CSM Mate - Privacy Policy

The Service Provider, as the controller of Users’ personal data, when collecting and processing personal data, and also when collecting data indirectly from the data subject, primarily applies the principles arising from applicable personal data protection regulations, namely the principles of:

• data minimization and purpose limitation,
• lawfulness, fairness and transparency,
• integrity and confidentiality of the processed personal data,
• limiting the period of processing and storage of data to the necessary minimum.

What information does the App obtain and how is it used?

Information provided by the User

The App obtains information that is provided by Users when registering an account in the App. Account registration is required to use the App.

Information provided by the User, necessary for booking Partners’ Services, providing the Partner Service and issuing accounting documents, includes, among others: first name, last name, email address, phone number and details of booked Partner Services. A request to issue an invoice or another accounting document by a Partner may result in the need to provide the Service Provider with the User’s billing data, such as residential address, country of tax residence and NIP/Tax ID number.

The legal basis for processing these data is the necessity for the performance of a contract (Article 6(1)(b) GDPR) and the fulfillment of the Service Provider’s legal obligations, such as invoicing (Article 6(1)(c) GDPR).

The Service Provider may also use the information provided to contact the User in order to provide important information, required notices and marketing information, based on the User’s explicit consent (Article 6(1)(a) GDPR) or based on a legitimate interest in direct marketing of similar services (Article 6(1)(f) GDPR), with the possibility for the User to opt out at any time.

Information collected automatically

In addition, the App may automatically collect certain information, including but not limited to: the type of mobile device used, the unique device identifier of the mobile device, the IP address of the mobile device, the mobile operating system, the types of mobile web browsers used, and information about how the App is used.

Technical data related to the use of the App (e.g., IP address, device model) are processed on the basis of the Service Provider’s legitimate interest (Article 6(1)(f) GDPR), consisting in ensuring security, improving the quality of the App’s operation and analyzing how it is used.

Does the App collect precise real-time location information of the device?

This App does not collect precise information about the location of the User’s mobile device.

Do third parties see and/or have access to information obtained by the App?

Only aggregated, anonymous data are periodically transmitted to external service providers or third parties to help the Service Provider improve the App and the services provided. The Service Provider may share information about the User with third parties in the manner described in this privacy statement. This includes sharing the necessary data with trusted payment service providers in order to process fees for Partners’ Services.

The Service Provider may disclose Information provided by the User and information collected automatically:

• as required by law, for example to comply with a court order or similar legal process;
• when it believes in good faith that disclosure is necessary to protect its rights, to protect the safety of the User or the safety of others, to investigate fraud, or to respond to a request from a government authority;
• with its trusted service providers who work on its behalf, have no independent right to use the information disclosed to them, and have agreed to adhere to the rules set out in this privacy statement;
• with trusted payment service providers, in particular PayPro S.A. — the operator of the Przelewy24 service — and banks (in the case of bank transfers), in order to process and confirm payments for Bookings made by the User. The App does not store the User’s full credit card data. Such data are handled directly by PayPro S.A., as the Payment Operator, and are subject to its own privacy policy.

What are my opt-out rights?

The User can easily stop all information collection by the App by uninstalling it. The User may use the standard uninstall processes available on their mobile device or via a mobile application marketplace or network.

Each User whose data are processed by the Service Provider has the right to lodge a complaint with the personal data protection supervisory authority if they consider that the processing of personal data by the Service Provider infringes personal data protection regulations, including the GDPR, or their rights and freedoms.

The User has the right to access the content of their personal data and the right to rectify, erase or restrict the processing of such data, the right to data portability, and the right to object to their processing at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

Data Retention Policy, Managing User Information

The Service Provider will retain the data provided by the User for as long as the User uses the App and thereafter for the period necessary to comply with its obligations under applicable law. The Service Provider will retain information collected automatically for up to 24 months and may thereafter retain it in aggregated form. The User may request that the Service Provider delete the data provided by the User via the App. For this purpose, it is necessary to contact the Service Provider at help@csmgdynia.pl. Please note that some or all of the data provided by the User may be required for the proper functioning of the App. Transaction-related data (e.g., data on invoices) are retained for the period required by tax and accounting law — for a period of at least five years from the end of the calendar year in which the transaction occurred in connection with Partner Services.

Persons under 18 years of age

The App is intended for people who are at least 18 years old, as this is the minimum age required to use Partners’ Services. The Service Provider does not knowingly collect or solicit data from persons under 18 years of age. If you are under 16, please do not use the App or provide any information through it. If we learn that we have collected or received personal data from a person under 16, we will delete that information. If you believe that we may have any information from or about a person under 16, please contact us at help@csmgdynia.pl.

Security

The Service Provider cares about maintaining the confidentiality of your information. It provides physical, electronic and procedural safeguards to protect information that is processed and maintained. For example, it limits access to this information to authorized employees and contractors who need to know it in order to operate, develop or improve the App. Please remember that although the Service Provider strives to provide appropriate security for information that is processed and maintained, no security system can prevent all potential security breaches.

Changes to the Privacy Policy

This Privacy Policy may be updated for any reason. Changes will be published as a consolidated text together with information about the changes on the website (https://www.centrumszkolenmorskich.pl/polityka-prywatnosci/), as well as in the App. The Service Provider will inform Users about the change to the Privacy Policy via an email message sent to the email address associated with the User’s Account, 14 days before the changes take effect. Continued use of the App by the User may be conditional upon prior acceptance of the changes to the Privacy Policy. The User has the right to refuse to accept the changes to the Privacy Policy and, in such case, the right to request deletion of the Account by submitting an appropriate statement in writing or in documentary form, within 14 days from the date of notification of the planned change.

This privacy policy is effective as of (effective date: 27 August 2026).

User Consent

By using the App and confirming that you are at least 18 years old (the minimum age required to use the Partner Service),

you consent to the processing of your information by the Service Provider in accordance with this Privacy Policy in its current wording and with changes introduced by the Service Provider. “Processing” means the use of cookies on a computer/handheld device or using or touching information in any way, including but not limited to: collecting, storing, deleting, using, combining and disclosing information.

Contact

If you have any questions regarding privacy while using the App or questions about these practices, please contact the Service Provider via email at help@csmgdynia.pl. For matters related to personal data protection, you can contact the following email address: help@csmgdynia.pl