Privacy policy

Effective from 15 October 2026.

1. Data controller

The controller of your personal data is Budomatch Daniël de Graaf, Białka 15, 09-550 Szczawin Kościelny, Polska, NIP 7010869430, REGON 381430120, VAT PL7010869430. Contact about data: [email protected] or the contact form.

2. What data we process and why

• Listings. Name, phone, e-mail, company, and the content and photos of the listing – to publish the listing, check it and contact you about it. Basis: contract (Art. 6(1)(b) GDPR). Contact details given in a listing are publicly visible because that is the listing's purpose.
• Enquiries about a listing. Name, e-mail, phone and the message – to pass your enquiry to the advertiser, who replies directly. Basis: contract (Art. 6(1)(b) GDPR). The advertiser becomes a separate controller of the data they receive.
• Partner registrations and contact-form messages. Company details, name, e-mail, phone, message – to reply and to start cooperation. Basis: steps before a contract and our legitimate interest in answering messages (Art. 6(1)(b) and (f) GDPR). For commercial contact we ask for consent, which you can withdraw at any time.
• Technical data. IP address, browser type, time and address of the request in server logs – to keep the service secure and stable. Basis: legitimate interest (Art. 6(1)(f) GDPR).
• Browser settings. Favourite listings and whether you closed the app-install bar are stored only in your browser (localStorage). We use no tracking cookies, no third-party analytics and no external fonts.
• Imported photos. Photos of listings imported from agencies may be loaded from that agency's servers; the agency then sees your IP address.
• Map and Street View. On a listing page we load a map with tiles from OpenStreetMap (OpenStreetMap Foundation, UK); the tile provider then sees your IP address. Google Street View loads only after you click – Google Ireland Ltd. then receives your IP address and may set its own cookies.

3. Who we share data with

• The advertiser – your enquiry about their listing.
• Providers who process data on our behalf under data-processing agreements: hosting and database (Railway Corporation, USA) and e-mail delivery (Resend, Inc., USA). Transfers outside the European Economic Area are based on the European Commission's standard contractual clauses.
• Public authorities where the law requires it.

We do not sell data and do not share it for other companies' marketing.

4. How long we keep data

• Listings: while live, then 12 months in the archive for complaints; after that we delete or anonymise them.
• Enquiries and contact-form messages: 12 months.
• Partner registrations: until cooperation ends, or 24 months if no cooperation follows.
• Server logs: 30 days.
• Billing data: for the period required by tax law.

5. Your rights

You have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, and to object to processing based on legitimate interest. You can withdraw consent at any time without affecting earlier processing. To exercise these rights, write to [email protected]. You also have the right to complain to a supervisory authority – in Poland the President of the Personal Data Protection Office (uodo.gov.pl); you may also contact the authority in your own country.

6. Security

The connection to the service is encrypted (HTTPS). Access to the admin panel is password-protected and data is stored with providers that meet industry security standards. Photos are resized on upload and stripped of metadata, including GPS location.

7. Changes to this policy

We announce significant changes on the site. The current version is always available at https://polodom.pl/en/prywatnosc.