Privacy notice

1. Data controller and contact

Controller: PobytWait project owner

Privacy contact: info@pobytwait.pl

2. What we collect

• Application type (TRC or PRC)
• Submission location (urząd wojewódzki, voivodeship office)
• Nationality and legal basis category
• Milestone dates for submission, fingerprints, decision and card collection
• Optional applicant comment (must not include direct personal identifiers)
• Review status and moderation notes for data quality
• Basic technical request logs for abuse prevention and security
• Anti-bot challenge metadata from Cloudflare Turnstile when enabled
• Hashed edit-key credential used to authorise future updates to the same submission

You must not submit names, passport numbers, case IDs, phone numbers, addresses, or any other direct identifiers.

3. Purposes and legal bases

• Operating timeline statistics and displaying aggregated trends (consent, GDPR Article 6(1)(a)).
• Detecting abuse, spam and manipulation attempts, including anti-bot verification and edit-key checks (legitimate interests, GDPR Article 6(1)(f)).
• Maintaining minimal records needed for legal and security obligations (legal obligations, GDPR Article 6(1)(c), when applicable).

You can withdraw consent for your submission by contacting us and providing your submission reference ID.

4. How long we keep data

• Raw timeline rows: up to 36 months from submission, then deleted or irreversibly aggregated.
• Moderation metadata: up to 36 months.
• Security and access logs: typically up to 30 days unless needed for incident investigation.

5. Sharing and international transfers

We use processors to run the service, including hosting and database providers.

• Vercel (application hosting and delivery)
• Supabase (database and API platform)
• Cloudflare Turnstile (anti-bot verification, when enabled)

Data is intended to be hosted in the EU. Where a provider processes data outside the EEA, we rely on safeguards such as the EU Standard Contractual Clauses.

6. Your GDPR rights

You can request access, rectification, erasure, restriction, portability, or objection where applicable.

To submit a request, email info@pobytwait.pl and include your submission reference ID if available.

You also have the right to complain to your supervisory authority. In Poland, this is the President of the Personal Data Protection Office (UODO).

7. Automated decision-making

We do not make legal or similarly significant decisions about individuals using automated processing. Data is used for aggregate statistics and moderation only.

8. Related notices

Read the cookie notice for details on cookie usage and similar technologies.