Privacy Policy

Last updated: 2026-06-11

1. Data controller

The data controller is Jakub Kolada, sole proprietor trading as Jakub Kolada Solutions (operator of WhiskyPolska), VAT ID (NIP): 9512416493, Al. Solidarności 68/121, 00-240 Warsaw, Poland. Contact: kontakt@whiskypolska.pl. The service is operated for informational and collector purposes.

2. Data we collect

Depending on how you use the service we process:
• email/password registration: email address, first and last name, password (stored as a bcrypt hash), a one-time verification code and your declaration of being 18+;
• Google sign-in: your Google account identifier, email address, first and last name and the birth date you provide;
• automatically: server logs (IP address, date/time of request, browser information);
• from your activity: tasting notes, lists and basket contents, submitted feedback, account settings and your newsletter consent status (if given).

3. Purposes and legal bases

We process data to: operate your account and provide the service — Art. 6(1)(b) GDPR; ensure security, prevent abuse and keep logs — Art. 6(1)(f) GDPR; verify age and email address — Art. 6(1)(f) GDPR (legitimate interest) in connection with alcohol-related legislation; handle contact and complaints — Art. 6(1)(f) GDPR; send the newsletter — solely on the basis of your voluntary consent (Art. 6(1)(a) GDPR), which you may withdraw at any time with no effect on your account.

4. Recipients and processors

Data may be entrusted to trusted providers acting on the controller's behalf: Hetzner Online GmbH (hosting; servers in the European Union), Resend, Inc. (sending emails such as verification codes), Google LLC (Google Analytics 4 — anonymous traffic analytics with IP anonymization; and — only if you choose Google sign-in — OAuth authentication). Data is not sold. Any transfer outside the European Economic Area takes place only under safeguards required by the GDPR (e.g. standard contractual clauses).

5. Retention

Server logs are kept for 30 days. Account data is kept until you delete your account or request erasure. A one-time verification code is valid for up to 15 minutes and then expires.

6. Cookies

The service uses cookies for the following purposes:
Essential: logged-in user session (connect.sid), language preference (wp_lang), theme preference (wp-theme, localStorage), and age confirmation (age_confirmed). The session cookie expires when you close your browser by default; if you tick "Remember me on this device" it expires after 30 days.
Analytics (require consent): Google Analytics 4 (_ga, _ga_*) — collects anonymized traffic data (pages visited, session duration, device, country) to improve the service. IP addresses are anonymized before processing. Analytics cookies expire after 14 months. Analytics cookies load only after you give consent in the cookie banner (Google Consent Mode v2 — consent is denied by default). You can change your choice anytime via “Cookie settings” in the footer. No advertising cookies are currently used.

7. Your rights

You have the right to: access your data, rectification, erasure (right to be forgotten), restriction of processing, data portability, to object to processing based on legitimate interest, and to lodge a complaint with the supervisory authority (in Poland: the President of the Personal Data Protection Office, UODO). Providing data is voluntary but necessary to create an account and use features that require signing in.

8. Account deletion

You can delete your account yourself from your profile (the “Delete account” section). Once requested, your account and personal data are permanently removed within 14 days — this window lets you cancel and protects against mistakes or session hijacking. Private notes are always deleted; public reviews are kept anonymised by default (with no link to you) unless you choose to delete them too. Nightly database backups (14-day retention) may contain data until the backup rotates — backup data is overwritten on rotation and is not restored into the live database. Server logs expire independently after 30 days.

9. Newsletter

The newsletter is entirely optional and requires separate consent (a dedicated, unchecked-by-default checkbox at registration). Not giving consent has no effect whatsoever on creating or using your account. You can withdraw consent at any time in your profile settings (the “Newsletter” section); unsubscribing carries no negative consequences and never blocks sign-in (Art. 7(3) GDPR). We keep your consent status until you withdraw it.

10. Contact

For data protection matters write to: kontakt@whiskypolska.pl.