Privacy Policy

Version 1.0.0

This is an English translation provided for convenience. Only the Polish version of the Privacy Policy is legally binding.

Summary

  • The controller of your data is Voltex Software Łukasz Walter – the operator of wybiegaj.com. Contact for data matters: kontakt.wybiegaj@gmail.com.
  • We process data to run your account and to handle your participation in events, payments and the shipping of packs – to the extent needed for these purposes.
  • We do not sell your data. We do not give your contact details to patrons or affiliate partners.
  • Marketing (newsletter, promotional notifications, partner offers) and analytics (Google Analytics on the website and in the web app) – only with your consent.
  • We do not store heart rate data, GPS routes or photos from Strava.
  • We collect your device's location only while you record a workout in the app, which you start yourself. Only you can see the route of such a workout.
  • We keep order data for 5 years because of tax law; other data until you delete your account, or for a shorter period.
  • You can download your data and delete your account yourself in the app. Your other rights are described in section 6.

1. Controller and contact

1. The controller of your personal data is Voltex Software Łukasz Walter, Wilków 42B, 58-125 Wilków (Świdnica commune), Poland, an entrepreneur entered in the Polish Central Register and Information on Economic Activity (CEIDG), tax ID (NIP) 8842572758, REGON 388685218 – the operator of wybiegaj.com (“we” or “us”).

2. For matters relating to personal data, write to kontakt.wybiegaj@gmail.com (preferably with “GDPR” in the subject line) or to our registered address. We have not appointed a data protection officer.

3. This Policy covers the wybiegaj.com website, the web application at app.wybiegaj.com, the mobile applications for Android and iOS and the patron panel at patron.wybiegaj.com (together, the “Service”). Capitalised terms (e.g. Event, Registration, Pack) have the meanings given to them in the Terms of Service.

4. “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation), and “EEA” means the European Economic Area.

2. Where we get your data from

You provide most of the data yourself – when you create an account, register for Events and use the Service. We receive some data from others: from Google, Apple or Facebook (if you sign in with them), from Strava (if you connect it to your account), from PayU (payment status), from InPost (parcel status), from an affiliate network (the identifier of your click on a partner link) and from a Patron link or referral link (the code it contains). Some data is generated automatically when you use the Service (e.g. server logs).

3. Purposes, legal bases and retention periods

3.1. Account

Data: email address, password (we store only its cryptographic hash), display name, optionally date of birth, gender and profile photo, language and other settings, saved delivery addresses; when you sign in with Google, Apple or Facebook – your account identifier with that provider, your email address and whether it is verified, and your first name or name (for Sign in with Apple we also store an encrypted token that allows us to disconnect your Apple account when you delete your account).

Purpose and legal basis: concluding and performing the Account agreement (Article 6(1)(b) GDPR).

Retention: until the account is deleted. We delete accounts that are not activated 30 days after registration, and activation and password reset codes 7 days after they expire.

3.2. Event participation, Activities and Rankings

Data: Registrations and their status, Counting Windows, progress and Completions; Activity data: type, name, distance, time, start date, average and maximum speed, elevation gain, calories, the private flag and Activity photos (we remove their metadata, including GPS location); Ranking results.

Purpose and legal basis: performing the Registration and the Account agreement (Article 6(1)(b) GDPR), including showing your display name and result in Rankings – you can hide your name in the settings (Settings → Personal details → “Hide me in rankings”); verifying the plausibility of results and preventing fraud – our legitimate interest (Article 6(1)(f) GDPR).

Retention: Activities – until you delete them or delete your account. A deleted Activity is no longer shown or counted, but we keep its record (without the photo and the route) until the account is deleted, to prevent abuse and the same activity being imported again. Event participation data – until the account is deleted, and to the extent related to an order – like order data (section 3.4).

