller of the data collected by its tools. With Meta Platforms Ireland Limited (Meta Pixel) and with TikTok Technology Limited and TikTok Information Technologies UK Limited (TikTok Pixel) we are joint controllers as regards collecting events in the Service and transmitting them to those providers: we are responsible for obtaining consent and providing information, and the providers are responsible for further processing on their side and for handling your rights in relation to their systems. The essence of the arrangements: Meta - facebook.com/legal/controller_addendum, TikTok - tiktok.com/legal/page/global/tiktok-analytics-joint-controller-addendum/en. The Meta and TikTok scripts load only after consent; the Google script runs before consent in the denied mode described on the Cookies page.
• Accounting and legal services (P): an accounting office or adviser, if we use one, as regards invoices and disputes.
• Public authorities: where required by law (e.g. tax authorities, courts, the Police) on the basis of a proper request.

6. Transfers of data outside the European Economic Area

Some providers have their registered offices or servers also outside the EEA, including in the USA. We transfer data to Cloudflare, Inc. and 650 Industries, Inc. (Expo) on the basis of the European Commission's adequacy decision of 10 July 2023 (EU-U.S. Data Privacy Framework), under which both companies are certified (list: dataprivacyframework.gov/list), and additionally on the basis of the standard contractual clauses in their data processing agreements. Google, Meta, TikTok and Apple serve us through companies based in Ireland; any onward transfer of data to the USA or other countries takes place under their responsibility: Google LLC and Meta Platforms, Inc. are DPF certified, Apple and TikTok use standard contractual clauses, and TikTok may also transfer data to other countries in which its group operates (including China), in accordance with its privacy policy. We apply additional safeguards: encryption in transit and at rest, and data minimisation. You can obtain a copy of the safeguards by writing to us.

7. Your rights

You have the right to:

• access your data and receive a copy of it,
• rectify your data (you can change your first name, e-mail, language and category in the settings),
• erasure of your data (you can delete your Account in the settings after entering your password, or without a password if you log in only via Google, Apple or Facebook, or by writing to us; we keep invoice data for the period required by tax law),
• restriction of processing,
• data portability: in the settings you can download a JSON file with your Account data, orders, exam history and learning history,
• withdraw consent at any time (news: Account settings; cookies: the "Cookie settings" link in the footer of the Service); withdrawal does not affect the lawfulness of processing carried out before the withdrawal; you can switch off reminders in the Account settings, in the App or in your phone's system settings,
• lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, Prezes UODO) (ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl).

Right to object. You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interest (section 3). After you object, we will stop processing the data for that purpose unless we demonstrate compelling legitimate grounds that override your interests or the need to establish, pursue or defend claims.

We respond to requests without undue delay, within one month, and in complex cases within up to 3 months; we will inform you of any extension. We may ask you to confirm your identity, e.g. by sending a message from the e-mail address assigned to the Account.

8. Security

We store passwords only as hashes (bcrypt). Connections to the Platform are encrypted (HTTPS), and App tokens are stored in the operating system's secure storage (Keychain, Keystore). Two-step verification secrets are encrypted, and demo session and trusted device tokens are stored only as hashes. Only authorised persons have access to the data, and actions in the administration panel are logged. Backups are stored in storage encrypted at rest, accessible only to the administrator. In the event of a personal data breach that is likely to result in a high risk to your rights, we will inform you in accordance with Art. 34 GDPR.

9. Children

A person who is at least 16 years old may create an Account on their own. A younger person (e.g. one preparing for category AM) may use an Account if a parent or guardian accepts the terms of service on their behalf. The consents we ask for in the Service (news, analytics and marketing cookies) are valid for a person under 16 only if they are given or authorised by a parent or guardian (Art. 8 GDPR). We do not verify age and do not knowingly collect data of children under 16 without such consent; if we learn that an Account of a person under 16 is being used without a guardian's consent, we will delete it. If you are a parent and have any questions, write to kontakt@latweprawko.pl.

10. Mobile app

• What the App collects: Account data (first name, e-mail, Account identifier), learning data (answers, times, results), history of purchases in the Store (transaction identifier, product, status), notification data (push token, platform, device name, App and operating system version, language, time zone, so that reminders are sent at a reasonable time) and technical connection data (IP address in server logs). The App does not collect location, contacts, the advertising identifier or data from other apps, and contains no third-party analytics or advertising SDKs.
• Permissions: the App asks only for permission to send notifications. It does not use location, contacts, the camera, the microphone or photos.
• Push token: we delete it after logout and when the Account is deleted; a token marked by the system as inactive (App uninstalled or notifications switched off) is deleted after 30 days.
• Purchases: these are handled by the App Store and Google Play. We do not see your card number or your Store account details; we receive only the transaction identifier, the product and the status. Apple and Google may provide us with aggregated sales statistics and crash reports if you enable the sharing of such data in your phone's settings.
• Stores as controllers: downloading the App, ratings, reviews, payments and refunds take place within your relationship with Apple or Google, under their privacy policies.
• No cookies: the App does not use cookies. It stores the login token and settings locally on the phone; they are removed when you log out or uninstall the App.
• Advertising: the App currently contains no advertisements or advertising SDKs. If in the future we introduce advertisements in the free part of the App, before doing so we will update this policy and describe the providers and the data (e.g. the device's advertising identifier), and we will switch on personalised advertisements only with your separate consent given in the App (on iOS also in the system App Tracking Transparency prompt).
• Store listings: the information in the "App Privacy" (App Store) and "Data safety" (Google Play) sections corresponds to this policy.

11. Cookies

The rules for using cookies and similar technologies in the Service (including browser storage), the list of cookies, their lifetime and how to change your consent are described on the Cookies page.

12. Changes to this policy

This policy may be updated as the Platform, providers or the law change. We will inform you of material changes (e.g. a new category of recipients, advertisements in the App) by e-mail or on the Platform before they take effect. The current version applies from 01.10.2026.