Skip to content
PL: Polska wersja strony EN
Join the list

Legal

Privacy policy

Last updated: 22 October 2026

This is an English translation. The Polish version is the binding one.

In short

  • We collect only what we need: your email address if you join the early-access list, and the basic technical data every browser sends to every website.
  • Your email address is used for two messages: a signup confirmation with a preview of the app, and an invitation when the Huvee app is ready to download. No newsletter, and we do not sell data.
  • Google Analytics runs only once you agree to it. Without consent we count visits only on the server, with no script and no cookie, and those statistics never store your IP address.
  • You leave the list with the link in our email or with one email to business@huvee.pl; the same email is enough to ask for a copy or deletion of your data.

1. Who controls your data

The controller of your personal data is Bartosz Burdalski, a private individual who runs the Huvee project outside any business activity; place of residence: Wałbrzych; address: ul. Blankowa 31/3, 58-316 WałbrzychNote 1. The controller is responsible for the huvee.pl website and the early-access list for the Huvee app. Huvee is not yet a company: it is a project the controller develops with a few collaborators.

The collaborators have access to data only as far as they need it to work on the website and the list, only on the controller's instructions, under the controller's authorisation and bound to confidentialityNote 2. In this policy "we" means the controller and these people; the controller is responsible for your data.

For anything about your data, write to business@huvee.pl or by post to the address above. We have not appointed a data protection officer because we are not required toNote 3.

2. The early-access list

What we keep: your email address, the fact that you ticked the consent box, the version of its wording and when you ticked it, the language of the page, the colour scheme picked on the site (light, dark or system, so the emails come in the same colours), the place on the page you signed up from, and any campaign tags (utm_*) in the link you arrived by. When you sign up our server also sees your IP address; we use it only to protect the form from abuse (a limit on the number of requests from one address), hold it only in the server's memory, for 15 minutes at most, and do not store it on the list.

Purpose: to send you two emails: right after you sign up, a confirmation with a preview of the Huvee app (its main features and example interests), and an invitation when the app is ready to download. We send the confirmation only the first time an address signs up. No newsletter and no other messages. We will not pass the list to another controller, such as a company that may take the project over in future, without your fresh consent.

Legal basis: your consentNote 4. Both emails are commercial information, so on top of the GDPR the law requires your prior consent to receive them by emailNote 5. You give it by ticking the box next to the form, which is never ticked in advanceNote 6.

Signup statistics and form protection: we look at the signup place and campaign tags only in aggregate (how many signups came from a given place or channel), to learn which promotion channels work, and we use the IP address for the request limit. The basis here is not your consent but our legitimate interest in measuring how well our promotion works and in protecting the form from abuseNote 7Note 8. You can object (section 9); we then delete the signup place and campaign tags from your record, and your address stays on the list.

Giving us your data is voluntary, but without an email address and consent we cannot send the confirmation or the invitationNote 9.

How long: until the invitation is sent or you withdraw consent, and if launch is delayed, no longer than 12 months after you sign up. Then we delete the address from the list. For a further 3 years we keep only the consent record (address, time and wording version) and the date the email was sent or consent withdrawn, so that we can show we acted lawfully and defend ourselves against any claims. The basis for that is our legitimate interestNote 7Note 10.

Withdrawing consent: click "Remove me from the list" in our email, write to business@huvee.pl from the address on the list, or reply to our email. Withdrawal does not affect anything we did before itNote 11.

The list is for adults only: the Huvee app will be available to people aged 18 and over.

3. Server logs and visit statistics without consent

When you open the page, your browser, as with any website, sends the server its IP address, the address of the page, the address of the page you came from, your preferred language, and the name and version of your browser and system (the User-Agent). We run no script for this and set no cookie.

Security: the server logs this with the date and time, to detect attacks and errorsNote 8. We keep the logs for no longer than 30 days.

Visit statistics: for each page opened, our statistics system keeps only the page address, the time, the name of the site you came from (not its full address), campaign tags (utm_*), the language, the country (when known), the device type, and the kind of browser and system. It does not store your IP address or the full browser string: it turns them straight into a hash with a random key that we change every day, keep only in memory (never on disk) and delete after 48 hoursNote 12. That tells us how many different visitors came on a given day, and once the key is gone the records cannot be linked to anyoneNote 13. Bot traffic is not counted. We keep the records for 13 months.

Legal basis: our legitimate interest in a secure site and in knowing whether and how it is visitedNote 7. Your browser has to send this information for the page to load at all, so it does not need consent for access to your deviceNote 14. You can object (section 9).

