Polityka prywatności Smalik System

The Polish text above is binding.

Smalik System (Krzysztof Grzebyta, ul. św. Mikołaja 8, lok. 11/208, 50-125 Wrocław, Poland, tax ID (NIP) 7631020441, kontakt@smalik.pl) provides an online reporting service for e-commerce businesses. The website smalik.pl uses no analytics or advertising tools and no marketing, analytics or profiling cookies; only cookies strictly necessary for its operation and security may be used. The client panel at app.smalik.pl uses only cookies strictly necessary for it to work: to keep a signed-in session and — during the company check and acceptance of the data processing agreement — to remember the result of the company check (at most 30 minutes) and the case link with which further people join the acceptance (at most 7 days, or 37 days for a case sent for review). It uses no analytics or advertising tools and does not read cookies set by other pages in the smalik.pl domain. Session cookies are removed on sign-out and expire after at most 400 days. The anti-abuse protection of the sign-up form uses no third-party provider and no cookies and does not use the IP address.

Account and company check: a person acting for a business can create a panel account with the sign-up form; we process the e-mail address, one-time login codes and technical session data (a code sent by e-mail confirms access to the mailbox, not the person’s identity); our database provider keeps technical logs, including the e-mail address, for the period set in its terms (7 days according to the provider); the provider decides when entries are actually deleted. A sign-up account nobody has signed in to is deleted 24 hours after the last code, and an account without a concluded data processing agreement 72 hours after the last sign-in. Before the data processing agreement is concluded in the panel, the person enters the company’s tax ID (NIP) and their name; we check in public registers (the VAT taxpayer list, the National Court Register (KRS) and CEIDG) that the company is active and that the person is registered as authorised to represent it, sending the registers only the NIP or KRS number. From the registers we receive company data and data of the people registered there (for a KRS company: the current extract, including the management board and commercial proxies with their functions, names partly masked as published by the register). The comparison is made in server memory only; our database stores no NIP, company name, names or addresses — only the result, the rule applied and SHA-256 hashes. Each accepting person receives a confirmation e-mail (agreement version and hash, date and time, company, NIP, their name and account e-mail, their register entry, statement, pre-contract answers, the basis for representation and, for a KRS company, the board and proxies) with the agreement PDF and, for a KRS company, the register extract attached; after conclusion each receives an e-mail with the agreement PDF; Smalik System receives a copy of each. If two or more people must accept, the first one forwards a link (valid 7 days) — we do not collect the others’ addresses; if representation cannot be established from the register, a case is sent for review (valid 30 days) and documents can be sent to kontakt@smalik.pl. Copies of confirmations, conclusion e-mails and review cases are kept as evidence of the agreement for its term and until the limitation periods for claims expire (Art. 6(1)(b) and (f) GDPR). Before a service agreement, a business may connect its store to see a result: we do not keep the store access (removed when the check starts, unused access after 30 minutes). Once a day we also read the store’s setting for erasing personal data from orders to show it in the panel.

Meta data: a client connects their own ad accounts through Facebook Login for Business with read-only access (ads_read) and selects which accounts to share. For those accounts we read the account ID and currency, and daily spend, impressions and clicks at campaign and account level. We do not read personal data — neither the profile of the person who connects the account nor data about people who see the ads. We do not create, edit or manage ads. We use the data only for that client’s own reporting; we do not sell it, share it with other clients or companies, or combine it with other clients’ data, including in aggregated or derived form. Access tokens are stored encrypted.

Google Ads data: a client can connect a Google Ads account in two ways — (A) by adding our integration account, google-ads@ops.smalik.pl, as a user of their own Google Ads account with “Read only” access, or (B) with the “Połącz Google Ads” (Connect Google Ads) button in the panel, by signing in with a Google account that has access to the Google Ads account and granting our app consent in Google’s official window; the client decides which accounts we retrieve data from, and the data retrieved is the same in both cases. From those accounts we retrieve only reporting data — daily cost, impressions and clicks at campaign and account level, on connection also for up to the previous 12 months — updated several times a day, together with the account ID, account currency and campaign IDs. We do not retrieve, store or use personal data from Google Ads accounts — neither about account users nor about people who see the ads — nor billing, payment or audience data, including data that “Read only” access technically allows viewing, such as the account’s user list or billing information. If someone acting for the client contacts us about the connection (invitation, e-mail), we process the data provided in that contact as described in section 4. We do not create, edit or delete campaigns or any other account elements. Although the permission scope our Google application uses technically allows managing Google Ads data, we limit retrieval and processing to the reporting data listed above. We use the data only for that client’s own reporting; we do not sell it, share it with other clients or companies, or combine it with other clients’ data, including in aggregated or derived form. With option (B), at the moment of consent Google sends us the e-mail address and Google account ID of the person granting consent; we only check that the address is verified by Google and do not store the address or the ID; we store an encrypted credential (refresh token) giving access to the Google Ads accounts, the date of consent and the list of Google Ads account IDs available in that connection; we never see or store the Google account password. The client can end access at any time: with option (A) by removing google-ads@ops.smalik.pl from the account’s users; with option (B) with the “Odłącz Google Ads” (Disconnect Google Ads) button in the panel (we then revoke the consent at Google) or in their Google Account settings, under connections with third-party apps; we then cannot retrieve new data. On request we delete data already retrieved and anything derived from it; if we find that access was revoked without such a request, we notify the client and, unless access is restored within 30 days, delete that data. Smalik System’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Store data (when connected): order values, products, quantities, discounts, product cost, refunds and cancellations; buyers only as a pseudonym derived from their store account ID. We never store buyers’ names, e-mail addresses, delivery addresses, phone numbers, IP addresses or payment data. We act as a data processor for the client.

Processors: Supabase (EU, Frankfurt), Google Workspace (under Google’s Cloud Data Processing Addendum), Google Cloud (OAuth client and authorisation handling, no storage of client data), Clever Cloud (EU, France — client panel hosting), Lettermint (EU — service e-mails: login codes, agreement confirmations with attachments, review cases, deletion notices and confirmations, sub-processor notifications), Hetzner (EU, Germany — encrypted backups; the encryption key is not stored by the provider), website and kontakt@smalik.pl mailbox hosting provider (Poland), including copies of e-mails sent by the service. Some providers may process data outside the EEA, in particular in the United States, on the basis of an EU adequacy decision or standard contractual clauses with supplementary safeguards; details: kontakt@smalik.pl. Retention: for the duration of the service; after the contract ends, after the client disconnects the Meta app, after Google Ads is disconnected in the panel, 30 days after Google Ads access is revoked and not restored, or on request — deleted from active systems without undue delay and no later than within 30 days, and from backups and version history no later than within a further 30 days. After the contract ends, access to the client’s ad accounts and store ends the next day and the data is deleted after 14 days, during which the client may ask for it to be returned; if a business that concluded the data processing agreement does not conclude a service agreement, its check result and account data are deleted 30 days after the later of the agreement or the last check, with 7 days’ notice by e-mail; deletions are automatic and confirmed by e-mail. Service e-mails (content with attachments, recipient address and delivery data) are kept by our e-mail provider, Lettermint, for 28 days after creation from 8 November 2026 (until then, for the term of our agreement with the provider); delivery statistics for up to 90 days. Data deletion instructions: smalik.pl/usuwanie-danych/.

You may object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation.