Privacy Policy
Last updated: April 3, 2026
This privacy policy describes how the website busek.pl/koscian (hereinafter: the "Service") processes user data.
Data Controller
Dariusz Kuśnierek Dariusz Kuśnierek (dkodr) Tax ID (NIP): 6981624570 Osiedle Piastowskie 15/4, 64-000 Kościan, Poland Email: kontakt@busek.pl
What data we process
The Service is an informational bus schedule application and does not require registration or login. We only process:
- •IP address — processed by the server with each HTTP request and by the analytics system (Umami).
- •Browser localStorage data — color theme (light/dark) and departure widget preferences (selected stop and lines). This data is not sent to the server.
- •Geolocation — only upon user request (clicking "My location"). Position data is not stored or sent to our server.
Purposes of processing
- •Analytics — anonymous visit statistics (number of visits, popular pages) to improve the Service.
- •Functionality — remembering user preferences (theme, stop) for convenience.
- •Geolocation — displaying the user's position on the map and finding the nearest stop.
Legal basis and data retention
The following table shows the purposes, data categories, legal bases, and retention periods:
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Visit analytics | IP address | Art. 6(1)(f) — legitimate interest (Service improvement) | Per Umami config |
| Functionality | localStorage (theme, preferences) | Art. 6(1)(f) — legitimate interest (user convenience) | Until deleted by user |
| Geolocation | GPS position | Art. 6(1)(a) — consent (browser permission) | Not stored |
| Server logs | IP address, HTTP request | Art. 6(1)(f) — legitimate interest (security) | 30 days |
| Advertiser data | Name/company, address, VAT ID, e-mail | Art. 6(1)(b) — contract performance | 5 years after contract end (tax obligation) |
Your rights
Under GDPR, you have the following rights:
- •Right of access to your data (Art. 15)
- •Right to rectification (Art. 16)
- •Right to erasure (Art. 17)
- •Right to restriction of processing (Art. 18)
- •Right to data portability (Art. 20)
- •Right to object to processing (Art. 21)
Where processing is based on consent (e.g., geolocation), you have the right to withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. You can revoke geolocation consent in your browser settings.
To exercise your rights, contact the data controller by email. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (uodo.gov.pl).
Data stored on your device
The Service does not use cookies. It uses the browser's localStorage mechanism as follows:
| Name | Purpose | Retention | Type |
|---|---|---|---|
| theme | Remember selected theme (light/dark) | Until deleted by user | Necessary |
| kkp-departure-prefs | Remember selected stop and lines in the departure widget | Until deleted by user | Necessary |
Data recipients and external services
Personal data may be disclosed to the following categories of recipients in connection with the operation of the Service:
- •Umami Analytics — a self-hosted analytics system on the controller's server. It does not use cookies and does not track users across websites. Data is not shared with third parties (no external recipient).
- •OpenStreetMap Foundation (United Kingdom) — independent controller providing map tiles. OSM servers may log IP addresses of users viewing the map.
- •Photon / Komoot GmbH (Germany, EU) — independent controller providing geocoding. Search queries are sent to photon.komoot.io.
- •OSRM (Project OSRM) — public API for walking routes (router.project-osrm.org). Only start and destination coordinates are transmitted.
- •Own advertising — the service may display static ad banners from partners. Ads use no cookies or profiling. Clicks and impressions are counted anonymously via Umami Analytics (no third-party recipients). Advertiser data (name/company, address, VAT ID, e-mail) is processed solely by the controller to fulfil the advertising contract.
Data transfers outside the EEA
Using the Service may result in your IP address being transmitted to OpenStreetMap Foundation servers in the United Kingdom. The UK has an adequacy decision from the European Commission (decision of June 28, 2021), meaning the transfer is based on Art. 45 GDPR. OSRM servers may be located outside the EEA — the transfer is based on Art. 49(1)(g) GDPR (data made publicly available by the user to obtain a route).
Voluntary nature of data provision
Providing your IP address is technically necessary to use the Service (without it, the browser cannot load the page). Using localStorage (theme, preferences) is optional — the Service works without them using default settings. Sharing your geolocation is entirely voluntary — refusal does not limit access to any features other than displaying your position on the map.
Automated decision-making
We do not use automated decision-making or profiling as referred to in Art. 22 GDPR.
Contact
For privacy and data protection matters, please contact: kontakt@busek.pl.
Policy changes
The controller reserves the right to change this privacy policy. The current version is always available at busek.pl/koscian/en/polityka-prywatnosci.