Privacy Policy

Effective date: 10 October 2026

This policy explains what personal data is processed when you use polskiebarymleczne.pl (the "site"), why, on what legal basis, for how long, who receives it, and what rights you have.

1. Who is responsible for your data

The site is run under the name Polskie Bary Mleczne from Gdańsk, Poland ("we", "us"). We are the controller of the personal data described in this policy within the meaning of the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR").

For any question about your data or to exercise your rights, write to kontakt@polskiebarymleczne.pl.

We have not appointed a data protection officer, as the law does not require one for an operation of this kind.

2. Summary

• We collect only the personal data the site needs to work, to answer you, and to meet our legal obligations.
• We do not sell personal data, and we do not use it for profiling or for decisions made solely by automated means.
• We do not use advertising cookies or cross-site tracking.
• Our visitor statistics use no cookies and do not identify you.
• You may ask to see, correct or delete your data at any time.

3. What we process and why

Visiting the site

When you open a page, your browser automatically sends technical data: your IP address, the date and time of the request, the page requested, the page you came from, your browser and operating system, and your device type.

• Purpose: to deliver the site to you, keep it secure, and protect it against attacks, abuse and errors.
• Legal basis: our legitimate interest in operating a secure and working website (Article 6(1)(f) GDPR).
• Retention: we do not keep server logs ourselves. Our hosting and security provider keeps security logs for a limited period, after which they are deleted or anonymised.

Visitor statistics

We use Cloudflare Web Analytics to count visits and see which pages are read. It does not use cookies, does not store data on your device, does not use fingerprinting, and does not follow you across other websites. It records the page viewed, the referring page, your country (derived from your IP address, which is not stored), your browser and device type, and how fast the page loaded.

• Purpose: to understand which content is useful and to keep the site fast.
• Legal basis: our legitimate interest in improving the site (Article 6(1)(f) GDPR).
• Retention: the statistics are aggregated and do not allow us to identify you.

Maps

Maps on the site are drawn from map tiles provided by OpenStreetMap and CARTO. To show the map, your browser requests the tiles directly from these providers, which receive your IP address and the map area being viewed. The map software is loaded from unpkg.com, which receives your IP address when delivering it. Links to directions open Google Maps only when you click them, and Google's privacy policy applies from that point.

• Purpose: to show where places are.
• Legal basis: our legitimate interest in providing a working map (Article 6(1)(f) GDPR).

When you contact us

If you write to us or use the contact form, we receive your name, your email address, your message and anything else you choose to include.

• Purpose: to read and answer your message and deal with your request.
• Legal basis: our legitimate interest in answering the people who write to us (Article 6(1)(f) GDPR); where your message concerns a purchase, the performance of a contract (Article 6(1)(b) GDPR).
• Retention: for as long as needed to deal with your request, and then for up to two years in case of follow-up questions or legal claims.

Our email is handled by an email service provider that processes messages on our behalf.

Suggestions for the site

If you suggest a milk bar for the guide, we use the information about it to check it and, where suitable, to publish it on the site. We never publish your name or email address.

• Legal basis: our legitimate interest in keeping the site complete and accurate (Article 6(1)(f) GDPR).
• Retention: your contact details are kept as described under "When you contact us".

Our app

Our mobile app, Polskie Bary Mleczne, is part of this service, and this policy covers it. It works without an account, shows no adverts and contains no analytics or tracking tools of our own.

• Loading the guide: the app downloads its data and pictures from polskiebarymleczne.pl, through the same hosting provider as the site, which receives your IP address and device type when delivering them, as described under "Visiting the site".
• On your phone only: your saved places, your language and settings, and a copy of the guide for use offline are stored on your device and never sent to us. Uninstalling the app or clearing its data deletes them.
• Location: if you tap "Near me" and allow it, the app uses your phone's location to sort places by distance. This happens on your phone: your location is not sent to us and not stored. You can refuse or withdraw the permission in your phone's settings, and the rest of the app keeps working.
• Maps on Android: the map in the Android app is provided by Google Maps, a service of Google Ireland Limited. To show it, Google receives your IP address, the map area and information about your device. The map component also sends Google crash reports, technical diagnostics, an identifier of the component and how the map is moved and zoomed, which Google uses to run and improve its service; we do not receive this data. The Google Privacy Policy (policies.google.com/privacy) applies to this use, and the Google Maps terms apply to the map.
• Directions, calls and email: "Navigate", phone numbers and the report link hand you over to your maps, phone or email app. What you send from there is covered by "When you contact us" and by those apps' own policies.
• Legal basis: our legitimate interest in providing the app you chose to install (Article 6(1)(f) GDPR). Location is used only with the permission you give, and control in your phone's settings.

4. Who receives your data

We share personal data only where needed for the purposes above, and only with:

• our hosting, security and content delivery provider;
• our email service provider;
• our statistics provider;
• the map providers described above;
• Google, for the map in the Android app, as described above;
• professional advisers, and public authorities where the law requires it.

Service providers that process data on our behalf do so under a contract that obliges them to follow our instructions and protect the data (Article 28 GDPR). We do not sell or rent personal data. If you ask, we will tell you the names of the specific recipients of your data.

5. Transfers outside the European Economic Area

Some of our providers are based in, or process data in, countries outside the European Economic Area, including the United States. Where the European Commission has not recognised a country as providing adequate protection, the transfer takes place under the EU-US Data Privacy Framework for certified recipients, or under the standard contractual clauses approved by the European Commission (Articles 45 and 46 GDPR). You may ask us for more information about these safeguards.

6. Cookies and storage on your device

We do not place cookies on your device, and we do not use cookies for statistics or advertising. For that reason the site shows no cookie banner.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased, where there is no longer a reason for us to keep it;
• restrict our processing, for example while you contest its accuracy;
• receive data you gave us in a structured, machine-readable format and have it transferred to someone else, where the processing is based on consent or a contract;
• object to processing based on our legitimate interests, on grounds relating to your particular situation, and at any time to processing for direct marketing;
• withdraw your consent at any time, where processing is based on consent. This does not affect the lawfulness of processing before the withdrawal.

To exercise any of these rights, write to kontakt@polskiebarymleczne.pl. We may ask you to confirm your identity. We will reply within one month of receiving your request. Where a request is complex, this period may be extended by two further months, and we will tell you so within the first month. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where you believe the infringement took place. The authority in the country from which we operate is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), uodo.gov.pl. We would appreciate the chance to address your concern first.

8. Whether you have to give us your data

The technical data sent by your browser is needed to deliver the site. We need your email address to answer you. Everything else you give us is voluntary.

9. Automated decisions

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

10. Children

The site is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, write to us and we will delete it.

11. Security

The site is served only over an encrypted connection (HTTPS). Access to personal data is limited to what each purpose requires, and we choose providers that apply appropriate technical and organisational security measures.

12. Visitors from the United States

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act. The site does not track visitors across third-party websites, so it treats every visitor the same whether or not the browser sends a "Do Not Track" signal.

13. Changes to this policy

We may update this policy when our services or the law change. The effective date at the top shows when it was last changed. Where a change is significant, we will say so on the site.

14. Contact

Polskie Bary Mleczne, Gdańsk, Poland. Email: kontakt@polskiebarymleczne.pl.