Privacy Policy
Last updated: 1 October 2026
§1 General Information
1. This privacy policy sets out the rules for processing personal data collected through the TelecomRadar Service (telecomradar.pl). 2. This privacy policy is an integral part of the Terms of Service. 3. Terms used in this policy have the meanings assigned to them in the Terms of Service.
§2 Data Controller
1. The controller of personal data is Miłosz Gołas, conducting business activity under the name DIGITAL SOLUTIONS MIŁOSZ GOŁAS, os. Na Lotnisku 1/29, 31-801 Kraków, Poland, NIP: 6321964756, REGON: 545258825 (hereinafter: the Controller). 2. The Controller can be contacted regarding personal data protection matters at the e-mail address rodo@telecomradar.pl and via the contact form available at telecomradar.pl/kontakt. 3. The Controller has not appointed a Data Protection Officer due to the scope and scale of data processing.
§3 What Data We Collect
1. Data provided in the offer inquiry form or the service availability inquiry form: a) first name (required) and surname (optional), b) phone number (required), c) e-mail address (required), d) installation address: city/town, street, building number, apartment number (required for the coverage check), e) preferred contact time and the status of the consents granted, f) if the service picker is used — the answers given in it (preferences regarding internet and television use, expected parameters, the name of the current operator, if provided). 2. Data provided in the form on the contact page: full name, e-mail address, inquiry category, subject and content of the message. 3. Data related to handling the inquiry: processing status, information about the conclusion of a contract with the Operator and the installation date (if confirmed), answers given in the satisfaction survey (ratings and a comment), and data necessary to settle a bonus under the Bonus Programme. 4. Data provided when adding a blog comment: first name or nickname, e-mail address (not published), content of the comment. When an article is rated, a hash of the IP address is stored. 5. Data collected automatically: a) IP address, b) browser type and version, operating system, c) date and time of the visit, pages visited, d) coverage queries (address, check result, IP address, browser) — recorded for statistical and security purposes, with IP address anonymization after 12 months, e) source of the visit: the domain name of the page from which the User came to the Service, the address of the landing page (without parameters), campaign parameters from the address (utm_*) and the information that the visit came from an advertisement. We record the source of the visit with each coverage check and with each inquiry submitted through a form. The ad click identifier (gclid, gbraid, wbraid, msclkid) and Google Analytics identifiers are recorded only with the relevant cookie consent (§8). 6. Consent register: to demonstrate compliance with the GDPR (Art. 7(1)), the Controller records the content and version of the consent granted, an identifier, cookie consent categories, a hash of the IP address, and browser information. 7. Panel user data (Operator Representatives, administrator): full name, e-mail address, Google account identifier, login timestamps. 8. Data from cookies and similar technologies — details in §8 and §9. 9. Data entered in the contract termination letter generator (including full name, PESEL number or date of birth, NIP/REGON, customer number, address) is processed solely locally in the User's browser in order to generate the content of the letter. This data is not sent to the Service's servers, is not stored, and is not made available to the Controller. 10. We do not collect sensitive data within the meaning of Art. 9 GDPR.
§4 Purposes and Legal Bases for Processing
1. Handling the User's inquiries. The data from the form (first name, surname if given, phone number, e-mail address, installation address, preferred contact time) serves two purposes at once. The Operator's Representative needs it to contact the User and present an offer. The Controller needs it to handle the inquiry: to confirm that it has been received, to inform the User about its status and result by e-mail or phone, to notify the User when coverage appears at the given address and, after the service is installed, to deliver the bonus from the Bonus Programme (point 2). The scope of data passed to Operators depends on the type of inquiry: a) offer inquiry: checking coverage and passing the data from the form to the selected Operator, b) service availability inquiry for an address at which the Service shows no coverage: passing the installation address and the User's first name to the Representatives of all Operators partnered with the Service in order to verify whether they can provide services at that address, and the remaining contact details (surname if given, phone number, e-mail address) exclusively to the Representative of the Operator that confirmed availability. When coverage appears at the given address, the Controller sends the User a one-time e-mail notification; the User can opt out of it using the link included in the messages concerning the inquiry. Legal basis: necessity to take steps at the User's request prior to entering into a contract and to perform the service (Art. 6(1)(b) GDPR). 2. Handling and settling the Bonus Programme (verifying the conclusion of a contract, delivering the bonus) — legal basis: Art. 6(1)(b) GDPR. 3. Contacting the User before their contract with the Operator expires in order to present alternative offers (direct marketing by e-mail or phone) — legal basis: voluntary, separate consent (Art. 6(1)(a) GDPR and Article 398 of the Polish Electronic Communications Law (PKE) of 12 July 2024). 4. Sending a newsletter with guides and updates from the telecommunications market — legal basis: consent (Art. 6(1)(a) GDPR), confirmed using a double opt-in model. 5. Responding to messages sent via the contact form — legal basis: legitimate interest of the Controller (Art. 6(1)(f) GDPR). 