Privacy policy

This document says what data about you we hold, what for, how long we keep it and what you can do about it. It is short, because we collect little data.

The data controller

The controller of your personal data is: .

Contact in all matters concerning data: kontakt@polskicert.pl.

The basic rule

You can read and solve the task bank without an account and without giving any data at all. Data is needed only when you want to save your learning progress or to buy access.

What data we collect and what for

Data	What for	Legal basis
E-mail address	keeping the account, logging in, password recovery, confirming a purchase	art. 6 ust. 1 lit. b GDPR (performance of the contract)
Password as an irreversible hash	secure logging in; we do not know your password and it cannot be recovered from the database	art. 6 ust. 1 lit. b GDPR
Google account identifier	logging in with a Google account, if you choose this method	art. 6 ust. 1 lit. b GDPR
Dates and times of logins and of failed login attempts	protecting the account against takeover and limiting attacks on the password	art. 6 ust. 1 lit. f GDPR (legitimate interest: security)
Learning progress (which items you have solved, whether correctly, when)	showing statistics, resuming your learning from the right place	art. 6 ust. 1 lit. b GDPR
Payment data (transaction identifier, amount, package, status, date)	carrying out the purchase, settlement, accounting and tax duties	art. 6 ust. 1 lit. b and lit. c GDPR
The content of messages you send us	replying, handling complaints	art. 6 ust. 1 lit. f GDPR (legitimate interest: handling enquiries)
Page view log (day, page path, technical hash)	traffic statistics, detecting failures and abuse	art. 6 ust. 1 lit. f GDPR

What we do not collect

We do not collect sensitive data within the meaning of art. 9 GDPR. We do not ask about citizenship, nationality, ethnic origin, religion, health, opinions or your residence status in Poland. It is not needed for learning a language, and this is a site for foreigners, so we say so plainly.

We do not collect your first name, surname, address or telephone number. You give those only if you ask for an invoice yourself.

We do not store your IP address in the page view log. Instead of the address we store an irreversible hash computed from the address, the browser, the current day and a secret value. The hash changes every day, so it cannot be used to build a history longer than one day or to link two days together. We also do not store the part of the address after the question mark, because tokens and transaction identifiers appear there.

We do not sell data. We do not share it for marketing purposes. We do not profile users and we do not take automated decisions about them producing legal effects.

Cookies

We use only cookies that are necessary for the site to work:

a session cookie that keeps you logged in. It has the HttpOnly and Secure flags, so no script on the page can reach it. Logging out deletes it;
technical cookies, for example remembering the language version you chose.

We use no tracking cookies, no advertising cookies and no external analytics tools. There is no Google Analytics here, no advertising pixels and no social network plugins. That is why there is no cookie consent banner either: there is nothing to ask consent for.

Logging in with Google

Logging in with a Google account is a choice, not a requirement. An account with a password works exactly the same.

If you choose to log in with Google, we receive from Google only your e-mail address and your account identifier. We have no access to your mail, contacts, files or anything else. In this respect Google is a separate controller and processes data according to its own privacy policy. Logging in with Google may involve a transfer of data outside the European Economic Area, on the terms set by Google.

Who we entrust data to

PayPro S.A. (Przelewy24) - handling payments. In this respect the operator is a separate controller and is itself responsible for card data, which we never see.
The hosting provider - maintaining the server the site runs on.
The mail provider - sending messages from the site (confirmations, password recovery).
Google - only if you choose to log in with a Google account yourself.

We have a data processing agreement with every entity that processes data on our behalf.

Transfers outside the European Economic Area

The site, the database, the mail and the backups are on a server in Poland. We do not transfer data outside the European Economic Area.

The only exception is where you choose to log in with a Google account yourself. The processing on Google's side may then take place outside the EEA, on the basis of the mechanisms provided for in chapter V of the GDPR. If you do not want that, create an account with a password.

How long we keep the data

Data	Period
account and learning progress	until the account is deleted
payment data	5 years from the end of the tax year in which the tax payment deadline fell (accounting duty)
correspondence	one year from the end of the matter
login dates and failed attempts	12 months
page view log	30 days

We delete an account within 14 days of the request, together with the learning progress. The only thing that remains is the payment data, which we must not delete because of tax law; it is then detached from the account and kept for that purpose only.

Your rights

You have the right to:

access your data and receive a copy of it,
rectification of incorrect data,
erasure of data (the right to be forgotten),
restriction of processing,
portability of data, that is receiving it in a machine readable format,
objection to processing based on a legitimate interest.

Send your request to kontakt@polskicert.pl from the e-mail address linked to your account. We reply within 30 days.

You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

Giving data is voluntary

Giving your data is voluntary, but without an e-mail address it is not possible to keep an account or to complete a payment. Without an account you can use the whole free part of the site.

Changes to this policy

If we change the way we process data, we will publish a new version of this page and notify users who have an account by e-mail. The rules for data already collected will not change to the user's disadvantage.

See also: the terms and conditions and sources and methodology.

Legal status as of 2026-09-02.