1. Data controller
The controller of personal data is Polbyte Artur Olszak, ul. Chmielna 2/31, 00-020 Warsaw, Poland, VAT ID PL8252049978, REGON 360085612. Contact for data protection matters: info@polbyte.com.
This policy applies to polbyte.com and the Polbyte apps (including Polmowa Online, SamplePad, Polbyte Games, Polbyte ERP and Polbyte IoT) that refer to it.
2. What data, why and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Running your Account and providing the Services | e-mail, username, password (hashed), settings, content and progress in the app | Art. 6(1)(b) – performance of a contract |
| Managing Paid plans | Paddle customer and transaction IDs, plan type, access expiry date | Art. 6(1)(b) – performance of a contract |
| Replying to contact form messages or e-mails | name, e-mail, company, message | Art. 6(1)(f) – legitimate interest (answering enquiries) |
| Complaints, refunds, legal claims | correspondence and order data | Art. 6(1)(c) and (f) – legal obligation and defence of claims |
| Security and abuse prevention | IP address, server logs, browser information | Art. 6(1)(f) – legitimate interest |
| Game leaderboards | chosen nickname and score | Art. 6(1)(b) – performance of a contract |
| Visit statistics | anonymised page view data (no cookies) | Art. 6(1)(f) – legitimate interest |
Providing data is voluntary, but without an e-mail address you cannot create an Account or buy a Paid plan.
3. Payments – Paddle
Payments are handled by Paddle.com Market Limited (United Kingdom), the Merchant of Record for our Paid plans. Data entered in the checkout (e.g. name, e-mail, country, postcode, VAT number, card details) is processed by Paddle as an independent controller under its privacy policy. We never receive or store full card details. From Paddle we receive what we need to activate access: customer ID, e-mail, plan type, payment status, country.
4. Recipients
We share data only with parties that help us provide the Services, under data processing agreements or as independent controllers:
- UpCloud: server hosting, data centre in Warsaw (Poland),
- AT Host: e-mail (Poland),
- Paddle: payments, invoices, refunds (independent controller, see section 3),
- our accounting office: for accounting documents,
- public authorities: where required by law.
We collect visit statistics with Umami, hosted on our own server. It uses no cookies and shares no data with third parties.
5. Transfers outside the EEA
Our servers and e-mail are located in Poland. Paddle is based in the United Kingdom, for which the European Commission has adopted an adequacy decision. Where Paddle or its sub-processors transfer data to other countries, they do so on the basis of standard contractual clauses or other safeguards under Chapter V GDPR.
6. How long we keep data
- Account data: until the Account is deleted, then up to 30 days (backups are overwritten in their normal cycle),
- Paid plan and transaction data: for the duration of the contract and until claims become time-barred,
- contact form messages: up to 3 years after the last contact,
- server logs: up to 90 days,
- accounting documents: for the period required by tax law (usually 5 years from the end of the tax year).
7. Cookies and browser storage
- polbyte.com uses no tracking or advertising cookies. After you change the language manually it only stores a
langcookie with your choice. - The apps use strictly necessary session and security cookies (e.g. keeping you signed in, protecting forms) and browser storage (localStorage, IndexedDB), e.g. for offline use and saving settings.
- The Paddle checkout may use its own cookies necessary for payment and fraud prevention.
We do not show ads or carry out marketing profiling. We do not make decisions based solely on automated processing that produce legal effects concerning you.
8. Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object to processing based on legitimate interest. To exercise your rights, write to info@polbyte.com. We respond within one month.
You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the supervisory authority in your country of residence.
9. Changes
We announce material changes to this policy on this page and, for Users with an Account, by e-mail.