Privacy Policy
Last updated: April 1, 2026
§1 General Information
1. This privacy policy sets out the rules for processing personal data collected through the TelecomRadar service (telecomradar.pl). 2. This privacy policy is an integral part of the Terms of Service. 3. Terms used in this policy have the meanings assigned to them in the Terms of Service.
§2 Data Controller
1. The controller of personal data is Miłosz Gołas, owner of the TelecomRadar service (hereinafter: the Controller). 2. You may contact the Controller regarding personal data protection matters via the contact form available at telecomradar.pl/kontakt. 3. The Controller has not appointed a Data Protection Officer due to the scope and scale of data processing.
§3 What Data We Collect
1. Data provided by the User in the Contact Form: a) first name (required), b) surname (optional), c) phone number (required), d) email address (required), e) installation address: city, street, building number, apartment number (required for coverage check). 2. Data collected automatically: a) IP address, b) browser type and version, c) operating system, d) date and time of visit, e) pages visited. 3. Data from cookies — details in §8. 4. We do not collect sensitive data within the meaning of Article 9 of the GDPR.
§4 Purposes and Legal Bases for Processing
1. Fulfilling the User's inquiry and forwarding contact details to the selected Operator — legal basis: consent (Article 6(1)(a) GDPR). 2. Informing the User about inquiry status by email or phone — legal basis: consent (Article 6(1)(a) GDPR). 3. Contacting the User during the operator contract period and before its expiry in order to present alternative offers — legal basis: consent (Article 6(1)(a) GDPR). 4. Sending a newsletter with tips and telecom market updates — legal basis: consent (Article 6(1)(a) GDPR). 5. Responding to messages sent via the contact form — legal basis: legitimate interest of the Controller (Article 6(1)(f) GDPR). 6. Ensuring the security of the Service and preventing abuse (server logs, rate limiting) — legal basis: legitimate interest of the Controller (Article 6(1)(f) GDPR). 7. Conducting traffic statistics and analytics for the Service — legal basis: consent (Article 6(1)(a) GDPR) in the case of analytical cookies. 8. Consent is voluntary. The User may withdraw consent at any time, which does not affect the lawfulness of processing carried out before its withdrawal.
§5 Data Recipients
1. Personal data may be shared with the following entities: a) Telecommunications Operators — only data from the Contact Form, for the purpose of presenting an offer. Only authorized Representatives of the Operator selected by the User have access to the data. b) Hosting and infrastructure providers: — Vercel Inc. (USA) — application hosting, — Supabase Inc. (USA) — database (PostgreSQL), — Upstash Inc. — rate limiting service (Redis). c) Security service providers: — Cloudflare Inc. (USA) — bot protection (Turnstile). d) Communication service providers: — Resend Inc. — email notification delivery. e) Google LLC (USA) — only if the User consents to analytical cookies (Google Analytics). 2. The entities listed in point 1(b)–(e) process data under data processing agreements or standard contractual clauses ensuring an appropriate level of data protection for transfers outside the EEA. 3. The Controller does not sell personal data to third parties.
§6 Data Retention Period
1. Contact form data (leads) — 36 months from the date the inquiry was submitted (covers operator contract period + pre-expiry recontact). 2. Contact page form data — 12 months. 3. Server logs (IP address, browser, timestamp) — 12 months. 4. Cookie data — in accordance with the lifetime of individual cookies (from session to 12 months). 5. Newsletter subscription data — until the subscription is cancelled. 6. After the retention period expires, data is deleted or anonymized.
§7 User Rights
1. Under the GDPR, you have the following rights: a) the right of access to your personal data (Article 15 GDPR), b) the right to rectification of your data (Article 16 GDPR), c) the right to erasure — the right to be forgotten (Article 17 GDPR), d) the right to restriction of processing (Article 18 GDPR), e) the right to data portability (Article 20 GDPR), f) the right to object to processing (Article 21 GDPR), g) the right to withdraw consent at any time (Article 7(3) GDPR). 2. To exercise the above rights, please contact us via the contact form at telecomradar.pl/kontakt. 3. We respond to requests within 30 days. 4. The User has the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
§8 Cookies
1. The Service uses cookies in the following categories: a) Necessary cookies (do not require consent): — coverage session (tr_session) — encrypted httpOnly cookie, 30 min, stores the coverage check result, — administrator login session (authjs.*) — httpOnly, 24h, — theme preferences (light/dark) — localStorage, — cookie banner state (tr_consent) — remembers the User's choice. b) Functional cookies (require consent): — last searched address (tr_last_address) — localStorage, 1h, facilitates repeat searches. c) Analytical cookies (require consent): — Google Analytics 4 — anonymous traffic statistics, _ga and _ga_* cookies, up to 12 months. 2. Cloudflare Turnstile — a bot protection mechanism. It operates in the background and requires no interaction from the User. Classified as necessary (security protection). 3. The User can manage cookie preferences via the banner displayed on the first visit or by clicking "Cookie Settings" in the Service footer. 4. The User may also delete cookies or block their storage in the browser settings. This may affect the functioning of certain Service features.
§9 Local Storage (localStorage)
1. The Service uses the browser's local storage (localStorage) to store: a) theme preferences (light/dark), b) last searched address (tr_last_address) — with consent for functional cookies, TTL 1 hour, c) cookie banner state. 2. Data in localStorage is not sent to the server and remains solely on the User's device. 3. The User can delete localStorage data in the browser settings.
§10 Data Security
1. The Controller applies appropriate technical and organizational measures to ensure the protection of processed personal data, in particular: a) data transmission encryption (HTTPS/TLS), b) coverage session encryption (AES-256-GCM), c) access control for the administration panel (OAuth 2.0, role-based access control), d) request rate limiting, e) bot protection (Cloudflare Turnstile). 2. Only persons authorized by the Controller have access to personal data.
§11 Changes to the Privacy Policy
1. The Controller reserves the right to update this privacy policy. 2. The Controller will inform Users of significant changes via a notice within the Service. 3. The date of the last update is displayed at the top of this document.
§12 Contact
For matters related to personal data protection and privacy, please contact us via the contact form at telecomradar.pl/kontakt. We respond to inquiries within 30 days.