4. Analytics with your consent: Google Analytics

Only if you agree to it in the cookie banner do we run Google Analytics 4 (Google Ireland Limited, Ireland). It shows us which sections get read, which buttons work and where visitors come from.

Google Analytics sets the _ga and _ga_<ID> cookies, which recognise your browser on later visits. Google does not store the IP addresses of visitors from the EU; it uses them only for an approximate location. The cookies expire with your consent, after 12 months at the latest. We keep event-level data and data linked to the browser identifier for 14 months, so that we can compare the same period year on year; Google then deletes it automaticallyNote 15. Only aggregate reports (plain numbers, such as visits in a given month) are kept longer. Advertising signals and ad personalisation are switched off.

What we measure: page and section views, clicks on buttons and links (to sections, to contact and to other websites), FAQ questions opened, interest categories selected, language and colour-scheme changes, starting a signup and its outcome (joined or error), and your choice in the cookie banner. We never pass your email address to Google.

Legal basis: your consentNote 4, which is also consent to access your deviceNote 16. You can withdraw it at any time with the "Cookie settings" button in the footer or in the cookie policy. Google Analytics then stops sending data and its cookies are deletedNote 11.

5. Email

If you write to us (including when the signup form opens your mail app), we process your email address, your message and whatever you put in it, to reply and keep the conversation going. Legal basis: our legitimate interest in answering messagesNote 7, and when we act on your GDPR rights, our legal obligationNote 17. We keep the correspondence until the matter is closed, then for up to 3 years in case of claimsNote 10.

6. Who receives your data

We do not sell data or share it with advertisers. We entrust it only to companies that process it on our behalf, under a data processing agreement and only on our instructionsNote 18:

  • Google Cloud Poland Sp. z o.o.: the servers that run the website, receiving early-access signups and the visit statistics;
  • Google Cloud Poland Sp. z o.o. (Firebase, Cloud Firestore): the early-access database, stored on servers in the European Union;
  • OVH SAS (OVHcloud, email): our mailbox, and sending the signup confirmation and the invitation;
  • Google Ireland Limited (Google Analytics 4): analytics, only with your consent.

We may also disclose data to public authorities when the law requires it.

7. Transfers outside the European Economic Area

Google may also process data on servers in the United States. Google LLC takes part in the EU-US Data Privacy Framework, which the European Commission has found to ensure an adequate level of protectionNote 19; Google also uses standard contractual clausesNote 20.

We will send you a copy of these safeguards if you ask at business@huvee.pl.

8. Your rights

You have the right to:

  • access your data and get a copy of it;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict processing;
  • receive the data we process on the basis of your consent in a portable format;
  • object to processing based on our legitimate interest (section 9);
  • withdraw consent at any timeNote 11.

To use any of them, write to business@huvee.pl. We reply without undue delay and within one month at the latestNote 21. We may ask you to confirm that the email address is yours.

You can also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl)Note 22.

9. Your right to object

You have the right to object at any time, on grounds relating to your particular situation, to processing of your data based on our legitimate interestNote 23. This covers:

  • signup statistics and form protection (section 2);
  • the consent record we keep after the invitation is sent or consent is withdrawn (section 2);
  • server logs and visit statistics (section 3);
  • email correspondence (section 5).

Send your objection to business@huvee.pl. We will then stop processing that data, unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or need it to establish, exercise or defend legal claims.

10. Automated decisions

We make no decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect youNote 24.

11. Security

The site is served only over encrypted HTTPS. Only the people who need it can access the list, and we choose providers that give sufficient guarantees of protecting dataNote 25.

12. The Huvee app

This policy covers the huvee.pl website. The Huvee app will have its own privacy policy and terms, which we will publish before it becomes available.

13. Changes to this policy

We update this policy when the way we process data or the law changes. The current version, with its date, is always on this page. We will email people on the early-access list about any significant change that affects it.

Contact

Questions about this policy go to business@huvee.pl.