Recording a workout in the app: if you record a workout in the app, we use your device's location (GPS) – only from the moment you start the recording yourself until it ends (also with the screen locked, for as long as the recording lasts). The app uses it to calculate the Activity's distance and time and, when you finish, sends us – along with the Activity data – the workout's route: a simplified path (the coordinates of successive points, without the times you were at them), the number of points and the area the route covers. Purpose: showing you the route on a map and checking that the distance given matches the route. Legal basis: performance of the Account agreement (Article 6(1)(b) GDPR). Only you can see the route – we do not show it to other Users, in Rankings or to Patrons. Retention: until the Activity is deleted (we delete the route straight away, even where we keep the record of a deleted Activity) or until the account is deleted. Recording is voluntary, and you can withdraw access to location at any time in your device's settings.

3.3. Strava integration

If you connect your account to Strava, Strava sends us – on your instruction – your Strava account identifier and Activity data: identifier, type, name, distance, time, start date, speed, elevation gain, calories and privacy flag. We do not store heart rate data, GPS routes or photos from Strava. We store encrypted access tokens. Legal basis: performance of the contract (Article 6(1)(b) GDPR). You can remove the connection at any time in the Service settings (Settings → Strava) – we will then delete the tokens and revoke access, and the imported Activities will remain in your account until you delete them. If, however, you revoke access in your Strava settings, we will delete the tokens and permanently delete every Activity imported from Strava (including its records); Activities added manually will remain, and your progress in Events will be recalculated without the deleted Activities. Strava, Inc. processes your data as a separate controller under its own privacy policy.

3.4. Orders, payments and invoices

Data: order details (Event, Pack and its variants, prices, discounts, Vouchers and Discount Codes used, Patron code), first and last name, email address, phone number, invoice details (company name, tax ID, address), payment status and identifier, and the IP address passed to PayU during payment.

Purpose and legal basis: concluding and performing the Registration (Article 6(1)(b) GDPR); issuing invoices, tax settlements and keeping accounting records – a legal obligation (Article 6(1)(c) GDPR in conjunction with tax and accounting law); establishing, pursuing and defending claims – our legitimate interest (Article 6(1)(f) GDPR).

Retention: 5 years from the end of the calendar year in which the tax payment deadline expired or, if the limitation period for claims ends later, until it ends. We keep this data even after the account is deleted.

3.5. Pack delivery

Data: the recipient's first and last name, phone number, email address, delivery address or Paczkomat locker number, parcel number and status.

Purpose and legal basis: delivering the Pack – performance of the contract (Article 6(1)(b) GDPR). For this purpose we share the data with InPost sp. z o.o.

Retention: like order data (section 3.4).

3.6. Vouchers, Discount Codes and the Referral Programme

We process information about Vouchers and Discount Codes granted and used, your referral code, information about who referred you and whom your account has referred, and the data needed to check the conditions of promotions (e.g. whether the account is new). Legal basis: performance of the contract (Article 6(1)(b) GDPR) and preventing abuse – our legitimate interest (Article 6(1)(f) GDPR). Retention: until the account is deleted, and information about discounts applied to orders – like order data (section 3.4).

3.7. Emails and notifications

We send messages related to your account and Registrations (e.g. activation codes, Registration confirmations, parcel information) – performance of the contract (Article 6(1)(b) GDPR). If you allow push notifications, we store your device token and notification settings – until you sign out on that device, switch notifications off or delete your account.

3.8. Marketing

  1. Newsletter – email address, date and source of subscription, confirmation of subscription and any unsubscription. Legal basis: your consent (Article 6(1)(a) GDPR and Article 398 of the Polish Electronic Communications Law). Subscribing through the form on the website requires confirmation via a link valid for 48 hours; we delete unconfirmed subscriptions 30 days after the link expires. After you unsubscribe, we keep your address for 30 days and then delete it.
  2. Push notifications about new Events and promotions and partner offers – based on your consent (Article 6(1)(a) GDPR and Article 398 of the Polish Electronic Communications Law), until you withdraw it. Partner offers are sent by us – we do not share your data with partners.

You can withdraw your consents at any time – in your account settings (Settings → Your consents), using the link in a message or by writing to us – without affecting the lawfulness of processing before the withdrawal. Withdrawing your newsletter consent unsubscribes you from the newsletter. Subscribing to the newsletter may entitle you to a Voucher under the Terms of Service; withdrawing your consent does not cancel a Voucher already granted.