6. Measuring satisfaction with the service (a survey sent by e-mail approx. 30 days after service installation) — legal basis: legitimate interest of the Controller (Art. 6(1)(f) GDPR); completing the survey is voluntary, and the User may object to this processing. 7. Publishing and moderating blog comments and collecting article ratings — legal basis: legitimate interest of the Controller (Art. 6(1)(f) GDPR). 8. Ensuring the security of the Service and preventing abuse (server logs, coverage query register, rate limiting, bot protection) and measuring website performance (Vercel Speed Insights, without cookies and without identifying the User) — legal basis: legitimate interest of the Controller (Art. 6(1)(f) GDPR). 9. Keeping traffic statistics and analytics for the Service using analytics cookies — legal basis: consent (Art. 6(1)(a) GDPR); details in §8. 9a. Establishing which sources bring Users to the Service and which of them lead to inquiries, that is measuring the effectiveness of our own promotional activities based on the source of the visit (§3(5)(e)). Legal basis: legitimate interest of the Controller (Art. 6(1)(f) GDPR). The User may object to this processing. 9b. Measuring the effectiveness of advertisements in Google Ads using marketing cookies and the ad click identifier, including informing Google that a visit from an advertisement ended with an inquiry or a contract. Legal basis: consent (Art. 6(1)(a) GDPR); details in §8. 10. Documenting the consents granted and cookie preferences (accountability) — legal basis: Art. 6(1)(c) in conjunction with Art. 7(1) GDPR. 11. Maintaining Operator Representative panel accounts — legal basis: Art. 6(1)(b) GDPR (account agreement). 12. Providing the data marked as required (first name, phone number, e-mail address, installation address) is a condition of handling the inquiry; failure to provide it makes it impossible to check coverage and forward the inquiry to the Operator or Operators. Providing the remaining data and the marketing consents are voluntary and do not affect the handling of the inquiry. 13. Consent is voluntary. The User may withdraw consent at any time, which does not affect the lawfulness of processing carried out before its withdrawal. 14. The Controller does not make decisions concerning Users based solely on automated processing, including profiling, that would produce legal effects concerning them or similarly significantly affect them.
§5 Data Recipients and Transfers Outside the EEA
1. Personal data may be shared with the following entities: a) Telecommunications Operators — only data from the inquiry form, for the purpose of presenting an offer. For an offer inquiry, only authorized Representatives of the Operator selected by the User have access to the data. For a service availability inquiry, the installation address and first name are received by the Representatives of all Operators partnered with the Service, and the remaining contact details exclusively by the Representative of the Operator that confirmed service availability. The Operator becomes an independent data controller to the extent that it processes the data for its own purposes. b) Hosting and infrastructure providers: — Vercel Inc. (USA) — application hosting, bot protection (Vercel Bot Protection) and performance measurement, — Supabase Inc. (USA) — database (PostgreSQL), — Upstash Inc. (USA) — rate limiting service (Redis). c) Security service providers: — Cloudflare Inc. (USA) — bot protection (Turnstile), — Sentry (Functional Software Inc., USA) — application error monitoring and system stability. d) Communication service providers: — Resend Inc. (USA) — e-mail notification delivery. e) Google LLC (USA) — analytics and advertising tools (Google Analytics, Google Ads, Consent Mode); the scope depends on the consents described in §8. 2. The speed test uses the embedded fast.com tool owned by Netflix Inc. (USA). When the test is started, the User's browser connects directly to Netflix servers, which receive the IP address and technical data of the browser. 3. Data transfers to the USA take place on the basis of the European Commission's adequacy decision (EU-US Data Privacy Framework) for entities certified under that programme (including Vercel, Cloudflare, Google, Sentry, Resend, Upstash) and on the basis of standard contractual clauses (including Supabase). The User may obtain a copy of the safeguards applied by contacting the Controller (§2(2)). 4. The entities listed in point 1(b)–(e) process data under data processing agreements. With regard to measuring advertising effectiveness, Google also acts as an independent data controller, on the terms set out in its data protection terms. 5. The Controller does not sell personal data to third parties.
§6 Data Retention Period
1. Data from offer inquiry forms (leads) — 12 months from the completion of inquiry handling, and where consent to contact before the end of the contract has been granted — 36 months from the date the inquiry was submitted, but no longer than until the consent is withdrawn. 2. Satisfaction survey answers — for the retention period of the related inquiry. 3. Data from the contact form (contact page) — 12 months. 4. Server logs and the coverage query register — 12 months; after this period the IP address is deleted or anonymized. After the same period we delete the identifiers recorded together with the source of the visit (ad click identifier, Google Analytics identifiers); the information about the channel and campaign remains as statistical data. 5. Blog comments — until the comment is deleted, an effective objection is raised, or erasure of the data is requested. 6. Cookie data — in accordance with the lifetime of individual cookies (from session to 24 months, details in §8). 7. Newsletter subscription data — until the subscription is cancelled. 8. The register of consents granted — for the period the consent remains in force, and after its withdrawal for the limitation period of any claims. 9. After the retention period expires, data is deleted or anonymized.
