Document

Privacy policy

This is a translation for convenience. The Polish version is the binding one — in the event of any discrepancy, the Polish text prevails. Regulamin · Polityka prywatności

This document says whose data we process in Ptasie Domki, what for, on what basis and for how long. It covers both the people using the app and the people who write to us through the form on this site.

In force from: 30 August 2026 · Version 3

  1. Who is responsible for the data

    The data controller is Karol Maj, a sole trader running the Ptasie Domki service. On matters concerning personal data — access, rectification, erasure, objection — write to kontakt@ptasiedomki.pl. We answer to the same address the letter came from.

    When an institution keeps its own registry in the app, it is the controller of its staff’s data and it decides who has access to it. We then act as a processor, on its instructions, under a separate data-processing agreement.

  2. Whose data, and for what purpose

    People using the app

    We process the name, e-mail address, assigned role and zones, and a record of what was done in the app. The name is needed because an inspection without an author is not an entry in the registry — it can neither be verified nor corrected.

    The basis is performance of the contract made with the institution (Article 6(1)(b) GDPR) and our legitimate interest in keeping changes to the registry accountable (Article 6(1)(f) GDPR).

    People writing through the form

    We process the name of the institution, the person’s name, e-mail address, phone number, the rough number of boxes and the content of the message — every one of those fields is required in the form. Solely in order to answer the enquiry and to know what scale we are talking about. The basis is consent (Article 6(1)(a) GDPR) and steps taken prior to entering into a contract (Article 6(1)(b) GDPR).

    Consent to contact and to news messages

    When an account is created we ask separately about two things: whether we may contact you about your boxes and submissions, and whether you want to receive news about the program and about nest boxes. The basis for both is your consent (Article 6(1)(a) GDPR).

    Both are optional — the account works the same without them — and both are withdrawn in your own account settings, inside the program, with no need to write to us. We store the date each of them was given; withdrawal erases that date.

    Account messages that cannot be declined are a different matter: address confirmation, setting a password, the outcome of a submission. They are sent on the basis of the contract (Article 6(1)(b) GDPR), because the account does not work without them, and they do not depend on either consent above.

    Technical data

    We log the IP address and basic information about requests to the server. It serves security alone: recognising abuse and limiting the number of submissions from one address. The basis is our legitimate interest (Article 6(1)(f) GDPR).

  3. What we do not do

    • We do not sell or share data for marketing.
    • We do not profile and we do not take decisions automatically.
    • We collect nothing about how you use this site until you agree to it. The point below covers this separately.
    • We run no advertising and we build no advertising audiences.
    • We do not publish nest locations. The point below says so separately.

  4. Cookies and device storage

    This site uses one tool that sets cookies: Google Analytics. It does not start until you click I agree on the bar shown on the first visit. Until then Google’s script is not even downloaded, so there is nothing to block and nothing to delete.

    Refusing breaks nothing here. The site, the calculators, the locality search and the programme all work identically. No decision — closing the tab without clicking, for instance — means the same as a refusal.

    What exactly is stored once you agree

    Files stored in the browser once consent is given
    Name What it holds For how long
    _ga A random number for the browser. It holds no name, no e-mail address and nothing else that came from you. 2 years
    _ga_ plus the stream number The state of the current visit: when it began and which visit in order it is. 2 years
    birdbox-zgoda-analityka Your answer to the bar: yes or no. This is not a cookie — it sits in the browser’s memory and goes nowhere. Without it the bar would ask on every visit. until the site’s data is cleared

    Why we need it

    To know which pages somebody actually reads and which are merely written. We write here about boxes for several dozen species and about forty-five thousand localities — without measurement there is no telling a section that helps somebody from a section that takes up space. The legal basis is your consent (Article 6(1)(a) GDPR, together with the provisions of the Polish Electronic Communications Law on storing information on a terminal device).

    Who sees this, and what is switched off

    The tool is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acting as a processor on our instruction. Google also processes this data outside the European Economic Area, on the basis of the European Commission’s standard contractual clauses and of participation in the EU–U.S. Data Privacy Framework.

