Privacy Policy

§ 1. Data controller

The controller of the personal data processed in the gorzko.app website and in the app.gorzko.app application (together: the “Service”) is Codewarbler spółka z ograniczoną odpowiedzialnością (a limited liability company) with its registered office in Hadykówka, address: Hadykówka 140, 36-105 Cmolas, entered in the register of entrepreneurs of the National Court Register (Krajowy Rejestr Sądowy) kept by the District Court in Rzeszów, XII Commercial Division of the National Court Register, under KRS number 0001174966, NIP (tax identification number) 8141702783, REGON 541845968 (the “Controller”).

Contact in all matters concerning personal data: [email protected] or in writing to the address of the registered office. The Controller has not appointed a data protection officer; it is not required to do so.

Capitalised terms (including Organiser, Guest, Event and Content) have the meaning given to them in the Terms.

§ 2. Purposes, legal bases and periods of processing

a) Contact form on gorzko.app

Scope: email address. Purpose: handling the enquiry and helping to set up the album, including sending an automatic confirmation. Legal basis: Art. 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract) and Art. 6(1)(f) GDPR (legitimate interest — conducting correspondence). Period: until the enquiry has been handled, but no longer than 12 months from the last contact.

b) Organiser account and payments

Scope: name, email address, password (stored solely in the form of a bcrypt cryptographic hash), data about Events and, in the case of a purchase, the payment history (amount, PayU transaction number, status, the moment at which the request to begin performance of the service before the expiry of the period for withdrawal from the contract was made) and the IP address transmitted to PayU together with the order. Purpose: concluding and performing the contract for the provision of services by electronic means, including verification of the email address, password recovery, messages necessary for the operation of the service and the handling of payments. Legal basis: Art. 6(1)(b) GDPR; accounting records — Art. 6(1)(c) GDPR; establishment and defence of claims — Art. 6(1)(f) GDPR. Period: until the account is deleted (on request, in accordance with the Terms) and, after its deletion, for the limitation period of any claims. Data covered by accounting records are stored for 5 years, counted from the end of the calendar year in which the tax payment deadline expired.

c) Guest list and RSVP answers

Scope: the name of the invitation, the first names and surnames of the invited persons, the kind of person (adult, child, accompanying person), the answer to the invitation and its date, information about diet, a message to the Couple, the Organiser’s notes, the group and the seat at a table. Source: the data are entered by the Organiser (manually or by pasting a table); the answer, the diet, the name of the accompanying person and the message may be completed by the invited person themselves through the link to their invitation. Purpose: enabling the Organiser to prepare the wedding — keeping the guest list, collecting answers, planning the room and the seating, and printing the table plan and place cards; the QR code on a place card allows the person named on it to join the album. Legal basis:Art. 6(1)(f) GDPR (the legitimate interest of the Organiser and the Controller — organising the wedding to which the person has been invited). Information about diet serves solely to prepare the meal. The RSVP form asks about menu preferences; information about one’s state of health should not be provided in it. If a person nevertheless provides such information, it is used solely to prepare the meal; the Organiser should not enter such information without that person’s consent. The invited person may remove the information about diet by changing their answer until the answer deadline set by the Couple expires and, after it has expired, by contacting the Organiser or the Controller (§ 5). Period:until the data are deleted by the Organiser or until they are deleted at the request of the Organiser or of the person concerned (§ 5). The Controller does not delete these data on its own initiative after a specified period of time.

d) Album Guests

Scope: first name (display name), telephone number, added photos, videos and captions, avatar, reactions, an optional PIN (stored solely as a bcrypt hash), story views, information about the telephones on which the Guest uses the album (the type of device read from the browser, the date of last use), and related metadata. Purpose: providing the shared album service — identifying the Guest within the Event, signing in on another telephone and making Content available to the participants of the Event. The telephone number serves to recognise the Guest and — when verification by SMS code is enabled — to send them a one-time SMS code (see letter e); the Controller does not send any other messages to this number, in particular marketing messages, and does not make calls. Legal basis: Art. 6(1)(b) GDPR (the contract for the provision of the service of participation in the Event) and Art. 6(1)(f) GDPR (the security of the album). Period:until deleted at the request of the Organiser or of the data subject (§ 5). The Controller does not delete these data on its own initiative after a specified period of time. Content deleted by a Guest or hidden by the Organiser immediately ceases to be visible in the album, but its file remains on the server — and is accessible at its direct address to anyone who knows that address — until it is deleted upon the request described in § 5. Removal of a Guest from the album by the Organiser hides their Content, signs them out of all telephones and blocks their telephone number so that they cannot rejoin the same Event; the remaining data of their account and their Content are stored on the terms described above.