§7 User Rights
1. Under the GDPR, you have the following rights: a) the right of access to your personal data (Art. 15 GDPR), b) the right to rectification of your data (Art. 16 GDPR), c) the right to erasure — the right to be forgotten (Art. 17 GDPR), d) the right to restriction of processing (Art. 18 GDPR), e) the right to data portability (Art. 20 GDPR), f) the right to object to processing based on legitimate interest (Art. 21 GDPR), g) the right to withdraw consent at any time (Art. 7(3) GDPR). 2. To exercise the above rights, contact the Controller at rodo@telecomradar.pl or via the contact form at telecomradar.pl/kontakt. 3. We respond without undue delay, no later than within one month of receiving the request. In complex cases, this period may be extended by a further two months, of which we will inform you before the end of the first month. 4. The User has the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), uodo.gov.pl.
§8 Cookies and Similar Technologies
1. Storing cookies and accessing them requires the User's consent, except for necessary cookies — in accordance with Article 399 of the Polish Electronic Communications Law (PKE) of 12 July 2024 and Art. 6 GDPR with regard to personal data. The categories also cover similar browser storage technologies (localStorage, details in §9). 2. The Service uses the following categories: a) Necessary cookies (do not require consent): — coverage session (__Host-tr_session) — encrypted httpOnly cookie, 30 min extended by activity (max 3 h), stores the coverage check result, — panel login session (authjs.*) — httpOnly, 24 h, — cookie banner state (telecomradar-consent) — 6 months, remembers the User's choice; the choice is additionally recorded server-side for accountability purposes (Art. 7(1) GDPR), — Vercel anti-bot verification cookie (_vcrcs) — set after passing Vercel Bot Protection verification. b) Functional cookies (require consent): — last searched address (tr_last_address) — localStorage, 1 h, facilitates repeat searches. c) Analytics cookies (require consent): — Google Analytics 4 — traffic statistics based on pseudonymous user and session identifiers: _ga and _ga_* cookies (up to 24 months) and _gid (24 h). This data does not allow the Controller to directly identify the User, but it is not anonymous, — source of the visit (tr_attr) — localStorage, up to 90 days; remembers which source brought the User to the Service (campaign parameters, referring domain, landing page), so that a later inquiry can be attributed to the right source. d) Marketing cookies (require consent): — Google Ads — measuring advertising effectiveness: _gcl_* cookies (up to 90 days) holding the ad click identifier, set after the User enters the Service from a Google advertisement, — the ad click identifier stored together with the source of the visit (tr_attr) — localStorage, up to 90 days. Consent in this category also controls Google Consent Mode signals (ad_storage, ad_user_data, ad_personalization). 3. The Google script (gtag.js) in Consent Mode loads on every visit. Until consent is given, it does not set cookies or identifiers, but it sends limited technical signals to Google (including the IP address and the address of the visited page) used for aggregate measurement. Analytics consent enables cookies and full measurement, and marketing consent enables the measurement of advertising effectiveness. 3a. Source of the visit without cookie consent. The Service reads the information about the source of the visit (§3(5)(e)) from the address of the landing page and keeps it only in the memory of the open page, without storing it on the User's device. It reaches the server together with a coverage check or an inquiry form. Without marketing consent, the ad click identifier is neither sent nor recorded. 4. Cloudflare Turnstile — a bot protection mechanism used with forms. It operates in the background and requires no interaction from the User. Classified as necessary (security protection). 5. The User can manage cookie preferences via the banner displayed on the first visit or by clicking "Cookie Settings" in the Service footer. 6. The User may also delete cookies or block their storage in the browser settings. This may affect the functioning of certain Service features.
§9 Local Storage (localStorage)
1. The Service uses the browser's local storage (localStorage) to store: a) theme preferences (light/dark), b) the last searched address (tr_last_address) — with consent for functional cookies, TTL 1 hour, c) the source of the visit (tr_attr) — with consent for analytics or marketing cookies, up to 90 days. 2. The data from point 1(a) and (b) is not sent to the server and remains solely on the User's device. The source of the visit (point 1(c)) is sent to the server together with a coverage check or an inquiry form. 3. Data entered in the contract termination letter generator (including the PESEL number or date of birth) is processed solely locally in the browser in order to generate the document and is not sent to the Controller's servers or stored anywhere. 4. The User can delete localStorage data in the browser settings.
§10 Data Security
1. The Controller applies appropriate technical and organizational measures to ensure the protection of processed personal data, in particular: a) data transmission encryption (HTTPS/TLS), b) coverage session encryption (AES-256-GCM), c) access control for the administration panel (OAuth 2.0, role-based access control), d) request rate limiting, e) bot protection (Cloudflare Turnstile and Vercel Bot Protection). 2. Only persons authorized by the Controller have access to personal data.
§11 Changes to the Privacy Policy
1. The Controller reserves the right to update this privacy policy. 2. The Controller will inform Users of significant changes via a notice in the Service, and persons using subscription services also by e-mail. 3. The date of the last update is displayed at the top of this document.
§12 Contact
For matters related to personal data protection and privacy, contact the Controller at rodo@telecomradar.pl or via the contact form at telecomradar.pl/kontakt. We respond without undue delay, no later than within one month.