Privacy policy

DRAFT FOR LEGAL REVIEW – this document is not yet binding. Version of 2026-11-01 (staging). The Polish version prevails.

1. Controller

The controller is IMETROLL – Laboratory of Technology sp. z o.o., ul. Jana Husa 18B/107, 03-153 Warszawa, KRS 0000745333, NIP 5242871675, REGON 381074397 ("Controller"). Data protection contact: office@imetroll.com. [TO VERIFY: whether a DPO is appointed]

2. Data, purposes, legal bases

Data	Purpose	Basis (GDPR)	Retention
e-mail, account data, report order history	account and service provision	Art. 6(1)(b)	until account deletion, then up to 30 days [TO VERIFY]
KW number entered by the User and the (anonymised) result	performing the requested service, stored only on the User's account	Art. 6(1)(b)	until deleted by the User or account deletion
invoice data (incl. company name, NIP, REGON, address), transaction data	billing, tax and accounting duties	Art. 6(1)(c)	5 years from the end of the tax year
company account and API key data (key hash, API usage logs)	company account, integrations, security, limits	Art. 6(1)(b) and (f)	until account deletion; usage logs up to 12 months [TO VERIFY]
IP address, server logs, session cookie	security, abuse prevention, login	Art. 6(1)(f)	logs up to 30 days [TO VERIFY]
correspondence	handling enquiries and complaints	Art. 6(1)(b) and (f)	up to 3 years (limitation period)

Your phone number (if you provide it) is used only to send login codes and is never used for marketing.

3. What we do NOT process

• We do not search land registers or parcels by person and keep no land register database; a KW is retrieved only when the User enters its number and the result is stored only on that account.
• We do not show or export owners' data or persons entered in the KW (masked) nor encumbrance, mortgage or credit data (KW sections III and IV).
• No profiling or automated decision-making with legal effects (Art. 22 GDPR).

4. Data sources

Spatial data comes from public registers and services (GUGiK: ULDK, Geoportal, zoning and utility integrations; the Electronic Land Registers service – only for a number given by the User) and OpenStreetMap. Company registry data (NIP, REGON, KRS, seat, legal form) comes from public registers or from the User.

5. Recipients

• Stripe Payments Europe, Ltd. (Ireland) – payment processor; Stripe processes card data as a separate controller.
• hosting/server provider [TO BE COMPLETED: provider and server location], e-mail provider [TO BE COMPLETED];
• Esri (satellite imagery in the app map) – when the satellite layer is shown, the browser loads tiles from Esri servers, which receive the IP address;
• systems designated by the User in integrations (CRM, webhook URLs) – on the User's instruction;
• public authorities where required by law.

6. Transfers outside the EEA

Where a provider (e.g. Stripe, Esri) transfers data outside the EEA, this is based on an adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses. [TO VERIFY]

7. Your rights (Art. 15–22 GDPR)

You have the right of access (Art. 15), rectification (16), erasure (17), restriction (18), data portability (20), to object to processing based on legitimate interest (21) and not to be subject to solely automated decisions (22). The Controller notifies recipients of rectification, erasure or restriction (19). Requests: office@imetroll.com; we reply within one month.

You may lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

8. Voluntary provision

An e-mail address is required to create an account; invoice data to issue an invoice. Other data is voluntary.

9. Cookies

See the Cookie policy.

← Back to home