Privacy policy

1. Data controller

The controller of personal data is Nikicomp Katarzyna Marcjańska, ul. Wiejska 45, 05-850 Ożarów Mazowiecki, VAT ID (NIP): 5792059039, REGON: 365631663. Data protection contact: [email protected].

2. What we process and why

• technical data (IP address, server logs) — to secure and operate the Portal (Art. 6(1)(f) GDPR — legitimate interest);
• correspondence data (e-mail, message content) — to reply to you (Art. 6(1)(f) GDPR);
• data of people presented in profiles and editorial materials (name or professional name, public contact details, area of activity, services, and links to events or organisations) — to help visitors find publicly offered services, initiatives, and events (Art. 6(1)(f) GDPR — the legitimate interests of the Controller and Portal visitors);
• preferences stored on your device (filters and the country used to order discovery sections) — only with your consent (see section 6);
• anonymous visit statistics (a daily hash of a random browser identifier, UTC hour, country, visited path, and — if present — the registrable domain of the referring website, e.g. "google.com", never the full hostname or referring URL) — only with analytics consent, to measure unique visits and traffic sources without building a cross-day profile;
• content of the anonymous feedback survey on the About page — to improve the Portal (Art. 6(1)(f) GDPR); the survey collects no identifying data and we ask you not to include any;
• event-submission form data (description, link, optional contact e-mail) — to verify and publish the event and to contact you if needed (Art. 6(1)(f) GDPR); the e-mail is never published.
• content-report data (reason, explanation, reported content type and URL, notifier name and e-mail (except legally permitted anonymous notices), good-faith declaration and decision/appeal correspondence) — to prevent fraud, moderate content and handle claims (Art. 6(1)(f) GDPR), and comply with DSA obligations (Art. 6(1)(c) GDPR);
• logs of create, update and delete operations performed by user and administrator accounts (account ID, action type, affected object and time) — for security, change accountability and abuse prevention (Art. 6(1)(f) GDPR). The log does not contain form bodies, passwords, session tokens or raw IP addresses.

For registered accounts we process the email address confirmed by the sign-in provider or by a one-time sign-in link (this is not full identity verification), the selected sign-in provider identifier, session data, and profile content edited by the user to create the account, secure access, and perform the requested profile publication and management service (Art. 6(1)(b) GDPR). Optional information that is not necessary for the service is provided voluntarily and can be removed by the user at any time.

Signing in with an e-mail link. When you ask for a sign-in link, we process the e-mail address you enter and a hash of a one-time token to send the link and, once it is used, to create your account or sign you in to an existing one (Art. 6(1)(b) GDPR). Before the link is sent you confirm that you accept the Terms of Service and have read this Policy; we record the date and version of that acceptance so that we can demonstrate it (Art. 6(1)(f) GDPR).

E-mails. We send only account-related messages: sign-in links you request and notifications you turn on (for example about sign-ups in your calendar, which you can turn off at any time in the calendar settings). Messages go to your account's e-mail address. We send no marketing other than the newsletter, which you can only subscribe to yourself, and we do not track opens or clicks.

Newsletter. We send the newsletter (news about selected events, places and people on the Portal) only to the account e-mail address of people who subscribed to it themselves in their account settings or on the Portal's newsletter page, on the basis of consent (Art. 6(1)(a) GDPR). Subscribing is not a condition for using the Portal or an account. You can withdraw consent at any time by unsubscribing in your account settings or on the newsletter page; this does not affect the lawfulness of sending before withdrawal. To be able to demonstrate consent, we record the date you subscribed, the version of this Policy, the language and the date you unsubscribed.

Practitioners' newsletters. You can subscribe to the newsletter of a person who runs an individual profile on the Portal (the author). We then process your account's e-mail address, the date you subscribed, the language and the version of this Policy to deliver that author's issues on the author's behalf, on the basis of your consent (Art. 6(1)(a) GDPR). The Controller of the Portal is the controller of these data. The author does not receive your e-mail address or any other data about you — only the number of subscribers. The author is responsible for the content of the issues. Every message is labelled as commercial information, names the author, says why you receive it, gives the Controller's details and contains a one-click unsubscribe link that works without signing in. You can withdraw consent at any time with that link, on the author's profile or in your account settings; this does not affect the lawfulness of sending before withdrawal. To handle delivery and any complaints, we keep for 90 days a record of which issue was sent to your address and when.

Notifications to administrators. When a new account is created (the account's e-mail address, sign-in method and date) or a profile asks to be published (the profile name, the account's e-mail address and date), we inform the Portal's administrators and the Controller by e-mail, to moderate content and keep the service secure (Art. 6(1)(f) GDPR).

