Privacy Policy

This Privacy Policy constitutes an annex to the Terms of Service. Terms written with an initial capital letter should be understood as defined in the Terms of Service.

Boyfriend respects users' personal data and complies with the requirements of the law, particularly Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR).

Boyfriend ensures that its employees and subcontractors have been trained in the protection of personal data.

For what purpose does Boyfriend process personal data?

Personal data provided through the platform and during contact with Boyfriend is used solely to provide services specified in the Terms of Service and ordered by the user, as well as to contact Boyfriend at the user’s request.

Who has access to the user's personal data?

The controller of the personal data provided during account registration on the platform, when submitting inquiries, and during participation in competitions and promotions organized by Boyfriend is:

Digital Industries sp. z o.o.
Address: ul. Dwernickiego 6 lok. 4, 31-530 Kraków, Poland
VAT: PL 6751633275
KRS: 0000713650

User's Rights

The user has the right to request access to their personal data from the controller and receive information on the purpose of its processing, the categories of data processed, the recipients of the data, and the duration for which the data will be stored (if this period cannot be determined, the user has the right to be informed about the criteria used to determine it).

The user also has the right to correct any inaccurate personal data and to request the completion of incomplete personal data.

The user has the right to request the deletion of personal data without undue delay if:

The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
The consent to the processing of personal data has been effectively withdrawn.
The user objects to the processing of personal data for marketing purposes.
The user objects to the processing (including profiling) of personal data based on the legitimate interest of Boyfriend or a third party unless there are legitimate grounds for processing that override the interests, rights, and freedoms of the user, or the processing is necessary for the establishment, exercise, or defense of legal claims.

The user has the right to request a restriction of the processing of personal data if:

The user contests the accuracy of the personal data – for a period enabling the controller to verify the accuracy of the personal data.
The processing is unlawful, and the user opposes the deletion of personal data and requests a restriction of their use instead.
The controller no longer needs the personal data for processing purposes, but the user requires them to establish, exercise, or defend legal claims.
The user has objected to the processing (under Article 21(1)) pending verification of whether the legitimate grounds of the controller override those of the user.

If the user requests the restriction of the processing of personal data, Boyfriend will refrain from processing the data without the user’s consent, except for storing them or processing them for the establishment, exercise, or defense of legal claims, protecting the rights of another natural or legal person, or for reasons of important public interest of the Union or a member state. The user will be informed before the restriction is lifted.

The user has the right to object to the processing of personal data for direct marketing purposes, including profiling to the extent that it relates to such marketing. After an objection is raised, Boyfriend will stop processing the user's personal data for direct marketing purposes (including profiling). The user has the right to raise objections using automated means based on technical specifications.

The user has the right to receive their personal data in a structured, commonly used, machine-readable format and to transfer those data to another controller without interference from Boyfriend, provided that:

The processing is based on the user’s consent or a contract requiring the processing of data; and
The processing is carried out by automated means.

Boyfriend is obliged to transfer the user’s data directly to another controller (if technically feasible) at the user’s request.

The user has the right to withdraw consent to the processing of personal data at any time, but the withdrawal does not affect the lawfulness of the processing that took place prior to the withdrawal of consent.

Regarding the processing of personal data, the user has the right to lodge a complaint with the President of the Office for Personal Data Protection.

What personal data does Boyfriend collect?

To create and maintain a user account, the following data are collected:

To create a user account:
- email address;
- name;
Data provided during contact with Boyfriend (most commonly first name, email address, username);

The user’s personal data are collected and processed based on the Terms of Service and within the scope provided by the user during the account creation process.

How long are personal data stored?

Boyfriend stores personal data from the moment the user registers their account or starts using other services until they stop using them. After receiving an email requesting the deletion of the account or cessation of other services, the permanent deletion of data from Boyfriend's servers may take up to 7 business days.

Exceeding this time frame is permitted only to fulfill Boyfriend’s legal obligations, such as accounting purposes for users who have used paid services, or to defend Boyfriend’s interests in the case of complaints.

Who does Boyfriend share personal data with?

Boyfriend shares users' personal data only with companies that provide services enabling the proper operation of the platform:

Zoho Mail: Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands – used to send and receive emails from the user.
Cloudflare: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA – hosting provider for platform servers, collects email addresses provided by users during the account registration process.
MailChimp: The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE Suite 5000, Atlanta, GA 30308, USA – collects email addresses provided by users during the registration process.
Mailgun Technologies, Inc. 548 Market St. #43099, San Francisco, CA 94104, USA – used to send transactional emails and notifications.

Boyfriend informs users that the data provided during API account registration is transferred to a third country – the United States of America. This is due to the fact that the servers owned by Mailgun and MailChimp are located in the United States. The systems of Mailgun and MailChimp ensure the confidentiality of the data transferred to the United States.

Cookies and server logs

To facilitate the use of the platform and monitor its performance, the management mechanism uses a technology called cookies – data stored by the platform's server and hosting provider Cloudflare on the user's computer or mobile device.

The platform uses three types of cookies:

Session cookies – temporary files stored on the user’s device until they log out, leave the website, or close the browser.
Permanent cookies – stored on the user's device for the time specified in their parameters or until they are deleted by the user.
Local storage – stored on the user’s device for a defined or indefinite period or until they are deleted by the user.

Cookies are not used to collect personal data about users who visit the platform.

The user can disable the option to accept cookies in their web browser settings at any time, but this may cause issues with the platform's functionality.

Below are links to guides on how to disable cookie acceptance in the most popular browsers:

Cookies are used for:

Creating statistics that help understand how users use the platform to improve its content;
Maintaining the user’s session, so there is no need to log in each time;
Personalizing ads;
Generating statistics that help in the administration of the platform and improving the quality of services offered.

These summaries are consolidated and do not contain data that identifies the visitors of the platform. These data are not disclosed to any other persons or entities.

Collected server logs, which contain, among other things, the user's IP address, the request time, the first line of the HTTP request, the HTTP response code, the number of bytes sent by the server, information about the user's browser, information about errors that occurred during the HTTP transaction, and information about the type of device, are stored indefinitely.