Privacy Policy

1. Who is responsible for your data

The controller of your personal data is Nasi Przodkowie – Marcin Polak, a sole trader registered in the Polish Central Register and Information on Economic Activity (CEIDG), with its registered office at ul. Sienna 9, 70-542 Szczecin, Poland, tax identification number (NIP) 5252912507, EU VAT number PL5252912507. PoloniaHub is a brand of this business. In this policy we call ourselves “PoloniaHub”, “we” or “us”.

You can contact us about your data by e-mail at info@poloniahub.com or by post at the address above. We have not appointed a data protection officer.

2. What this policy covers

This policy applies to personal data we process when you browse poloniahub.com, send us an enquiry through the contact form or by e-mail, or ask us to obtain an official Polish document, certification, apostille, translation or related service. It also explains how we handle information about other people, such as your parents, grandparents or other relatives, which you give us so that we can locate a record.

Our website is operated from Poland and is aimed at people living outside Poland. The General Data Protection Regulation (GDPR) and the Polish Act on the Protection of Personal Data apply to everything we do with your data, wherever you live.

3. What data we collect and where it comes from

When you send an enquiry (contact form or e-mail). Your name, e-mail address, country, and whatever you write about your case. We ask you not to include identity document numbers, PESEL numbers or other sensitive identifiers at this stage.

When you place an order (checkout or order form). Your full name, e-mail address, telephone number, postal address for delivery, your relationship to the person the record concerns, and the details needed to identify the record: names, dates and places of birth, marriage or death, names of parents and, for older records, of grandparents or earlier ancestors. Depending on the document you order, we may also need a copy of your identity document, a signed power of attorney, and proof that you are entitled to receive the record (for example a birth certificate showing your descent).

When you pay. Card payments are handled by our payment provider, Stripe. We receive confirmation of payment, the amount, the last four digits of the card and the card brand. We never see or store your full card number. Where you pay by bank transfer, we see the details shown on the transfer.

While we work on your case. Correspondence with you, applications and letters we send to Polish authorities on your behalf, the documents those authorities issue, and our notes on the progress of the case.

When you visit the website. Technical data such as your IP address, browser type, device type, pages visited and the time of the visit, collected by our server logs and by Google Analytics, which uses cookies. See our Cookie Policy.

Most of this data comes directly from you. Some of it is created during the case (for example the documents issued by a Polish registry office), and some comes from public registers that we search on your instruction.

4. Information about other people

To find a record we usually need details of people other than you: the person the record concerns, their parents, and sometimes further ancestors or relatives. Many of them are deceased; the GDPR does not apply to information about deceased persons, but Polish law still restricts who may obtain a civil status record about them, and we respect those restrictions.

Where the information concerns a living person (for example a living parent or sibling), we process it because it is necessary to perform the contract with you and because we have a legitimate interest in carrying out the search you have instructed (Article 6(1)(b) and (f) GDPR). We use this information only to identify and obtain the record you ordered, we do not use it for any other purpose, and we delete it when the case is closed (see section 10).

We do not normally contact those people directly, because we do not have their contact details and doing so would be disproportionate to the purpose. This policy is our public notice to them under Article 14 GDPR. If you order a record that concerns a living adult other than yourself, please tell that person that you have asked us to obtain it and point them to this policy. Any person whose data we hold can exercise the rights described in section 11.

5. Sensitive information

Some records may reveal information that the GDPR treats as sensitive, for example religious denomination in a historical parish register, or health information in a death record. We process such information only because you have asked us to obtain that particular record, only to the extent it appears in the record itself, and on the basis of your explicit request (Article 9(2)(a) GDPR). We never ask you to provide sensitive information that the authority does not require.

6. Why we use your data and on what legal basis

Purpose	Data used	Legal basis
Answering your enquiry through the contact form or e-mail	Enquiry data	Steps taken at your request before entering into a contract, Art. 6(1)(b) GDPR
Performing the service you ordered: identifying the authority, preparing and filing applications, obtaining the document, arranging apostille, translation and delivery	Order data, case correspondence, documents issued	Performance of a contract, Art. 6(1)(b) GDPR
Taking payment and issuing invoices	Name, address, payment confirmation, invoice data	Performance of a contract, Art. 6(1)(b), and legal obligations under Polish tax and accounting law, Art. 6(1)(c) GDPR
Keeping records of the case and of our correspondence in case of a complaint, dispute or audit	Case file	Our legitimate interest in defending legal claims and demonstrating compliance, Art. 6(1)(f) GDPR
Keeping the website secure and available	Server logs	Our legitimate interest in security, Art. 6(1)(f) GDPR
Measuring how the website is used (Google Analytics)	Cookie identifiers, pages visited, device and browser type, approximate location	Our legitimate interest in understanding how the website is used, Art. 6(1)(f) GDPR. You can object at any time by blocking Google Analytics, as described in the Cookie Policy
Responding to requests to exercise data protection rights	Identity and contact data	Legal obligation, Art. 6(1)(c) GDPR

We do not use your data for marketing e-mails, we do not sell it, and we do not make automated decisions about you.