e) Verification of the telephone number by SMS code

The SMS sending provider processes data on behalf of the Controller under a data processing agreement (Art. 28 GDPR) concluded on the terms of the regulations (terms of service) of the SMS-fly.pl service. As long as verification by SMS code is not enabled, the telephone number is not verified, no SMS messages are sent, and the data described in this point are not collected. Scope: telephone number, Event, a one-time six-digit code (stored solely as an HMAC hash, valid for 10 minutes, at most five attempts), an identifier of the telephone on which the code was requested (in the form of a hash), and a log of sent messages: number, Event, purpose (joining or signing in), the message identifier at the provider, cost, status and delivery report. The log does not contain the code. Purpose: confirming that the person joining the album or signing in on a new telephone has access to the number provided — so that nobody can enter the album as another person — as well as limiting abuse (limits on the number of messages) and settling the costs of sending. The message comes from the sender “gorzko.app”; the code is sent only to numbers from Poland, the other States of the European Economic Area and the United Kingdom. Legal basis: Art. 6(1)(b) GDPR (signing in to the service) and Art. 6(1)(f) GDPR (security of accounts and prevention of abuse). Period: codes — 7 days from sending; the log of sent messages — 90 days from sending.

f) Security and technical data

Scope: IP address (used for limits on the number of requests and by Cloudflare), date and time of the request, the address of the page requested. Purpose: ensuring the security and continuity of operation of the Service, including limits on the number of requests, detection of abuse and fixing of failures. Legal basis: Art. 6(1)(f) GDPR. Period: server logs are stored for up to 30 days, and request-limit data for up to one hour. Backup copies of databases and files are stored for up to 14 days; therefore data deleted from the Service disappear from the backup copies no later than after that time.

g) Visit statistics (Google Analytics 4)

Scope: data on the use of the gorzko.app website collected by means of cookies — only after consent has been given in the banner. Before consent is given, the Google Analytics script is not loaded and no data reach Google. Purpose: statistics and development of the Service. Legal basis: Art. 6(1)(a) GDPR in conjunction with Article 399(1) of the Electronic Communications Law Act of 12 July 2024 (ustawa z dnia 12 lipca 2024 r. — Prawo komunikacji elektronicznej) (consent). Period: consent is valid for 6 months, after which we ask for it again; the Google Analytics cookies expire together with it. Data collected on the basis of consent are stored in Google Analytics for no longer than 14 months; withdrawal of consent stops further collection and removes the Google Analytics cookies from the browser.

§ 3. Recipients of data

1. Data are stored on the Controller’s servers located in Germany (European Economic Area).

2. The recipients of the data are entities processing them on behalf of the Controller: Cloudflare, Inc. (protection and delivery of network traffic, including album files), Karolina Fiuk conducting business activity under the business name PUH Karolina Fiuk (hostline.pl) with its registered office in Lębork (electronic mail), PROMOHUB sp. z o.o. with its registered office in Warsaw (KRS 0001077455), the operator of the SMS-fly.pl service (sending of SMS codes, from the moment the verification described in § 2 letter e is enabled), and — solely to the extent covered by consent — Google Ireland Ltd. (statistics). An SMS message is, in addition, delivered by the operator of the mobile network in which the recipient’s number operates.

3. Payment data are processed by PayU S.A. with its registered office in Poznań, which, as regards the execution of payments, is a separate controller of the data and provides information about this in its privacy policy.

4. As part of the service, data are seen by other users: the Organiser — the guest list with the answers and the album accounts (first name, telephone number, the telephones on which the Guest uses the album, and Content); the participants of the Event — the Guest’s first name, avatar, reactions and Content.

5. Data may be disclosed to public authorities authorised under the provisions of law. The Controller does not sell personal data.

§ 4. Transfer of data outside the EEA

1. In connection with the use of the services of Cloudflare and Google, data may be transferred to the United States. The basis for the transfer is the decision of the European Commission finding an adequate level of protection under the EU-U.S. Data Privacy Framework (both providers hold active certification) and, supplementarily, the standard contractual clauses referred to in Art. 46(2)(c) GDPR.