3.9. Patron Programme

Application to the Programme: first and last name, email address, optionally phone number, category (e.g. runner, club, coach, brand), city, links to social media profiles, number of followers, a description of your motivation and the date of consent. Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). We delete rejected applications after 12 months.

Participation in the Programme: Patron code, display name (visible to buyers who enter your code), commission accruals and payouts, and payout details (first and last name or company name, address, bank account number, tax ID). Legal basis: performance of the contract (Article 6(1)(b) GDPR) and tax and accounting obligations (Article 6(1)(c) GDPR). Retention: until the end of participation in the Programme, and payout data – like order data (section 3.4).

A Patron sees only aggregate statistics – we do not give them buyers' data.

3.10. Affiliate networks

If you arrive at the Service via an affiliate partner's link, we remember the click identifier. After you register or pay for a Registration, we send the affiliate network: the click identifier, the transaction identifier (the order number or the account identifier), the amount excluding the courier delivery surcharge, the currency, and the status and type of the transaction – without your name, email address or other contact details. Legal basis: our legitimate interest in settling our cooperation with partners (Article 6(1)(f) GDPR). Retention: until our cooperation with the partner has been settled and the limitation period for claims has expired. How the identifier is stored on your device is described in section 11.

3.11. Analytics

On wybiegaj.com and in the web application at app.wybiegaj.com – only with your consent given in the banner (Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law) – we use Google Analytics 4, provided by Google Ireland Limited, to obtain statistics on visits to and use of the Service. We do not enable advertising signals or ad personalisation, and we send the addresses of visited pages without query parameters. The mobile apps do not use any analytics tools. We keep data in Google Analytics for no longer than 14 months. You can change your consent at any time using the “Cookie settings” link in the website footer or in the web app settings (Settings → Cookies).

3.12. Security, logs and backups

We process IP addresses, browser and device information, dates and times of events, information about sessions and sign-ins and a security event log – to ensure the security and continuity of the Service, detect abuse and establish, pursue and defend claims, which is our legitimate interest (Article 6(1)(f) GDPR). We send information about application errors (a description of the error and where it occurred in the code, the request address and method, technical server data and, exceptionally, data contained in the error message, e.g. an email address) to the Sentry service so that we can detect and fix faults quickly; we do not send it IP addresses, cookies or the content of forms. From the mobile apps and the web app we send Sentry reports of application errors and freezes: a description of the error and where it occurred in the code, the screen it occurred on, the device model, and the system and app versions – without an email address, account identifier, IP address or the content of forms. Retention periods:

  • web server logs – 14 days; system and application logs – up to 30 days;
  • session information (IP address, browser, device name) – up to 30 days after the session expires or ends;
  • records of failed sign-in attempts – 7 days;
  • the security and administrative actions log – 12 months;
  • error reports and logs in the Sentry service – up to 90 days;
  • backups – 14 days; data deleted from the Service disappears from backups no later than after this period.

3.13. Contact, complaints and exercising your rights

We process contact details and the content of correspondence to handle enquiries and complaints (Article 6(1)(b), (c) or (f) GDPR – depending on the matter) and to respond to requests to exercise your rights (Article 6(1)(c) GDPR) – for as long as needed to deal with the matter and then until the limitation period for claims expires.

3.14. Document acceptances and consents

We keep records of the acceptance of documents and of consents given and withdrawn: which document and which version they concern, when they were made, and the IP address and browser information. We do this to be able to demonstrate that our processing is lawful (Article 6(1)(c) in conjunction with Article 7(1) GDPR and Article 6(1)(f) GDPR). Retention: for as long as you use your account and until the limitation period for claims expires; after the account is deleted, we remove the IP address and browser information from these records.

