Privacy Policy

Draft for legal review. This policy is a draft; a lawyer will review it before final publication. The technical description matches the state of the portal on 2026-10-03; we will update the policy after every change (forms, Help desk, new services).

The data controller is Fundacja Ludzka Miara (Human Measure Foundation), with its seat in Żurawica, Poland. Registration in progress: we will publish the full seat address and the KRS, NIP and REGON numbers after entry in the KRS register.

Contact for personal data matters: fundacja@miara.org.pl. Information about a possible data protection officer will be added once the foundation is entered in the National Court Register (KRS).

The portal contains no advertising, does not profile visitors, does not sell data and does not use cookies for tracking. Public pages can be read without creating an account and without providing any data.

The server on which the portal runs, like any web server, processes the IP address and technical data of the request (e.g. the page address, the browser) while the connection lasts. This data is needed to deliver the page and ensure security (protection against attacks). Legal basis: the controller's legitimate interest — security and operation of the portal (Art. 6(1)(f) GDPR). The retention period of logs is given in section 5.

We count visits with Rybbit, which runs on a server controlled by the foundation and its technical operator, not in a service of a third-party advertising company. The settings we applied:

• no cookies and nothing is stored in the visitor's browser;
• the IP address is not stored in the statistics database; a hash, with a daily salt, is created from it (together with browser data), so visits by the same person on different days cannot be linked;
• no session recording and no storing of URL parameters;
• the statistics script loads from the portal's domain (miara.org.pl), so the browser does not connect to a foreign domain for this purpose;
• statistics do not cover the editorial panel or form pages;
• the statistics dashboard is to be public (in line with the foundation's principle of transparency); we will give its address once it is launched.

The purpose is to know which content is read. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

The portal's editorial panel is available only to the foundation's team. Login is handled by the Supabase Auth service. We process the email address and data necessary for logging in and securing the account (e.g. user identifier, session data). Legal basis: Art. 6(1)(f) GDPR (security and operation of the portal) and, for collaborators, Art. 6(1)(b) or (f). Visitors do not create accounts.

When you write to the foundation's address (e.g. fundacja@miara.org.pl), we process the content of your message and your email address in order to reply and to keep correspondence. Legal basis: Art. 6(1)(f) GDPR; if the message concerns concluding a contract or cooperation — point (b). Email is handled by a mail server (Stalwart) controlled by the foundation and its technical operator. The retention period of correspondence is given in section 5.

At the time this page is published, the portal does not offer forms that collect personal data from visitors. Before forms are launched (including the Help desk for people harmed by an AI system's decision), the policy will be supplemented; a data protection impact assessment is planned beforehand.

We will conclude data processing agreements (DPAs) with Supabase and the other providers before launching features that process personal data in their services. Because the provider is a US company while the data is stored in the EU, any transfer outside the European Economic Area takes place on the basis of standard contractual clauses or another mechanism provided for in Chapter V of the GDPR.

Data is not passed to advertising networks or data brokers.

• statistics: to be added after registration in the KRS;
• server logs: to be added after registration in the KRS;
• team accounts: until the end of cooperation;
• correspondence: to be added after registration in the KRS.

You have the right of access to your data, rectification, erasure, restriction of processing, data portability, and the right to object to processing based on legitimate interest. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). To exercise your rights, write to the address given in section 1. Providing data is voluntary; you do not have to provide any just to read the portal.

We do not make decisions about visitors based solely on automated processing, including profiling.

The connection to the portal is encrypted (HTTPS). The application server runs on a separate system account with limited privileges. We make regular database backups on servers of the foundation and its operator.

We publish the current version on this page with the date of the last update (in the header). Effective date: to be set after registration in the KRS.