    We have switched off two things in this tool whose presence would change the meaning of the whole paragraph above: Google signals, that is, tying a visit to the visitor’s Google account, and ad personalisation. We run no advertising, so the only thing that would come of it is data circulating to no purpose.

    Google Analytics does not store the IP address — it uses it at the moment of the visit to work out the country and city, then discards it. We have no access to it in that tool at all.

    How to change your mind

    In the footer of every page there is a Privacy settings button — it opens the same bar and takes a new answer. Choosing Do not collect after having agreed earlier reloads the page, so that switching off takes effect at once rather than from the next visit. Withdrawing consent does not undo what we lawfully collected before.

    You can achieve the same by clearing this site’s data in your browser or blocking cookies in its settings — except that clearing the data also erases your answer, so the bar will ask again.

    Device memory in the programme

    The programme itself has no counter — the consent bar and Google Analytics sit on the product site, not in the field application. The programme does store data in the device’s storage, because otherwise it would not work with no signal: the session token, a copy of the registry for the assigned zone, photos and inspections waiting to be sent, and downloaded map packages. None of it is attached to requests or sent to anybody — it is a copy for working in the field.

    Clearing the site data in the browser deletes that copy along with entries that have not managed to send. So before clearing, it is worth opening the app with a signal and checking that the unsent counter shows zero.

    Apart from the counter you agreed to yourself, opening this page sends nothing to anybody else’s servers: the typefaces, the mark and every file come from our own server. Without consent not a single request leaves here to anyone but us.

    Once logged in, the programme fetches one thing from outside and only on request — aerial imagery from Geoportal, when somebody switches the map to “Imagery”. The device’s IP address is then seen by the Head Office of Geodesy and Cartography. The drawn base map, the boxes and the inspections work with no network and with nobody else involved.

  5. Nest locations

    The coordinates of boxes are not personal data, but we treat them more carefully than the law requires. The locations of sensitive species are blurred in exports by default, and a box counts as sensitive if such a species was ever recorded in it — otherwise comparing two summaries would be enough to reconstruct the exact spot.

    For the same reason our pages carry no map screenshots and no data from any existing registry.

  6. Whom we entrust data to

    We use a server provider and an outgoing-mail service. Each acts under a data-processing agreement and on our instructions alone. The current list, with names and registered offices, is given in the data-processing agreement, and on request we send it to kontakt@ptasiedomki.pl. We keep it in one place deliberately: a list copied onto a web page drifts out of step with the facts at the first change of provider.

    Separately, and only once you have consented, there is also Google Ireland Limited — the provider of the visitor counter, described in the point on cookies. We name it here rather than referring to the contract as we do for the others, because it is the only recipient whose presence depends on your decision and who can be switched off with one click.

    Registry data is kept on servers within the European Economic Area. Should that change, we will say so before it does. Counter data is the exception described above — and that is the whole reason the registry and the counter stand separately in this document.

  7. For how long

    • Data of people using the app — for the duration of the contract with the institution, and then for the period required by accounting law.
    • The record of actions in the registry — together with the registry, because without it the inspection history loses its author.
    • Enquiries from the form — 24 months from the last contact, unless you ask for erasure sooner.
    • The record of consent to contact and to news messages — until it is withdrawn, and afterwards only for as long as is needed to show that we acted on the withdrawal.
    • Technical data — 12 months.
    • Visitor counter data — 14 months, the longest period Google Analytics allows at all. Anything under a year makes it impossible to compare two breeding seasons, and that is the only comparison we are after here.

  8. Your rights

    You may request access to your data, its rectification, erasure or restriction of processing. You may also object to processing based on our legitimate interest, and request data portability.

    You can withdraw consent to contact and consent to news messages at any time — in your own account settings or by writing to us. Withdrawal does not affect what we did lawfully before it.

    Consent to the visitor counter is withdrawn with the Privacy settings button in the footer of every page. It works at once and without writing to us.

    You have the right to lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.

  9. Is giving the data mandatory

    No. Giving data in the form is voluntary, but without an e-mail address we have no way to reply. In the app, giving a name is a condition of creating an account, because an inspection has to have an author.

  10. Changes

    When we change this document, we will raise the version number and the date at the top. We give the institution advance notice of changes that matter to the people using the app.