Privacy Policy
Version of 20 October 2026
We explain what personal data we process in Gabaro, for what purposes, to whom we pass it and what rights you have. This is a translation; the Polish version is binding.
The documents are available in Polish, English and German. The Polish version is binding; this translation is for information only.
1. Controller
The controller is Grzegorz Kundys (giekadigital.pl). Contact for all matters relating to personal data: kontakt@giekadigital.pl. No data protection officer has been appointed.
2. Who this policy applies to
- Account users (owners and employees of Companies).
- Companies' contact persons and pilots entered into the Service by a Company (also without their own account) — the Company entering their data should pass this information on to them.
- People writing via the contact form.
- Visitors to the Service website.
3. What data we process
- Account: e-mail address, password (only as a cryptographic hash), language, notification settings, date and version of acceptance of the Terms.
- Company: name, country, tax/VAT number and the VIES check result, base address and location (coordinates) and operating radius, contact person, phone, e-mail, roles, subscription, any block and its reason.
- Pilots: full name, countries of qualification, activity.
- Vehicles: make, model, registration number, qualifications (e.g. BF class).
- Documents: files (scans, photos, PDF), expiry dates, verification status and rejection reason. Documents may contain personal data (e.g. driving licence, pilot certificates).
- Orders: route and addresses, dates, vehicle dimensions, cargo, rates, contact phone and person, additional terms, offers, acceptances, withdrawals and cancellations with reasons.
- Chat: messages and attachments in Order and Offer threads.
- Ratings: stars, comments, information on payment timeliness.
- Availability: announcements of free vehicles (period, area, qualifications), trusted pilots, saved marketplace filters.
- Notifications: in-app notification content, e-mail/push delivery queue, push subscriptions (browser push service address and encryption keys).
- Contact form: name, e-mail, company (optional), message, language and a hash of the IP address (irreversible, with a secret salt — for spam protection).
- Technical data: IP address, browser information, time and URL of requests in the hosting and database server logs.
4. Purposes and legal bases
| Purpose | Basis (GDPR) |
|---|---|
| Creating and running the account, providing the Service (marketplace, orders, chat, ratings, PDF, calendar), in-app and e-mail notifications | Art. 6(1)(b) — contract |
| VIES check of the VAT number, document verification, masking contact details before acceptance, moderation, blocks, security and abuse prevention | Art. 6(1)(f) — legitimate interest (reliability and security of the marketplace) |
| Data of pilots and contact persons entered by a Company | Art. 6(1)(f) — legitimate interest of the Company and the Operator (performing orders) |
| Push notifications | Art. 6(1)(a) — consent (enabling push in the browser); you can withdraw it at any time by disabling push |
| Replying to a contact-form message | Art. 6(1)(f) — legitimate interest (communication) |
| Establishing, pursuing and defending claims | Art. 6(1)(f) |
| Legal obligations (e.g. tax obligations once payments are introduced) | Art. 6(1)(c) |
Notification e-mails are part of the service; you can turn them off in the notification settings. We do not send newsletters or advertising.
5. What other users see
Signed-in Users see your Company's name, country and roles, base location (to calculate distances), badge, ratings, payment-timeliness indicator and cancellation/withdrawal statistics, as well as the content of your Orders and availability announcements.
Phones, e-mails, contact person and additional terms of an Order are visible only to accepted Companies. Documents are visible only to your Company and the administrator. The public website does not show Company data.
6. Recipients and processors
We pass data only to entities that help us run the Service (processors acting on our instructions) or to services used by your browser:
- Supabase — database, sign-in (authentication) and file storage (documents, chat attachments); servers in the EU (Frankfurt region, Germany). Processes all account and company data described above.
- Vercel — hosting of the application and website; server functions in the EU region (Frankfurt, fra1). Processes network traffic (IP address, requests) and data passing through the application.
- Zenbox — e-mail delivery (SMTP) — sign-up confirmation, notifications, forwarding contact-form messages to the Operator; servers in Poland. Processes the recipient's e-mail address and message content.
- OpenStreetMap — map tiles loaded directly by your browser from tile.openstreetmap.org — the OpenStreetMap server sees your IP address and browser information (OpenStreetMap Foundation, United Kingdom; European Commission adequacy decision).
- Photon (komoot) — address suggestions (geocoding): the address text you type is sent from our server to photon.komoot.io (komoot GmbH, Germany) — without your IP address or account data.
- VIES — the European Commission's EU VAT number check: when a company is created we send the country and VAT/tax number to confirm the company exists and its name.
- Google FCM / Mozilla / Apple / Microsoft — browser push services — only if you enable push notifications. Your browser vendor's service (e.g. Google Firebase Cloud Messaging for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge) receives the encrypted notification and the subscription address; the content is end-to-end encrypted (Web Push standard) and cannot be read by the vendor. Servers may be located outside the EEA.
Data may also be received by other Users to the extent described in section 5 and by public authorities where required by law. We do not sell data.
7. Transfers outside the EEA
Service data is stored in the EU. Supabase and Vercel are US-based companies — access from the US (e.g. for technical support) may occur on the basis of the European Commission's standard contractual clauses or an adequacy decision (EU-US Data Privacy Framework). Browser push services may process data outside the EEA under their vendors' terms.
8. How long we keep data
| Data | Period |
|---|---|
| Account and Company data, orders, chat, ratings | until the account (Company) is deleted, and afterwards only as required by law or until claims become time-barred |
| Documents (including older versions kept as verification history) | until the Company account is deleted — when the account is deleted, the document files are deleted too |
| Read in-app notifications | 180 days |
| E-mail/push delivery queue | 30 days |
| Contact-form messages | up to 12 months |
| Push subscriptions | until push is disabled or the subscription expires in the browser |
| Hosting and database technical logs | short-term, according to the providers' settings |
9. Account deletion
At this stage the Service has no self-service account deletion button. To delete your account, write from the account e-mail address to kontakt@giekadigital.pl — we will delete the account and data without undue delay, within 30 days at the latest (except data we must keep by law).
10. Your rights
- access to your data and a copy of it,
- rectification (you can correct most account and Company data yourself in the application),
- erasure and restriction of processing,
- portability of data processed on the basis of contract or consent,
- objection to processing based on legitimate interest,
- withdrawal of push consent at any time (without affecting the lawfulness of earlier processing),
- a complaint to the Polish supervisory authority — President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw).
Send requests to kontakt@giekadigital.pl.
11. No profiling
We do not profile Users for marketing and do not take decisions with legal effects based solely on automated processing. The “recommended nearby” list and matching of new-order notifications are sorting and filtering by transparent criteria (distance, qualifications, badge, ratings). Contact details in content are masked automatically.
12. Providing data is voluntary
Providing data is voluntary, but without account and Company data the marketplace cannot be used. Documents are needed for the “Verified” badge.
13. Security
Connections are encrypted (HTTPS), access to database data is restricted by row-level security rules, documents are stored privately and passwords only as hashes.
15. Changes and contact
We will announce changes to this policy in the Service; the current version is dated at the top of the page. Questions: kontakt@giekadigital.pl.