Privacy Policy

1. Data Controller

The controller of personal data processed in connection with the operation of the Service is the entity operating the Service under the miejski.bike brand (hereinafter: the „Controller"). In all matters concerning the processing of personal data, the exercise of the rights of data subjects and the application of this Policy, the Controller may be contacted at the following email address:

Contact

hello@miejski.bike

The Controller has not appointed a data protection officer (DPO) within the meaning of Article 37 of the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council, hereinafter: the „GDPR"), as the conditions for mandatory appointment are not met. Contact regarding all matters connected with the protection of personal data is provided via the indicated email address.

2. Scope of the Policy and absence of User accounts

Within the Service there are no mechanisms for registration, login, User accounts, contact form, payments, comments or profile panel. The Controller does not maintain any database of first names, surnames, telephone numbers, residential addresses or payment card details.

The absence of accounts and the absence of voluntarily collected data does not, however, mean that use of the Service is free from any technical processing of data. The scope of such processing depends on the version of the Service used, the type of device, the operating system and the external service providers, and is set out in detail in the further provisions of this Policy.

Contact via hello@miejski.bike is carried out by means of the User's email client. If the User sends a message, its content and contact data may be processed by the User's email provider and by the Controller for the purpose of providing a response.

3. Purposes and legal bases of processing

The Controller processes personal data for the following purposes and on the following legal bases arising from Article 6 of the GDPR:

• to ensure the proper functioning of the Service, IT security and technical analysis of traffic (including handling of hosting logs, statistics of API responses and protection against abuse) — pursuant to Article 6(1)(f) GDPR (the legitimate interest of the Controller consisting in maintaining the stability, quality and security of the Service);
• to make available functions based on device location and to process analytical data in the Mobile Applications and the Web Map — pursuant to Article 6(1)(a) GDPR (the User's voluntary consent expressed in the settings of the operating system or browser, which may be withdrawn at any time);
• to handle correspondence sent by the User to the Controller's email address — pursuant to Article 6(1)(f) GDPR (the legitimate interest of the Controller consisting in providing a response to the enquiry);
• to handle complaints, establish, exercise or defend claims and to fulfil obligations arising from generally applicable law — pursuant to Article 6(1)(c) and (f) GDPR.

The provision of any personal data is voluntary. Refusal of consent to the processing of analytical data or to access to location data may result in a limitation of certain functions of the Service; it does not, however, deprive the User of access to its basic functions.

4. Technical data resulting from use of the Internet

The Controller informs that the very establishment of a connection with the Internet results in the processing of certain technical data. The browser, operating system, hosting provider, network and external services may technically process in particular: the IP address, the User-Agent identifier, information concerning the device and operating system, the request time and diagnostic data.

The Controller does not use such data to create an account or to knowingly identify a natural person by first name and surname. However, technical data may be subject to personal data protection provisions where they enable indirect identification of a natural person.

5. Location

The website and the Mobile Applications may initiate a request for access to the device's location for the purposes of centring the map, matching the city or presenting nearby points. The transfer of location data is optional and conditional upon the granting of consent in the settings of the browser or operating system.

In the Android application, location data is not transmitted to the Controller's server as an element of the User's profile, but is used only locally on the device for the centring of the map, sorting of results, matching of the zone and other map functions. Processing of data by the operating system, the Mapbox service, Google Play Services or the geocoding service is subject to the separate rules of the respective providers.

In the iOS application, location data is obtained using the „while using the app" permission. The analytical code creates a Firebase Analytics event containing the latitude and longitude rounded to four decimal places and sets the zone identifier as an analytical property. If iOS analytics is active in the production configuration, the aforementioned information may be linked by the Firebase service with the technical data of the application instance.

The Web Map uses the Mapbox GeolocateControl component with high accuracy and, under certain conditions, automatically initiates a geolocation request upon loading of the page. The map may also store the current view in a fragment identifier of the URL, as a result of which the shared URL may contain approximate geographical coordinates of the selected view.

The User is entitled to refuse the location permission. In such a case, the basic functions of the map remain available, with the exception of functions based on location.

6. Mobile Applications — service providers and processors

The Mobile Applications use the services of Google/Firebase, Mapbox and the services of the Android and iOS operating systems. The indicated entities act as processors within the meaning of Article 28 GDPR or — to the extent carried out independently — as separate controllers. In the current version of the Service, the following data flows technically occur:

• Firebase Analytics in the Android application — receives events concerning the selected zone, POIs and data refresh;
• Firebase Analytics in the iOS application — receives events concerning location, zone, selected POIs, location tracking, map style, menu, legend and synchronisation;
• Firebase Crashlytics — receives information about errors, technical logs and device diagnostic data;
• Firebase Remote Config — supplies the application with the map configuration and data refresh frequency;
• Mapbox Inc. and the respective Google and Apple system services — handle maps, location data, geocoding and map data;
• iOS — stores map data in a local Realm database and preserves settings, the last location and the record of Terms acceptance in the device's local storage.

The scope, retention and place of storage of data on the providers' side are also determined by their configuration and terms of service.

7. Technical identifier of application requests

The Android application transmits to the Controller's server a User-Agent header value containing, in particular, the application version number, the Firebase Installation ID, the Android system version and the device model. The server uses the aforementioned value solely for the purpose of maintaining technical endpoint statistics for valid, unauthorised and erroneous requests, and not for the purpose of creating an account or User profile.

The daily statistical records are intended for short-term aggregation. After a report has been generated, the detailed records are deleted by the appropriate server process; statistical aggregates are retained in accordance with the rules set out in § 9 of the Policy.