2. An SMS code sent to a number in the United Kingdom numbering range (+44) is delivered by an operator in the United Kingdom or on the Isle of Man, Jersey or Guernsey — for each of these territories a decision of the European Commission finding an adequate level of protection is in force. The SMS sending provider handles sending from servers in Germany; according to its privacy policy, any transfer of data outside the European Economic Area takes place with the application of appropriate safeguards, including the standard contractual clauses referred to in Art. 46(2)(c) GDPR. Information about these safeguards can be obtained by writing to [email protected].

§ 5. Rights of data subjects

1. Every person has the right of access to the data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to portability of data processed on the basis of a contract or consent (Art. 20). Every person also has the right to object at any time to the processing of their data on the basis of Art. 6(1)(f) GDPR, on grounds relating to their particular situation (Art. 21 GDPR). Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal.

2. A request may be sent to [email protected] or in writing to the address of the registered office. The Controller responds without undue delay, and no later than within one month, and may ask for information needed to confirm identity — for example, the telephone number and the name of the Event. A person on a guest list may also contact the Organiser directly, who may correct or delete their data.

3. The data subject has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa (uodo.gov.pl).

§ 6. Voluntary provision of data

Providing data is voluntary but necessary, respectively, for: handling the enquiry (the form), creating an account (Organiser) or taking part in the album of an Event (Guest) — including providing a telephone number and, when verification by SMS code is enabled, a number on which an SMS code can be received. The answer to the invitation and the information about diet are voluntary. Consent to statistics is entirely voluntary and is not a condition for using the Service.

§ 7. Automated decision-making and profiling

The Controller does not take decisions concerning persons based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect those persons (Art. 22 GDPR). The proposed seating of guests is merely a suggestion for the Organiser, who decides whether to apply it.

§ 8. Children

The Service is not directed at children. The guest list may contain the names of children entered by the Organiser, and Content in the album may depict children present at the wedding. The rights of a child with regard to their data are exercised by their parents or guardians, including by requesting the deletion of Content in the manner described in § 5. Content may also depict other persons present at the wedding; the source of these data is the Guest who added the Content.

§ 9. Cookies and similar technologies

1. The gorzko.app website uses two categories of storage on the device:

a) necessary — one entry in the browser’s storage (localStorage, key gorzko.consent) storing the decision concerning cookies, its date, the manner in which it was expressed and the version of the consent window; the entry is not sent to the Controller or to anyone else and ceases to be valid after 6 months or after a change in the version of the window — the website then asks again. It does not require consent (Art. 399(3)(2) of the Electronic Communications Law);

b) analytical — Google Analytics 4 cookies (provider: Google Ireland Ltd.): _ga, distinguishing browsers, and _ga_9Q6Z1SWJ48, storing the state of the visit; they are stored only after consent has been given and expire together with it, no later than after 6 months. Google advertising signals are disabled. The transfer of data to the USA is described in § 4.

2. On the first visit, the website asks for consent; the “Accept all” and “Reject all” buttons are equivalent, and in “Settings” the categories can be chosen. Closing the consent window (with the “×” button or the Esc key) means that no consent is given. Consent may be changed or withdrawn at any time by clicking “Cookie settings” in the footer of the home page, below the Terms, or here: Cookie settings. Withdrawal of consent immediately disables statistics in all open tabs of the website and removes the Google Analytics cookies. The app.gorzko.app application does not use analytical or advertising cookies; it uses only technical storage of the session and settings in the browser’s storage, which is necessary for the operation of the service (Art. 399(3)(2) of the Electronic Communications Law).

§ 10. Changes to the policy

The Controller informs about material changes to this policy on this page and, in the case of account holders, also by electronic mail. The current version applies from the date indicated at the beginning.

§ 11. Changes in this version

Compared with the version of 18 August 2026: verification of the telephone number by SMS code and the SMS sending provider have been added (§ 2 letter e, § 3, § 4); the guest list and RSVP answers (§ 2 letter c), payments through PayU (§ 2 letter b, § 3) and logs and backup copies (§ 2 letter f) have been described; it has been clarified how album Content is deleted (§ 2 letter d) and how to submit requests (§ 5); § 8 on children has been added; Google Analytics is loaded only after consent has been given, consent is valid for 6 months, and consent can be changed or withdrawn in the “Cookie settings”, which describe both categories of storage (§ 2 letter g, § 9); the legal basis for cookies has been updated to the Electronic Communications Law Act; the address of the President of the PUODO has been updated.