  1. Art. 4(7) GDPR (definition of a controller) and art. 13(1)(a) GDPR (the controller's identity and contact details, given when data is collected). A natural person is a controller outside any business too: the exemption for purely personal or household activities (art. 2(2)(c) GDPR) does not cover a public website or a signup list. Back to the text at note 1
  2. Art. 29 GDPR: a person acting under the controller's authority who has access to personal data processes it only on the controller's instructions; art. 32(4) GDPR: the controller takes steps to ensure that such persons process data only on its instructions. Back to the text at note 2
  3. Art. 37(1) GDPR: a data protection officer is required for public authorities and for organisations whose core activities consist of regular and systematic monitoring of people on a large scale, or of large-scale processing of special categories of data. Back to the text at note 3
  4. Art. 6(1)(a) GDPR (consent as a legal basis); art. 4(11) and art. 7 GDPR (consent must be freely given, specific, informed, unambiguous and given by a clear affirmative act). Back to the text at note 4
  5. Art. 398(1) PKE: using terminal equipment to send commercial information, including direct marketing, is prohibited unless the subscriber or end user has given prior consent. Since 10 November 2024 this provision replaces the repealed art. 10 UŚUDE. Sending commercial information without consent is a petty offence (art. 448 PKE). Back to the text at note 5
  6. Art. 400 PKE: consent is governed by the data protection rules, i.e. the standard of art. 4(11) and art. 7 GDPR. Recital 32 GDPR: silence, pre-ticked boxes or inactivity do not constitute consent. Back to the text at note 6
  7. Art. 6(1)(f) GDPR (the controller's legitimate interest) and art. 13(1)(d) GDPR (the duty to state that interest). Back to the text at note 7
  8. Recital 49 GDPR: processing to the extent strictly necessary to ensure network and information security is a legitimate interest of the controller. Back to the text at note 8
  9. Art. 13(2)(e) GDPR (whether providing data is a requirement, and the consequences of not providing it). Back to the text at note 9
  10. Art. 5(2) and art. 7(1) GDPR: the controller must be able to demonstrate compliance and that the person consented. Three years matches the limitation period for claims for damage caused by a tort (art. 442¹ § 1 KC), including claims under art. 82 GDPR. Back to the text at note 10
  11. Art. 7(3) GDPR: consent can be withdrawn at any time, withdrawing must be as easy as giving it, and it does not affect the lawfulness of processing before the withdrawal. Back to the text at note 11
  12. Art. 4(5) GDPR (pseudonymisation), art. 5(1)(c) GDPR (data minimisation) and art. 25(1) GDPR (data protection by design). Back to the text at note 12
  13. Recital 26 GDPR: data protection rules do not apply to anonymous information, i.e. information that, using means reasonably likely to be used, can no longer be attributed to an identified or identifiable person. Back to the text at note 13
  14. Art. 399(3) PKE: consent is not required where storage or access is necessary to transmit an electronic communication or to provide an electronic service the user has requested. Back to the text at note 14
  15. Art. 5(1)(e) GDPR (storage limitation: data is kept no longer than necessary for the purposes of processing) and art. 13(2)(a) GDPR (information about the storage period). Back to the text at note 15
  16. Art. 399(1) PKE: storing information, or gaining access to information already stored, in a user's terminal equipment is allowed if the user has first been clearly informed of the purpose and has consented. Back to the text at note 16
  17. Art. 6(1)(c) GDPR (legal obligation) together with art. 12(3) GDPR (the duty to act on a data subject's request). Back to the text at note 17
  18. Art. 28 GDPR (a processor acts under a contract and only on the controller's documented instructions) and art. 13(1)(e) GDPR (information about recipients). Back to the text at note 18
  19. Art. 45 GDPR and Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 (EU-US Data Privacy Framework). The General Court dismissed an action against that decision on 3 September 2025 in Case T-553/23 Latombe v Commission; an appeal is pending before the Court of Justice (C-703/25 P). Back to the text at note 19
  20. Art. 46(2)(c) GDPR and Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses; art. 13(1)(f) GDPR (information about the safeguards and how to obtain a copy). Back to the text at note 20
  21. Art. 15–18 and 20 GDPR (access, rectification, erasure, restriction, portability); art. 12(3) GDPR (reply without undue delay and within one month, extendable by two months); art. 12(6) GDPR (confirming identity). Back to the text at note 21
  22. Art. 77 GDPR (right to lodge a complaint) and art. 34(1) and (2) of the Polish Personal Data Protection Act (the President of the Personal Data Protection Office is the supervisory authority under the GDPR). Back to the text at note 22
  23. Art. 21(1) GDPR: objection to processing based on art. 6(1)(f) GDPR; after an objection the controller stops unless it demonstrates compelling legitimate grounds or needs the data for legal claims. Art. 21(4) GDPR: this right is brought to the data subject's attention explicitly, clearly and separately from any other information. Back to the text at note 23
  24. Art. 22(1) and art. 13(2)(f) GDPR. Back to the text at note 24
  25. Art. 32 GDPR (security of processing) and art. 28(1) GDPR (choosing processors that give sufficient guarantees). Back to the text at note 25