8. Web applications and cookies

The Main Website and the Web Map constitute two separate, technically independent web applications differing in the scope of external libraries used and the manner of data processing. The rules for the processing of data for each of the applications are set out separately in the provisions of this section.

8.1. Main Website (miejski.bike)

The Main Website does not use its own account system, forms, localStorage mechanism or proprietary analytics. The website does, however, load external resources, in particular the Mapbox GL JS library, Mapbox resources and Google Fonts. External providers and the hosting provider may receive technical data necessary to handle the request, in particular the IP address and HTTP request headers.

8.2. Web Map (miejski.bike/mapa)

The Web Map constitutes a separate, historical web application, independent of the Main Website in terms of source code and external libraries used. This application uses the Google Analytics service provided by Google Ireland Limited (hereinafter: „Google"). The analytical script initialises measurement and transmits a page-view event to Google. Google Analytics in its standard configuration uses cookies and processes in particular the IP address, information about the browser and device, the visit time and analytical identifiers.

Within the Google Analytics services, in particular the following cookies may be used:

• _ga — used to distinguish Users; storage period: up to 2 years;
• _gid — used to distinguish Users; storage period: up to 24 hours;
• _gat — used to throttle the rate of requests sent to Google Analytics; storage period: up to 1 minute.

The User is entitled to manage cookies through the settings of their own browser, including by blocking or deleting them. Disabling cookies may affect the functioning of certain elements of the Service.

9. Data retention periods

• map data, the selected zone, the last location and application settings are stored locally on the User's device, in particular in the Realm database and in UserDefaults, until the application data is deleted or the application is uninstalled;
• data of daily server statistics is stored until the aggregation process is performed, after which it is deleted; statistical aggregates are stored for the period necessary to achieve the purpose for which they were collected;
• application logs are stored for a maximum period of 30 days in the standard configuration; hosting logs, reverse proxy logs and backup copies may be subject to separate storage periods resulting from the service provider's configuration;
• data processed by Firebase Analytics, Firebase Crashlytics, Google Analytics, Mapbox, the hosting provider and the email service provider is stored in accordance with the configuration and rules of those providers; in particular, in Firebase Analytics and Google Analytics the maximum event data retention period results from the retention settings in the administration panel of the given service;
• electronic correspondence directed to the Controller is stored for the period necessary to provide a response and for the duration of any potential establishment or defence of claims.

10. Transfer of data to third countries

In connection with the use of services provided by Google LLC (Firebase, Google Analytics), Mapbox Inc. and Apple Inc., User data may be transferred to countries located outside the European Economic Area, in particular to the United States of America.

The aforementioned transfer takes place on the basis of instruments legalising the transfer of data, referred to in Chapter V of the GDPR, in particular:

• Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 finding an adequate level of protection of personal data under the EU–U.S. Data Privacy Framework (DPF) — with regard to providers holding DPF certification;
• Standard Contractual Clauses adopted by the European Commission — with regard to transfers carried out outside the DPF mechanism.

Detailed information concerning the rules for the transfer of personal data by the indicated providers is set out in their privacy policies and terms of service.

11. Data security

The Controller implements appropriate technical and organisational measures to ensure the security of processed data, adequate to the identified risk of infringement of the rights or freedoms of data subjects, in accordance with Article 32 GDPR. In particular, the Controller ensures:

• encryption of data transmission using the HTTPS (TLS) protocol;
• restriction of access to systems and data to authorised persons only;
• use of the services of reputable infrastructure providers holding recognised security certifications (including ISO/IEC 27001 and SOC 2);
• ongoing updates of software components and monitoring of security events.

12. Automated decision-making and profiling

The Controller does not take, in relation to Users, decisions which are based solely on automated processing of data, including profiling, and which produce legal effects concerning them or similarly significantly affect them, within the meaning of Article 22 GDPR.

13. Data of persons under 16 years of age

The Service is not directed to persons under 16 years of age. The Controller does not knowingly collect personal data of persons who have not attained 16 years of age. In the event of obtaining credible information that data of such a person has been transmitted without the required consent of a parent or legal guardian, the Controller shall immediately take the necessary steps to delete such data.

14. Rights of data subjects

To the extent that the Controller processes the User's personal data, the User has the rights arising from the GDPR, including the right to:

• access data and obtain a copy thereof (Article 15 GDPR);
• rectify inaccurate data or complete incomplete data (Article 16 GDPR);
• erase data („right to be forgotten") (Article 17 GDPR);
• restrict processing of data (Article 18 GDPR);
• object to processing of data based on Article 6(1)(f) GDPR (Article 21 GDPR);
• data portability (Article 20 GDPR);
• withdraw consent at any time where processing is carried out on the basis of consent, whereby withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal (Article 7(3) GDPR).

The data subject is also entitled to lodge a complaint with a supervisory authority, which in the Republic of Poland is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), with its seat at ul. Stawki 2, 00-193 Warsaw.

A request in the scope of the exercise of the above rights should be directed to the email address hello@miejski.bike. Given that the Service does not maintain User accounts, additional information enabling the location of the data to which the request pertains may be necessary in order to consider the request. Data processed independently by Google, Firebase, Mapbox, Apple, the hosting provider or the email service provider may require the request to be directed to the relevant controller.

15. Amendments to the Policy

The Policy may be updated in connection with a change in the scope of services provided, the configuration of external providers or generally applicable law. The current version date of the Policy is indicated in this document. Changes of a significant nature will be communicated to Users in a manner appropriate to the scope of the change.