3.15. Our social media profiles

We run profiles on Facebook and Instagram. If you contact us or comment on our posts, we process your name, the content of your comments and messages and the statistics provided by Meta – to communicate with you and run the profiles, which is our legitimate interest (Article 6(1)(f) GDPR). For profile statistics (Page Insights) we are a joint controller with Meta Platforms Ireland Limited; Meta's processing is described in its privacy policy.

4. Who we share data with

Your data may be received – only to the extent needed for the given purpose – by:

  1. OVHcloud – the provider of the server the Service runs on (the server is located in Poland);
  2. Brevo (Sendinblue SAS, France) – sending emails;
  3. Sentry (Functional Software, Inc., USA; data stored in the European Union) – application error monitoring;
  4. Expo (650 Industries, Inc., USA) – delivering push notifications, through Apple Push Notification service and Firebase Cloud Messaging (Google);
  5. PayU S.A., based in Poznań – payment processing; for payments PayU is a separate controller;
  6. InPost sp. z o.o., based in Kraków – delivering Packs; when you open the Paczkomat map, your browser also connects to InPost's servers, which may receive your IP address;
  7. Strava, Inc. (USA) – if you connect your account to it, as a separate controller;
  8. Google Ireland Limited, Apple Distribution International Limited and Meta Platforms Ireland Limited – when you sign in with Google, Apple or Facebook (as separate controllers), and Google also as the provider of Google Analytics;
  9. affiliate networks – only the data described in section 3.10, without contact details;
  10. providers of accounting, legal, IT and advisory services to us – under contracts and subject to confidentiality;
  11. other Users and website visitors – your display name and results in Rankings, according to the Event settings and your privacy settings; and, for Patrons – the Patron's display name, visible to buyers who enter their code;
  12. public authorities and other entities authorised by law – where we are legally obliged to share the data.

When you download a mobile app, you also use the Apple App Store or Google Play, which process data under their own rules.

5. Transfers outside the EEA

We store the Service's data on a server in Poland. Some of the providers listed (Google, Apple, Meta, Expo, Strava, Sentry) may process data in the United States or other countries outside the EEA. Such transfers are based on a European Commission adequacy decision – including the EU-US Data Privacy Framework for entities covered by it – or on standard contractual clauses approved by the European Commission. You can obtain a copy of these safeguards by writing to us.

6. Your rights

You have the right:

  • to access your data and obtain a copy of it – you can download a file with your data in the app (Settings → Personal details → “Download my data”);
  • to rectify your data – you can correct most of it yourself in your account settings;
  • to erasure – you can delete your account in the app (Settings → Delete account) or by following the instructions at wybiegaj.com/en/delete-account; we keep some data longer where the law requires it (section 3.4);
  • to restrict processing;
  • to data portability for data processed on the basis of a contract or consent – in a structured format (JSON);
  • to object to processing based on our legitimate interest – on grounds relating to your particular situation, and to direct marketing – at any time;
  • to withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal;
  • to lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

We respond to requests without undue delay and in any event within one month. Where justified, this period may be extended by a further two months – in which case we will let you know. We may ask you to confirm your identity, e.g. by sending the request from the email address assigned to your account.

7. Do you have to provide data

Providing data is voluntary, but necessary to: create an account (email address and password, or signing in with Google, Apple or Facebook), register for an Event and receive the Pack (delivery details), receive an invoice (invoice details) and take part in the Patron Programme (application and payout details). Your date of birth, gender, profile photo, Strava connection and recording workouts in the app (access to location) are optional.

8. Automated decision-making

The Service determines Event progress and Completion – on which the shipping of the Pack depends – automatically on the basis of the recorded Activities, which is necessary to perform the Registration (Article 22(2)(a) GDPR). We also apply automated plausibility rules to Ranking results (e.g. pace thresholds). You can challenge such a result, express your point of view and ask for it to be reviewed by a person acting on our behalf – write to kontakt.wybiegaj@gmail.com. Apart from this, we do not take decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

9. Data security

We apply technical and organisational measures appropriate to the risk, in particular: encrypted connections (TLS), storing passwords only as cryptographic hashes, encrypting access tokens for external services, controlling and logging administrative access, removing metadata from photos and regular backups.