3. Data obtained from public sources — Article 14 notice

Some basic entries may be created from information that a person has made public in connection with their professional activity or event organisation. This also applies to sole traders. Sources may include the person's or organisation's official website, public professional social profiles, public event and venue pages, and public business registers. We provide the specific source on request and, where possible, the entry links to the source page.

In this situation we process only data necessary for the Portal's information function: professional name or personal name, publicly offered services, city or countries of activity, public professional contact details and links, information about an organisation or event, and the source and verification date. We do not automatically publish a home address, private phone number, or private email address. We do not combine multiple sources into an extensive personal profile unless this is necessary to present the person's public activity.

We do not infer religious or philosophical beliefs, health, sex-life, or other special-category data. We do not ask for such information in a profile. Publishing it requires a separate Art. 9 GDPR condition, such as explicit consent or the person's clear affirmative action by which they manifestly made the specific data public themselves (Art. 9(2)(e) GDPR). We rely on that condition for public-source material only after individual review and only where the information is necessary to present the offered activity.

Before relying on Art. 6(1)(f), the Controller assesses whether the purpose is lawful, whether the scope is necessary, and how publication affects the person's rights and reasonable expectations. Where a public professional contact channel is available, we provide an individual notice within a reasonable period, no later than one month, at first contact, or no later than first disclosure — whichever occurs first. We rely on the impossibility or disproportionate-effort exception only after a documented assessment; in that case this public notice and an easy data-rights contact are safeguards.

4. Recipients

Data marked as public are disclosed to Portal visitors and may be indexed by internet search engines. Other data may be entrusted to hosting and technical providers acting on the controller's behalf under data-processing agreements. Data are never sold and are not used for automated decision-making or profiling.

Federated sign-in is handled by Microsoft Azure and the provider chosen by the user (for example Google or Facebook), under that provider's own privacy policy.

E-mails are sent on the Controller's behalf by Microsoft Azure (Azure Communication Services, data location: Europe) from [email protected]; replies go to [email protected] or, for a practitioner's newsletter, to the author's public e-mail address if they published one. Newsletter authors do not receive subscribers' data.

Providers may include Microsoft Azure (hosting, database, file storage, authentication, and e-mail delivery) and OpenAI (tools assisting the editorial team with content). AI tools do not make decisions producing legal effects for people presented on the Portal, and material is reviewed editorially before publication. If a provider processes data outside the European Economic Area, the transfer uses an appropriate Chapter V GDPR mechanism, such as an adequacy decision or Standard Contractual Clauses; information about the applicable safeguard is available from[email protected].

5. Retention and accuracy

Archived technical logs — up to 7 days; application console output is not archived. Correspondence — until the matter is closed and for the limitation period of claims. An account and user-managed profile are retained until the account or profile is deleted, subject to any period needed to establish, exercise, or defend legal claims. Entries created from public sources are reviewed periodically, at least every 90 days; an outdated entry, or one whose accuracy cannot be confirmed, is deleted or reduced to strictly necessary archival data where a separate legal basis permits retention.

A sign-in link is valid for 15 minutes and works once. The record holding the e-mail address and token hash is deleted when the link is used, and an unused one within a day after it expires. The date and version of your acceptance of the Terms are kept for as long as the account exists. A newsletter subscription lasts until you unsubscribe; the subscription and unsubscription dates and the consent version are kept for as long as the account exists, and the related activity-log entries for no more than 24 months. A subscription to a practitioner's newsletter lasts until you unsubscribe; the record of sent issues is kept for 90 days, and the issues themselves for as long as the author's profile exists. Records of notifications to administrators are deleted after 30 days; a profile's publication request is kept for as long as the profile exists.

Portal sessions expire after 7 days. Daily analytics hashes are deleted after 62 days, and the raw analytics cookie identifier expires after no more than 48 hours.

CUD activity logs are retained for no more than 24 months. Content reports are retained while they are handled and afterwards for the period needed to demonstrate moderation steps or defend claims.

6. Cookies & local storage

The Portal uses first-party cookies and browser local storage only. The "preferences" and "analytics" categories operate only after consent given in the banner (changeable any time via "Cookie settings" in the footer).

7. Your rights

You have the right of access, rectification, erasure, and restriction. Data portability applies within the scope of Art. 20 GDPR. Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing. Requests: [email protected]. You may also lodge a complaint with the Polish supervisory authority (PUODO, uodo.gov.pl).

Right to object: where we rely on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the data are needed to establish, exercise, or defend legal claims. In practice, we handle credible requests to remove a basic aggregated entry without undue delay and suppress the source so that an automated process does not add it again.

8. Correcting, claiming, or removing an entry

If the Portal presents your profile or business information, you may ask for the source, rectification, restriction, erasure, or to claim and manage the profile yourself. Write to [email protected]. We may request only the information needed to verify that the request comes from the person concerned.

9. Changes

Significant changes will be announced on this page. Version of 25 October 2026.