Privacy Policy

In all matters related to personal data, you can contact us by email at [email protected] or via the contact form. The Controller has not appointed a Data Protection Officer.

We process personal data only to the extent necessary for the following purposes:

• Account and provision of the Service — email address, first and last name, password (stored only as a cryptographic hash), language and currency preferences, profile picture, search settings, trip plans, routes and saved places. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Retention: until the Account is deleted.
• Trip Gallery (Pro Package) — uploaded photos stored in WebP format, including the location read from their EXIF data. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Retention: while the Pro Package is active and for at least 12 months after it expires; photos are permanently deleted within 7 days of a deletion request sent to [email protected] from the email address of the Account, or when the Account is deleted.
• Evidence of registration and acceptance of the Terms — registration IP address, date of accepting the Terms and date of Account activation. Legal basis: our legitimate interest in demonstrating the conclusion of the contract and defending against claims (Art. 6(1)(f) GDPR). Retention: for the lifetime of the Account and then until the limitation period for claims expires.
• Sale of the Pro Package, settlements and accounting — subscription history, billing period, price and currency, payment status and invoice data. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with tax and accounting obligations (Art. 6(1)(c) GDPR). Retention: 5 years from the end of the calendar year in which the tax payment deadline expired.
• Subscription management records — date, time and IP address of each cancellation and resumption of the subscription. Legal basis: our legitimate interest in documenting your instructions and defending against claims (Art. 6(1)(f) GDPR). Retention: until the limitation period for claims expires.
• Contact and complaints — name, email address and the content of your message. Legal basis: our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR) and, for complaints, compliance with consumer law obligations (Art. 6(1)(c) GDPR). Retention: for the time needed to handle the matter and then until the limitation period for claims expires.
• Security, bot protection and statistics — IP address, visited page, date of the visit and the country determined from the IP address, as well as data processed by reCAPTCHA on the login, registration and contact forms. Legal basis: our legitimate interest in securing the Service, preventing abuse and analysing traffic (Art. 6(1)(f) GDPR). Retention: visit logs are kept for 12 months.
• Displaying prices in the right currency — the country determined from your IP address. Legal basis: our legitimate interest in presenting a relevant offer (Art. 6(1)(f) GDPR). You can choose the currency yourself in the settings. Retention: as for visit logs.

Payments for the Pro Package are processed by PayU S.A., with its registered office in Poznań (ul. Grunwaldzka 186, 60-166 Poznań, KRS 0000274399). To process a payment, we transfer to PayU the data necessary for this purpose: your email address, first and last name, the amount, currency and description of the order and your IP address. PayU processes payment data as an independent controller, in accordance with its own privacy policy available at payu.pl. We do not receive or store your full payment card details.

Your personal data may be disclosed to entities that help us provide the Service, acting on our behalf as processors or as independent controllers:

• PayU S.A. — payment processing;
• Amazon Web Services EMEA SARL — hosting of the Service, the database and stored photos (data centre in Frankfurt, Germany);
• OVH SAS — email delivery;
• Cloudflare, Inc. — network security and content delivery;
• Google Ireland Ltd — reCAPTCHA bot protection and web fonts;
• ip-api.com — determining the country from the IP address;
• OpenStreetMap Foundation and public content delivery networks (unpkg, cdnjs, jsDelivr) — map tiles and scripts loaded directly by your browser, which receive your IP address;
• public authorities, where required by law.

We do not sell personal data and do not use it for advertising.

Some of the providers listed above (e.g. Cloudflare and Google) may process data outside the European Economic Area, in particular in the United States. In such cases, data are transferred on the basis of a European Commission adequacy decision (including the EU–US Data Privacy Framework) or standard contractual clauses approved by the European Commission.

You have the right to:

• access your data and receive a copy of it;
• rectify inaccurate data;
• have your data erased;
• restrict processing;
• data portability;
• object to processing based on our legitimate interest;
• lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.

To exercise your rights, send a request to [email protected], preferably from the email address associated with your Account, so that we can verify your identity. We will respond within one month of receiving the request.

Providing personal data is voluntary, but necessary to create an Account, purchase the Pro Package or receive an answer to a message. Without it, we cannot provide these services.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. The currency shown to you is suggested automatically based on your IP address, but you can change it at any time in the settings.

The Service uses only the cookies needed for it to work and to remember your choices:

• JSESSIONID — keeps you logged in during a session; deleted when the browser is closed;
• remember-me — keeps you logged in if you select "Remember me"; valid for 30 days;
• HP_LANG — remembers the selected language; valid for 1 year;
• holidayplan_cookie_consent — remembers your cookie choice; valid for 1 year.

We do not use advertising or tracking cookies. On pages with a reCAPTCHA form, Google may set its own cookies. The Service also stores some interface settings in your browser's local storage. You can delete cookies and local storage at any time in your browser settings; blocking necessary cookies may prevent you from logging in.

We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), storing passwords only as cryptographic hashes, access control and regular backups.

We may update this Privacy Policy, for example when the law or the way the Service works changes. The current version is always available on this page, and registered users will be informed of material changes by email.