10. Minors

The Service is intended for people aged 16 and over. We do not knowingly collect data from younger people – if we learn that an account was created by a person under 16, we will delete it.

11. Cookies and similar technologies

1. Cookies are small files that your browser saves on your device. Browser local storage (localStorage and sessionStorage) and the secure data storage of the mobile app work in a similar way. We use them for two purposes:

  1. strictly necessary – to operate the Service and provide the services you ask for (e.g. keeping you signed in, remembering your settings and your cookie choice, applying the code from a link that was clicked). We do not need consent to store them (Article 399(3) of the Polish Electronic Communications Law);
  2. analytics and attribution – for statistics (Google Analytics) and for remembering a Patron code or a partner's click identifier in the browser. We store them only with your consent given in the banner.

wybiegaj.com website

  • consent.analytics (browser storage) – your choice regarding analytics cookies; 12 months, after which we ask again; strictly necessary.
  • prefs.theme (browser storage) – the chosen theme (light or dark); until you remove it; strictly necessary.
  • carry (browser storage) – codes from Patron, referral and partner links passed on to the app; only with consent; at most 30 days. Without consent, a code is only passed along in the addresses of the pages you visit and is not saved on your device.
  • _ga and _ga_* (Google Analytics cookies) – statistics; only with consent; up to 13 months.

Web application at app.wybiegaj.com

  • bnm.tokens (browser storage) – session data that keeps you signed in; until you sign out; strictly necessary.
  • prefs.language and prefs.theme – language and theme; until you remove them; strictly necessary.
  • consent.analytics – your cookie choice; 12 months, after which we ask again; strictly necessary.
  • referral.pendingCode – the referral code from a link that was clicked, or typed in the sign-up form, so that it can be applied when you register; a code from a link for up to 30 days; strictly necessary.
  • patron.pendingCode and affiliate.pendingClick – the Patron code and the partner's click identifier from a link, needed to attribute a Registration to the Patron or partner; in browser storage only with consent (without consent – only until the tab is closed); up to 30 days or another period set by the partner.
  • workout recording (browser storage) – the state of an unfinished recording and the route's points, so that it can be resumed after the page is reloaded; until the workout is saved or discarded; strictly necessary.
  • browser tab storage (sessionStorage): auth.pendingEmail and links.lastClaimed – technical data for registration and link handling; until the tab is closed; strictly necessary.
  • _ga and _ga_* (Google Analytics cookies) – statistics; only with consent; up to 13 months.

Mobile apps

In the device's secure data storage we keep: session data, the push notification token, language and theme, as well as codes from links that were clicked – the referral code, the Patron code and the affiliate partner's click identifier (except for partners whose rules require consent to tracking) – until they are used or expire, for no longer than 30 days or another period set by the partner. While you record a workout, the app keeps the recording's state and the route's points on the device, and a recording that could not be sent for lack of an internet connection – until it is sent or discarded. The mobile apps contain no analytics or advertising tools; they contain an error reporting tool (Sentry, described in section 3.12). The Facebook SDK is used only for signing in – automatic event collection and the advertising identifier are disabled in it.

Patron panel

In browser storage we keep session data (patron.tokens) and the chosen language (patron.lang) – strictly necessary for the panel to work.

Third-party services

The Google, Apple and Facebook sign-in buttons load those providers' scripts only when you press them. The InPost Paczkomat map loads only when you open it. The map of a workout's route uses OpenFreeMap tiles (data © OpenStreetMap contributors) – when it is shown, your device downloads map tiles from OpenFreeMap's servers, which may receive your IP address and the area being shown. Payment takes place on PayU's page, which uses its own cookies.

2. You can change your consent to analytics cookies at any time using the “Cookie settings” link in the website footer or in the web app settings. You can also delete cookies and site data in your browser settings – but some features (e.g. staying signed in) may then stop working.

12. Changes to this Privacy Policy

We may change this Policy when the law requires it or when our services, providers or ways of processing data change. We will inform you of material changes in the Service or by email. The current version and the date from which it applies are always available in the Service.