Privacy policy

The controller of your personal data is Artur Koniec — a natural person conducting unregistered business activity and the operator of the Uratujkota.pl service (the "Controller" or "we"). The Controller is not entered in the CEIDG business register or the National Court Register (KRS) and holds no NIP or REGON number.

For matters concerning the protection of personal data, you can contact us at kontakt@uratujkota.pl.

The service is in development ahead of its public launch — the Controller's address for correspondence will be given here before the production release.

• Account data — the email address, display name and phone number you provide at registration, along with information about email confirmation and the consents you have given.
• Caretaker profile — data linked to your profile in the adoption module, including your display name and the contact details used in listings.
• Cats and adoption listings — information about the cats you publish (description, age, health status, vaccinations, photos) and the content of the listings you create.
• Addresses — the addresses saved in your profile (postal code, city, voivodeship, optionally a street) serve as templates for filling in listings and are not published on their own. An address placed on a listing is the address where the cat is collected and it is public in full, the street included if you gave one.
• Technical data — essential cookies and basic browsing data required for the secure operation of the service (see the cookies section).

• Running your account and providing the service — including creating an account, publishing listings and matching adoptions (Art. 6(1)(b) GDPR — performance of a contract for the provision of electronic services).
• Consent — processing based on freely given consent, e.g. the data processing consent at registration, which you may withdraw at any time (Art. 6(1)(a) GDPR).
• Legitimate interest — ensuring the security of the service, preventing abuse, and system maintenance and diagnostics (Art. 6(1)(f) GDPR).
• Legal obligations — where the law requires us to process or retain certain data (Art. 6(1)(c) GDPR).

• Security cookie (CSRF / antiforgery) — protects forms against cross-site request forgery attacks.
• Authentication session cookie — keeps you signed in after authentication.
• Language preference cookie — remembers the chosen interface language (Polish or English).
• Cookie consent cookie — remembers that you have seen the cookie notice, so the banner does not appear again.

We do not sell your personal data. We entrust it to providers who process it on our behalf and according to our instructions, under data processing agreements:

• the server infrastructure provider — its servers run the service;
• the managed database provider — it holds your account data, listings and addresses;
• the file storage provider — it stores the cat photos and the listing covers, and the nightly encrypted backups of the database;
• the identity provider, Microsoft Entra External ID — it handles registration, sign-in and password changes, and stores your credentials and email address;
• the email delivery service — it sends the notifications about a scheduled and a cancelled account deletion.

The contact details given in a listing (email address and phone number) are public — every visitor to the service can see them, including visitors without an account. On the listing page they sit behind a "Show contact details" button, but clicking it requires no sign-in. You share these details voluntarily so that people can contact you about an adoption — only publish details you are willing to make public.

We store data on servers and in services located in the European Economic Area: the application servers, the managed database and the file storage together with its backups all run in data centres inside the EEA, and the identity provider's directory was created with European data residency. The email delivery service is run by a provider established in the European Union.

Some of our providers belong to corporate groups headquartered outside the EEA. Where access to data from a third country cannot be ruled out in the course of technical support or system maintenance, such a transfer takes place on the basis of a European Commission decision on the adequate level of protection or of standard contractual clauses approved by the European Commission (Articles 45 and 46 GDPR).

You can obtain a copy of the safeguards applied to such a transfer by writing to kontakt@uratujkota.pl.

We retain account data and the linked profile for as long as you hold an account in the service.

Account deletion happens in two steps. When you request it, we block sign-in and send a single-use link to your email address that lets you call the deletion off. 14 days after the request we erase the data from the service permanently and irreversibly: we remove identifying data (email address, display name, phone number, addresses), the account at the identity provider and the photos of the cats and the listing covers, and the associated content is no longer linked to you.

The moment you request it, your published listings — together with the contact details they carry — stop being visible in the service, and sign-in stays blocked. If you call the deletion off with the link from the email, the listings return automatically, unchanged.

A deleted cat first goes to a trash you can restore it from for 14 days; after that its data and photos are removed.

Two technical copies go a little later, and they are a safeguard against failure and accidental deletion rather than a separate data set. Deleted photos — including those removed together with an account — first go to a private copy that is not publicly accessible and is erased automatically, typically within 15 days. The nightly database backups are encrypted and erase themselves automatically within 30 days of being taken, so a backup made before an account was deleted ceases to exist at most 30 days after it was taken.

We may retain some data longer where this is necessary to fulfil legal obligations or to establish, exercise or defend legal claims.

• Right of access to your data and to obtain a copy of it.
• Right to rectification of inaccurate or outdated data.
• Right to erasure ("right to be forgotten").
• Right to restriction of processing.
• Right to data portability — to receive your data in a structured, commonly used format.
• Right to object to processing based on legitimate interest.
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
• Right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.

You can exercise some of these rights yourself directly in the service, without contacting us:

• Data export — under "Account → Export data" you can download a copy of your data (exercising the rights of access and portability).
• Account deletion — under "Account → Delete account" you can request deletion of your account and data (exercising the right to erasure). We block sign-in immediately and erase the data irreversibly after 14 days; during that time you can call the deletion off through the single-use link from the email.

For any other matter, write to us at kontakt@uratujkota.pl — we will respond without undue delay.

For any matter concerning your personal data or this policy, you can contact us at kontakt@uratujkota.pl.

This policy may be updated from time to time, e.g. as the service evolves or the law changes. The current version is always available on this page, and we indicate the date of the last update at the top. We will announce any significant changes in the service.