WARUN - privacy policy
In short
We keep the amount of personal data we hold to a minimum. To use Warun you need an account, so we store your email address and either a securely hashed password or an identifier from your Google account. We also store your app settings, such as your chosen language and theme. We do not track your location, we do not build a profile of you, we do not use your data for advertising, and we do not sell it. The sections below set out the detail required by the General Data Protection Regulation (GDPR).
Who we are
The controller of your personal data is:
- Jakub Płachta
- Ketlinga 26/15, 92-431 Łódź, Poland
- Email: contact@warun.nu
We trade as "Plandeka Software" and operate the Warun service. In this policy, "we", "us" and "our" refer to the controller named above, and "Warun" or "the Service" means the website at warun.nu, the web application at app.warun.nu, and the Warun mobile applications.
We have not appointed a Data Protection Officer, as we are not required to. For any question about your personal data, write to contact@warun.nu.
What we collect
Account data
When you create an account we collect your email address. If you register with an email and password, we store your password only as a salted cryptographic hash, which cannot be reversed to reveal the password. If you sign in with Google instead, we receive your Google account identifier and email address from Google, display name and profile picture. Out of that we only save the email and identifier. We do not receive your Google password.
We use this data to create and maintain your account, to sign you in, to let you reset your password, and to contact you about the Service when necessary.
Your settings
We store the preferences you choose in the app, such as interface language and light or dark theme, so that they follow you between your devices and sessions.
Service emails
We use your email address to send messages that are necessary to run your account, such as account confirmation, password resets, security notices, and notice of important changes to the Service or to these policies. We do not send marketing or promotional email. If we ever want to, we will ask for your separate consent first, and you will be able to withdraw it at any time.
Technical and security logs
Our hosting provider records standard web server logs when you use the Service. These may include your IP address, the date and time of the request, the page or endpoint requested, and basic information about your browser or app version. We use these logs only to keep the Service running, to investigate faults, and to detect and prevent abuse such as automated attacks on the login form. We do not use them to build a profile of you or to track you across other websites.
We do not use any kind of third party analytics to analyze your data
What we do not collect
- Location. Warun does not collect or request your device location.
- Climbing activity. We do not record which areas you look at. The only record that we keep is the list of your favourites, that is removed if you remove your account
- Special category data. We do not collect health, biometric, or any other special category data under Article 9 GDPR.
- Payment data. Warun is free and nothing can be bought in it, so we hold no payment or billing information.
Why we process your data, and on what legal basis
| What | Why | Legal basis |
|---|---|---|
| Email address, password hash or Google account identifier | To create your account, sign you in, and let you recover access | Article 6(1)(b) — necessary to provide the service you asked for |
| Language, theme and other settings | To give you the app configured the way you chose | Article 6(1)(b) — necessary to provide the service you asked for |
| A list of favourite entries | To make the app more convenient | Article 6(1)(b) — necessary to provide the service you asked for |
| Service emails | To administer your account and tell you about changes that affect you | Article 6(1)(b), and Article 6(1)(c) where the law requires us to notify you |
| Technical and security logs | To keep the Service available, diagnose faults, and prevent abuse | Article 6(1)(f) — our legitimate interest in a secure, working service |
We do not make any decision about you by automated means that has a legal or similarly significant effect on you, within the meaning of Article 22 GDPR.
How long we keep it
| Data | Retention |
|---|---|
| Account data and settings | For as long as your account exists. If you delete your account, we delete this data within 30 days, except where we must keep something longer to comply with the law or to defend a legal claim. |
| Technical and security logs | [X] days, then deleted or anonymised. |
| Correspondence with us | Up to [12/24] months after the matter is closed. |
| Backups | Deleted data may persist in encrypted backups for up to [X] days before those backups are overwritten. |
If your account is inactive for a long period we may delete it, after giving you notice by email beforehand.
Who else sees your data
We do not sell your personal data and we do not share it for anyone else's marketing. We use a small number of service providers, and some parts of the Service rely on third parties who act independently:
| Recipient | What they receive | Why | Where |
|---|---|---|---|
| SeoHost.pl | Everything stored by the Service, as our hosting provider | Hosting and server infrastructure | Poland (EEA) |
| Google Ireland / Google LLC | App distribution data; and, if you use Google sign-in, the fact that you authenticate to Warun | Google Play distribution and Google sign-in | Ireland, with transfers to the USA |
| OpenWeather | Coordinates of the requested climbing area | Weather forecasts shown in the app | United Kingdom |
| Windy.com | Coordinates of the requested climbing area | Webcams | Czech Republic (EEA) |
Requests to weather providers are made by our servers, not by your device. These providers receive the coordinates of the climbing area being displayed, and they do not receive your IP address, your email address, or any other information about you.
These third parties handle data under their own privacy policies:
We may also disclose personal data where we are required to do so by law, for example in response to a lawful order from a court or public authority, or where it is necessary to establish, exercise or defend a legal claim.
Transfers outside the EEA
Most of your data stays within the European Economic Area. Two exceptions:
- United Kingdom. The European Commission has decided that the UK provides an adequate level of data protection, so transfers there need no additional safeguard.
- United States. Google may process data in the USA. Those transfers rely on the EU–US Data Privacy Framework and, where applicable, on the European Commission's Standard Contractual Clauses.
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you, and receive a copy of it.
- Correct data that is inaccurate or incomplete.
- Erase your data, including by deleting your account.
- Restrict our processing in certain circumstances.
- Object to processing based on our legitimate interests.
- Portability — receive the data you gave us in a structured, machine-readable format.
- Withdraw consent at any time, where we rely on consent. Withdrawing it does not affect processing carried out beforehand.
To exercise any of these, email contact@warun.nu. To delete your account and data, follow the instructions here. We will respond within one month, and will tell you if we need longer because the request is complex. We may ask you to confirm you control the account's email address before we act, so that we do not disclose your data to somebody else.
If you think we are handling your data unlawfully, you can complain to the Polish supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You may also complain to the supervisory authority where you live or work. We would rather you came to us first, so we can try to put it right.
How we protect your data
We use technical and organisational measures appropriate to the risk, including encryption of traffic in transit (HTTPS), storage of passwords as salted hashes using a modern password-hashing function, access controls limiting who can reach production data, rate limiting on sign-in and password reset, and regular application of security updates.
No system is perfectly secure. If a breach of your personal data occurs that is likely to result in a high risk to your rights and freedoms, we will notify you and the supervisory authority as required by Articles 33 and 34 GDPR. You can help by using a password you do not reuse anywhere else.
Children
Warun is not directed at children. You must be at least 16 years old to create an account, which is the age set in Poland under Article 8 GDPR for a child's own consent to information society services.
We do not knowingly collect personal data from anyone under 16. If we learn that we have, we will delete it. If you are a parent or guardian and believe your child has given us personal data, contact contact@warun.nu and we will remove it.
Changes to this policy
We may update this policy, for example if we add a feature that involves new data. When we do, we will change the version date at the top of this page, publish the new text here, and — where the change is significant — tell you in the app or by email before it takes effect. Where a change requires your consent, we will ask for it rather than assume it.
Contact
Questions about this policy or about your data: contact@warun.nu.