Nearella Privacy Policy

1. Data controller

The controller of your personal data is [uzupełnić: nazwa firmy z CEIDG] — [uzupełnić: imię i nazwisko], [uzupełnić: adres wykonywania działalności], NIP [uzupełnić: NIP], REGON [uzupełnić: REGON] (we), the provider of Nearella described in the Terms of Service.

For anything about personal data, write to [uzupełnić: e-mail kontaktowy]. We have not appointed a data protection officer.

2. What data we process and why

Each purpose is described separately: what data, on what basis under Regulation (EU) 2016/679 (the GDPR) and for how long.

Correspondence within a request: message text, author, sending/editing time, read acknowledgements and archive state. The request author and profile owner can read messages; administrators may read them to operate and protect the service. Messages have no separate expiry and are deleted with the request when the author deletes their account. When a profile owner deletes their account, their messages in other people’s requests lose their text and author ID, and further messaging in those conversations is blocked. Deleted message text is erased immediately; a deletion placeholder remains. Notification e-mails contain an excerpt of up to 300 characters. Message limits use account IDs and sending times, with counters retained for up to 30 days.

• Account and sign-in.
  • Data: e-mail address, name, profile photo from Google (if you sign in with Google), account ID and, if you give them, phone number and e-mail language.
  • Purpose: creating and keeping your account, signing in.
  • Basis: the agreement for keeping the account (Article 6(1)(b) GDPR).
  • How long: until the account is deleted. The sign-in service provider removes the data from backups within 180 days.
• Requests to coaches and clubs.
  • Data: name, the account’s e-mail address, phone number and Telegram username (if you give them), sport, convenient times, message, date and recipient of the request.
  • Purpose: passing the request to the chosen coach or club and showing its status in your account.
  • Basis: your consent given in the form (Article 6(1)(a) GDPR) and the performance of the agreement (point (b)).
  • How long: as long as your account exists. A coach or club that receives a request (also by e-mail) keeps it as a separate controller.
• Preventing abuse of requests.
  • Data: account ID and the profiles a request was sent to on a given day.
  • Purpose: daily request limits that protect coaches from spam.
  • Basis: our legitimate interest in protecting the service (Article 6(1)(f) GDPR).
  • How long: 30 days, after which the data are deleted automatically.
• Coach and club profiles.
  • Data: name, sports, description, photos, training places (addresses and points on the map), prices, languages and links (WhatsApp, Instagram, Telegram, website, Google Maps) and, in the private settings, the e-mail and phone for notifications and a record of the consent to publication.
  • Purpose: publishing the profile, receiving requests and profile statistics. We remove metadata from photos, including GPS location.
  • Basis: the agreement (Article 6(1)(b) GDPR); for a profile we prepared with your consent — consent (point (a)).
  • How long: until the account or the profile is deleted or the consent is withdrawn. The data of a published profile are public.
• Coach applications from the “For coaches” form.
  • Data: name, sports, city, contact (Instagram, Telegram, phone or e-mail) and message.
  • Purpose: getting in touch about preparing a profile.
  • Basis: consent (Article 6(1)(a) GDPR).
  • How long: 365 days from sending, after which the application is deleted automatically; earlier if you withdraw your consent.
• “I train here” and coach–club links.
  • Data: the user’s name, the coach and the status of the mark; the linked coach and club profiles.
  • Purpose: confirming that someone trains with a coach (seen only by that person and the coach) and showing active coach–club links on both profiles.
  • Basis: the agreement (Article 6(1)(b) GDPR).
  • How long: until the mark or the link is withdrawn or the account is deleted.
• Profile statistics.
  • We count profile views, clicks on the contact buttons and requests to show coaches and clubs their statistics. So as not to count the same person several times a day, we make a hash of the IP address and browser data with a random daily value that we delete the next day. We do not store the IP address itself, and once that value is deleted the hash cannot be linked to a person. Visits by the profile’s owner are not counted.
  • Basis: legitimate interest (Article 6(1)(f) GDPR).
• Security of the service.
  • Data: IP address, browser and device data, time of events.
  • Purpose: protecting forms and accounts from bots and abuse (Firebase App Check with Google reCAPTCHA Enterprise on the request form and account actions), daily limits of the “For coaches” form and server logs.
  • Basis: legitimate interest (Article 6(1)(f) GDPR).
  • How long: server logs up to 30 days, daily counters 30 days; the sign-in service provider keeps sign-in IP addresses for a few weeks.
• E-mails.
  • Data: e-mail address and the content of the message.
  • Purpose: the sign-in link, notifying coaches and clubs of new requests and informing about the decision on publishing a profile.
  • Basis: the agreement (Article 6(1)(b) GDPR).
• Contacting us.
  • Data: e-mail address and the content of your message.
  • Purpose: replying, handling a complaint or a notice about content.
  • Basis: legitimate interest (Article 6(1)(f) GDPR) and, for complaints, a legal obligation (point (c)).
  • How long: until the matter is closed, then until claims are time-barred.