7. Do you have to give us your data

You are not obliged to give us any data, but we cannot answer an enquiry without a way to contact you, and we cannot obtain a document without the details that identify the record and prove your entitlement to it. If you do not provide them, we will not be able to provide the service.

8. Who receives your data

Polish authorities. To obtain the document we file your application, with the details you gave us and the power of attorney, with the authority that holds the record: a civil registry office (Urząd Stanu Cywilnego), a state archive, a provincial office (Urząd Wojewódzki), a court register, the land and mortgage register, a tax office, the Social Insurance Institution (ZUS) or another office. Each of these authorities is a separate controller of the data it receives and processes it under Polish law.

Service providers who work for us.

• hosting and backup of the website and of our case files: our hosting provider, whose servers are located in Poland;
• e-mail and document storage: Google Workspace, provided by Google Ireland Limited;
• website analytics: Google Analytics, provided by Google Ireland Limited;
• card payments: Stripe Payments Europe, Ltd., Ireland, which processes your payment data under its own privacy policy and also acts as an independent controller for fraud prevention;
• couriers and postal operators, who receive your name, address and telephone number to deliver the document;
• sworn translators, where you order a translation, who receive the document to be translated;
• persons who act for us in Poland where an authority requires a physical visit, who receive the application file for your case.

These providers act on our instructions under written agreements, except for Polish authorities, courier companies in the country of delivery, and Stripe for fraud prevention, which decide for themselves how they process data.

We may also disclose data where the law requires it, for example to a court or a supervisory authority.

9. Transfers outside the European Economic Area

We store and process your data in Poland and in the European Economic Area. Some of our providers may transfer data to other countries:

• Google (e-mail, document storage, analytics) and Stripe (payments) may process data in the United States. Both companies are certified under the EU-U.S. Data Privacy Framework and also rely on the European Commission’s standard contractual clauses;
• when we send the finished document to you at an address outside the EEA, or correspond with you there, the transfer is necessary to perform our contract with you (Article 49(1)(b) GDPR).

You can ask us for a copy of the safeguards that apply by writing to the address in section 1.

10. How long we keep your data

Category	Retention period
Enquiries that do not lead to an order	12 months from our last exchange with you
Submissions stored in the website’s form system	Deleted automatically after 60 days; the data is moved to the case file before that
Details of relatives and ancestors, copies of identity documents, powers of attorney and application files	Deleted within 90 days after the case is closed, unless we need them for a complaint or dispute that is already open
Contract, invoice and payment records	5 years from the end of the calendar year in which the invoice was issued, as required by Polish tax and accounting law
Correspondence relevant to a complaint or a dispute	Until the claim is time-barred under Polish law, normally 6 years
Server logs	12 months
Backups	Up to 30 days; data deleted from live systems disappears from backups within that period
Analytics data	See the Cookie Policy

11. Your rights

You have the right to:

• access your data and receive a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased, where we no longer have a reason to keep it;
• have processing restricted while a dispute about the data is resolved;
• receive the data you gave us in a machine-readable format and have it transmitted to another controller, where processing is based on contract or consent;
• object to processing based on our legitimate interests, on grounds relating to your particular situation;
• withdraw consent at any time, where processing is based on consent; this does not affect processing that took place before you withdrew it.

To exercise any of these rights write to info@poloniahub.com. We will reply within one month; if your request is complex we may extend this by a further two months and will tell you if so. We may ask you to confirm your identity before we act on a request. Exercising your rights is free of charge.

If you believe we have processed your data unlawfully, you may lodge a complaint with the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl. If you live in another EEA country you may instead complain to the supervisory authority there.

12. How we protect your data

The website is served over an encrypted connection (HTTPS). Case files are kept in access-controlled storage, available only to the people working on your case. Identity documents and powers of attorney are shared with authorities only in the form and to the extent the authority requires. We ask you to send identity documents only when we request them, and only through the channel we indicate.

13. Cookies

Our use of cookies and similar technologies, including Google Analytics, is described in the Cookie Policy.

14. Changes to this policy

We may update this policy when our services, providers or the law change. The date at the top shows when the current version took effect. If a change materially affects how we use data you have already given us, we will tell you by e-mail.