Librent Privacy Policy

Translation notice. This English translation is provided for information only and is pending legal review. The Polish version is the binding version and prevails in the event of any discrepancy.

This Privacy Policy describes the rules for processing personal data in the Librent service (hereinafter the "Service"), operated by DydlakCloud Dawid Dydliński (hereinafter the "Controller"). This document fulfils the information obligation under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

1. Data controller

1. The controller of your personal data is DydlakCloud Dawid Dydliński, the operator of the Librent Service, conducting business in the form of Indywidualna działalność gospodarcza (CEIDG).
2. Registration details of the Controller:
   • Name: DydlakCloud Dawid Dydliński
   • Address: ul. Zebrzydowicka 12 lok. 5, 44-200 Rybnik
   • NIP (Tax ID): 6423227346
   • REGON (Statistical No.): 387752266
3. The Controller may be contacted on data protection matters in writing at: ul. Zebrzydowicka 12 lok. 5, 44-200 Rybnik, or electronically at the email address: [email protected].
4. If the Controller appoints a Data Protection Officer, their contact details will be made available on this page and at the address above.

2. Purposes and legal bases of processing

Personal data is processed for the following purposes:

1. Concluding and performing the agreement for the provision of electronically supplied services (registration, access to the Account, Organisations and features of the Service) — legal basis: Article 6(1)(b) of the GDPR.
2. Fulfilling legal obligations incumbent on the Controller (e.g. issuing and storing invoices, tax settlements, preventing abuse) — legal basis: Article 6(1)(c) of the GDPR.
3. Establishing, exercising or defending legal claims — legal basis: Article 6(1)(f) of the GDPR (the Controller's legitimate interest in protecting its rights).
4. Ensuring the security and technical correctness of the Service (logging, monitoring, backup, audit) — legal basis: Article 6(1)(f) of the GDPR.
5. Visit statistics (aggregated traffic statistics collected without cookies) — legal basis: Article 6(1)(f) of the GDPR (the Controller's legitimate interest in maintaining and improving the Service).
6. Marketing (newsletter) — solely on the basis of separate, voluntary consent — Article 6(1)(a) of the GDPR, if given.
7. Answering enquiries (e.g. sent by email about the Service, pricing or enabling the paid plan) — legal basis: Article 6(1)(b) of the GDPR (steps taken at the data subject's request prior to entering into a contract) or Article 6(1)(f) of the GDPR (the Controller's legitimate interest in responding).

3. Scope of data processed

In connection with the use of the Service, the Controller processes the following categories of personal data:

• Account data: first and last name, email address, encrypted password;
• Organisation data: name, members, roles;
• Data entered by the User in the course of its business (data of the User's customers, equipment descriptions, the content of bookings and agreements) — the User is the controller of this data and DydlakCloud Dawid Dydliński its processor under the data processing agreement set out in § 14 of the Terms of Service;
• Technical data: IP address, browser type, access logs (for the period necessary for security, max. 12 months);
• Communication data: the content of correspondence with support.

4. Recipients of data

Personal data may be disclosed, solely to the extent necessary to provide the services, to the following categories of recipients (processors):

• Providers of cloud infrastructure and data storage (hosting, database, object file storage) — in EEA countries or on the basis of appropriate data processing agreements and safeguard clauses;
• Providers of email services (verification and transactional emails, newsletter);
• Provider of the visit statistics tool (script loaded from tracking.sitehero.pl) — the tool uses no cookies or browser storage and provides the Controller with aggregated statistics only;
• Public authorities — solely where required by law, on the basis of an appropriate order.

Data is not transferred to third countries (outside the EEA) without appropriate safeguards, such as contractual clauses approved by the European Commission (Standard Contractual Clauses), or on the basis of an adequacy decision.

5. Data retention period

1. Account data is stored for the duration of the agreement and deleted within 30 days of its termination, except for data that must be retained longer by law (e.g. accounting/tax records — 5 years).
2. Technical data (logs) is stored for no longer than 12 months.
3. Data entered by the User (customers, equipment, bookings) is stored until it is deleted by the User or the Account is deleted.
4. Data processed on the basis of marketing consent is stored until the consent is withdrawn.
5. Correspondence about enquiries is stored until the matter is concluded, for no longer than 12 months, unless a contract is concluded.

6. Your rights

Under the GDPR, you have:

• the right of access to your data and to obtain a copy of it (Article 15 of the GDPR);
• the right to rectification of inaccurate data (Article 16);
• the right to erasure ("the right to be forgotten") — Article 17, subject to the exceptions provided by law;
• the right to restriction of processing (Article 18);
• the right to data portability (Article 20) — with respect to data processed on the basis of a contract and by automated means;
• the right to object to processing based on legitimate interest (Article 21);
• the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Article 7(3));
• the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).

To exercise your rights, contact the Controller at [email protected]. The Controller handles requests without undue delay and in any event within one month.

7. Requirement to provide data

Providing data (first and last name, email, password) is voluntary but necessary to create an Account and use the Service. Refusal to provide the data makes registration impossible.

8. Automated decision-making and profiling

Your data is not used for fully automated decision-making producing legal effects concerning you or similarly significantly affecting you (Article 22 of the GDPR). Behavioural analysis, if carried out, is statistical in nature and does not lead to individual profiling.

9. Consents

1. During registration, explicit, voluntary consent is required to:
   • accept the Terms of Service of the Service;
   • accept this Privacy Policy (information on the processing of data for the performance of the agreement).
2. Consent is recorded together with the date and the version of the documents that were accepted.
3. Marketing consents, if collected, are separate and voluntary — not giving them does not affect access to the core features of the Service.

10. Cookies and tracking technologies

1. The Service stores on the user's device only information that is strictly necessary to provide the service the user requested (Article 399(3)(2) of the Polish Electronic Communications Law). Such information does not require consent, so the Service does not display a cookie banner.
2. Cookies:
   • NEXT_LOCALE — the remembered interface language; set when a language is chosen or on sign-in; valid for 12 months;
   • sidebar_state — the remembered state (collapsed/expanded) of the side panel in the Organisation panel; valid for 12 months.
3. Browser storage (localStorage and sessionStorage) — used only after sign-in or while making a booking: the session authentication token, basic data of the signed-in user, the selected Organisation, the selected calendar view, a technical app-update flag and the cart contents in the booking form (removed when the tab is closed). The token and user data are removed on sign-out; the remaining data can be deleted in the browser settings.
4. The Service does not use analytics, marketing or third-party cookies. Visit statistics are collected without cookies and without storing any data on the user's device.

11. Data security

The Controller applies appropriate technical and organisational measures to ensure data security, in particular:

• encryption of data at rest (database, storage) and in transit (TLS);
• passwords stored in one-way hashed form;
• access to data restricted to authorised persons;
• regular backups and restore procedures;
• encryption of sensitive fields in the database.

12. Changes to the Privacy Policy

The Controller reserves the right to amend this Privacy Policy (e.g. due to changes in the law or in the functionality of the Service). We will inform you of material changes by email or by a notice in the Service at least 14 days before they take effect. The current version and date are always shown at the top of the document.

13. Contact

For matters relating to the protection of personal data, contact the Controller at: [email protected] or in writing at: ul. Zebrzydowicka 12 lok. 5, 44-200 Rybnik. Please also read the Terms of Service at /en/terms.