3. Who receives the data

• The coach or club you send a request to — only the data of that request.
• Everyone visiting the service — the data of a published coach or club profile.
• Service providers that process data on our behalf under data processing agreements: Google (Firebase and Google Cloud — hosting, database, files, server functions, sign-in, App Check and reCAPTCHA) and Resend (sending e-mails).
• Public authorities, where the law requires it.

We do not sell data.

4. Where the data are stored

The database, photos and server functions are kept in Google Cloud in Warsaw (region europe-central2), and the pages of the service are served from a Google data centre in the Netherlands (region europe-west4).

Outside the European Economic Area we process: sign-in data (the Firebase Authentication service runs in Google data centres in the USA), reCAPTCHA data (Google), analytics data when you consent (Google Analytics, Google Ireland Limited, with possible processing in the USA) and e-mails sent through Resend (USA). These transfers rely on the European Commission’s adequacy decision (EU–US Data Privacy Framework) or on standard contractual clauses approved by the Commission.

5. Cookies and browser storage

We use Google Analytics 4 only with your optional consent, to measure public page visits, searches, filters, contact clicks (including Telegram), requests and coach registrations. The legal basis is consent (Article 6(1)(a) GDPR). We send no names, contact details, messages, account identifiers or precise locations. Google may process technical data such as IP addresses and browser information. We do not use advertising cookies. Necessary browser storage includes:

• the “lang” cookie — the chosen page language, for a year, set when you change the language;
• Firebase Authentication sign-in data (IndexedDB) — keep you signed in;
• the e-mail address for signing in with a link (localStorage) — removed after signing in;
• the invitation token for taking over a profile (sessionStorage) — until the tab is closed;
• Firebase App Check and Google reCAPTCHA — on the request form and account actions they store a token and may set Google cookies that protect against bots.

Your analytics choice is saved in localStorage (nearella.analytics-consent) for 180 days. If storage is blocked, the choice lasts only for the current page. When enabled and accepted, GA4 uses _ga and _ga_* cookies, configured to expire after 180 days, and event data are retained for 2 months. Without consent, the Google Analytics tag is not loaded and no analytics events are sent. You can change or withdraw consent through Cookie settings in the footer. Withdrawal stops collection, removes accessible GA cookies and reloads the page; it does not affect processing before withdrawal.

You can delete or block cookies and browser storage in your browser settings; signing in does not work without them.

6. Third-party services on the pages

• The map uses free OpenFreeMap tiles with OpenStreetMap data. When you see the map, your browser loads its tiles from OpenFreeMap servers, which see your IP address.
• In the profile wizard, address search uses the Photon service of komoot GmbH (Germany): we send the address you type, and its server sees your IP address.
• The WhatsApp, Instagram and Telegram buttons and the links to coaches’ websites are plain links: data reach those services only when you click, under their own terms.
• When you sign in with Google, you use a Google service that gives us your name, e-mail address and photo; Google processes data under its own privacy policy.

7. Your rights

• You have the right to access your data, to rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interest.
• You may withdraw consent at any time; this does not affect the lawfulness of processing before the withdrawal.
• You can delete your account and the data linked to it yourself in the account settings. For anything else, write to [uzupełnić: e-mail kontaktowy] — we reply within a month.
• You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

8. Voluntary data and automated decisions

• Giving data is voluntary, but without an e-mail address you cannot create an account, and without a name and contact you cannot send a request.
• We make no decisions based solely on automated processing that would have legal effects on you, and we do not profile you for that purpose.
• An account may be created by a person aged 16 or older.

9. Changes to this policy

We update this policy when the features of the service or its providers change. We announce significant changes in the service or by e-mail. The version and the effective date are at the top of this page.