Privacy Policy
Last updated: May 27, 2026
This privacy policy describes how the website busek.pl/koscian (hereinafter: the "Service") processes user data.
Data Controller
Dariusz Kuśnierek Dariusz Kuśnierek (dkodr) Tax ID (NIP): 6981624570 Osiedle Piastowskie 15/4, 64-000 Kościan, Poland Email: kontakt@busek.pl
What data we process
The Service is an informational bus schedule application and does not require registration or login. We only process:
- •IP address — processed by the server with each HTTP request and by the analytics system (Umami).
- •Browser localStorage data — color theme (light/dark) and departure widget preferences (selected stop and lines). This data is not sent to the server.
- •Geolocation — only upon user request (clicking "My location"). Position data is not stored or sent to our server.
- •Push notification subscription — if the user sets a bus reminder, we store on the server an anonymous endpoint (URL generated by the browser), cryptographic keys needed to encrypt the notification, language preference, and which stop and line the reminder concerns. We do not use cookies — the browser manages the subscription in its own storage.
- •Contact form — e-mail address (required), optionally name and message content with a selected topic. Data is sent to the server to deliver an e-mail to the administrator.
Purposes of processing
- •Analytics — anonymous visit statistics (number of visits, popular pages) to improve the Service.
- •Functionality — remembering user preferences (theme, stop) for convenience.
- •Geolocation — displaying the user's position on the map and finding the nearest stop.
- •Push notifications — sending a system notification about 5 minutes before the selected bus arrives at the selected stop.
- •Contact form — handling inquiries, reports and suggestions submitted by the user.
Legal basis and data retention
The following table shows the purposes, data categories, legal bases, and retention periods:
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Visit analytics | IP address | Art. 6(1)(f) — legitimate interest (Service improvement) | Per Umami config |
| Functionality | localStorage (theme, preferences) | Art. 6(1)(f) — legitimate interest (user convenience) | Until deleted by user |
| Geolocation | GPS position | Art. 6(1)(a) — consent (browser permission) | Not stored |
| Server logs | IP address, HTTP request | Art. 6(1)(f) — legitimate interest (security) | 30 days |
| Advertiser data | Name/company, address, VAT ID, e-mail | Art. 6(1)(b) — contract performance | 5 years after contract end (tax obligation) |
| Contact form | E-mail, name (optional), message content | Art. 6(1)(f) — legitimate interest (handling inquiry) | Until inquiry is resolved |
| Push notifications | Subscription endpoint, encryption keys, stopId, lineId, locale | Art. 6(1)(a) — consent (browser permission) | Until consent withdrawn, endpoint expires (typically a few months), or 6 hours after creation for a single reminder |
Your rights
Under GDPR, you have the following rights:
- •Right of access to your data (Art. 15)
- •Right to rectification (Art. 16)
- •Right to erasure (Art. 17)
- •Right to restriction of processing (Art. 18)
- •Right to data portability (Art. 20)
- •Right to object to processing (Art. 21)
Where processing is based on consent (e.g., geolocation, push notifications), you have the right to withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. You can revoke geolocation consent in your browser settings. Push notifications can be turned off in the app by clicking "Cancel reminder" or globally in your browser / system settings.
To exercise your rights, contact the data controller by email. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (uodo.gov.pl).
Data stored on your device
The Service does not use cookies. It uses the browser's localStorage mechanism as follows:
| Name | Purpose | Retention | Type |
|---|---|---|---|
| theme | Remember selected theme (light/dark) | Until deleted by user | Necessary |
| kkp-departure-prefs | Remember selected stop and lines in the departure widget | Until deleted by user | Necessary |
| kkp-push-sub-id | Push subscription identifier — lets the app restore the "Remind" button state when returning to the page | Until deleted by user or consent withdrawn | Optional (consent) |
Data recipients and external services
Personal data may be disclosed to the following categories of recipients in connection with the operation of the Service:
- •Umami Analytics — a self-hosted analytics system on the controller's server. It does not use cookies and does not track users across websites. Data is not shared with third parties (no external recipient).
- •OpenStreetMap Foundation (United Kingdom) — independent controller providing map tiles. OSM servers may log IP addresses of users viewing the map.
- •Photon / Komoot GmbH (Germany, EU) — independent controller providing geocoding. Search queries are sent to photon.komoot.io.
- •OSRM (Project OSRM) — public API for walking routes (router.project-osrm.org). Only start and destination coordinates are transmitted.
- •The real-time bus position preview feature is currently disabled. The service does not fetch any vehicle location data.
- •Own advertising — the service may display static ad banners from partners. Ads use no cookies or profiling. Clicks and impressions are counted anonymously via Umami Analytics (no third-party recipients). Advertiser data (name/company, address, VAT ID, e-mail) is processed solely by the controller to fulfil the advertising contract.
- •OVH SAS (France, EU) — e-mail server provider (SMTP). Messages sent via the contact form are delivered through OVH servers to the administrator's mailbox. OVH processes data solely to deliver the message.
- •Push service providers (recipients of the subscription endpoint) — depending on the browser and system: Google LLC (Firebase Cloud Messaging) for Chrome, Edge, Samsung Internet, and Chrome on Android; Mozilla Foundation (autopush.services.mozilla.com) for Firefox; Apple Inc. (Apple Push Notification service) for Safari and installed PWAs on iOS/iPadOS. Only the encrypted notification payload is transmitted — the provider does not know the notification content or any user data beyond the subscription endpoint assigned to its device.
Data transfers outside the EEA
Using the Service may result in your IP address being transmitted to OpenStreetMap Foundation servers in the United Kingdom. The UK has an adequacy decision from the European Commission (decision of June 28, 2021), meaning the transfer is based on Art. 45 GDPR. OSRM servers may be located outside the EEA — the transfer is based on Art. 49(1)(g) GDPR (data made publicly available by the user to obtain a route). When using push notifications, the subscription endpoint is transmitted to the push service provider matching the user's browser — Google LLC and Apple Inc. (USA) are certified under the EU-U.S. Data Privacy Framework, providing a basis for transfer under Art. 45 GDPR; Mozilla Foundation hosts autopush on Google Cloud facilities covered by the same decision.
Voluntary nature of data provision
Providing your IP address is technically necessary to use the Service (without it, the browser cannot load the page). Using localStorage (theme, preferences) is optional — the Service works without them using default settings. Sharing your geolocation is entirely voluntary — refusal does not limit access to any features other than displaying your position on the map. Push notifications are entirely optional and require active user consent (clicking "Remind 5 min before" and accepting the browser prompt); declining does not limit any other Service features. Providing data in the contact form is voluntary — the e-mail address is required only so that we can reply to your inquiry.
Automated decision-making
We do not use automated decision-making or profiling as referred to in Art. 22 GDPR.
Contact
For privacy and data protection matters, please contact: kontakt@busek.pl.
Policy changes
The controller reserves the right to change this privacy policy. The current version is always available at busek.pl/koscian/en/polityka-prywatnosci.
