Privacy policy

The controller of the data is [NAZWA FIRMY], tax number [NIP], [ADRES]. Contact for data matters: xpomoc@wp.pl.

Who uses the service

Guests do not create an account. Sellers give the name of the display, the city, a telephone number and a password, and they add offers. The operator signs in with a separate access.

What data we process

• a seller’s account: name, city, voivodeship, telephone, password hash, delivery and collection, a description of the area, the chosen subscription, the date paid, acceptance of the terms, status, and dates
• offers: name, description, price, photograph
• a seller’s or operator’s session: a cookie needed to stay signed in
• the city a guest chooses, and a few recently opened cities: only in that browser

We remove metadata from photographs, including the location stored by the camera. Passwords are stored only as a hash (scrypt) — they cannot be read back.

Location

The button “Use my location” asks the browser for permission. The coordinates are used only on the guest’s device to point to the nearest Polish city. We do not send them to the server and we do not store them in the database. Without permission, please type the city. The city list is in the application, without asking an outside service.

The chosen city, and a few recently opened cities, stay locally in the browser (localStorage). The current city is also in a technical cookie, so the display can be shown at once. An address with the city parameter (opened from another application in the family) sets the same city. These do not enter the account database.

Why, and on what basis

• running a seller’s display — Article 6(1)(b) GDPR (a contract for the service)
• security of sign-in and defence of claims — Article 6(1)(f) GDPR
• the operator’s legal duties, if they arise — Article 6(1)(c) GDPR

We do not sell data. We do not use tracking tools.

Whom we pass data to

The host on which the service runs. A seller’s telephone number is visible to guests as the way to order — that is the point of the display. We do not pass data to advertising networks.

How long

We keep account data until it is deleted on request, and afterwards for the time needed to defend claims or required by law. A session expires after 30 days, or when you sign out.

Rights

You may ask for access, correction, deletion, restriction, and objection to processing based on legitimate interest, and you may complain to the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa). Requests: xpomoc@wp.pl.

Sign-in by SMS code

In this version sign-in is by password. Later, a one-time SMS code may be added for a number approved by the operator. The description will then name the message provider.

Cookies

• ekwiaty_session — the session of a signed-in seller or operator, httpOnly
• ekwiaty_city — the chosen city, so the right display can be shown
• ekwiaty_city_from — a one-time mark that the city came from the address; it expires after two minutes
• x-lang — the chosen language of the page, pl or en

There are no analytics or marketing cookies.