Privacy policy

1. Data controller

The controller of your personal data is Maksymilian.org, Konopnica 95c, 21-030 Motycz, Tax ID (NIP): PL7133092677. Contact: [email protected].

2. What data we process

Account: first and last name, e-mail address, password (only a hash of it is stored), optionally a phone number and a profile picture, your chosen language and theme.

Signing in with Google or Apple: the account identifier at the provider and an e-mail address (possibly Apple's private relay address), and on the first sign-in with Apple your name.

Using the service: favourite stops, routes and companies, saved connections, notifications, device tokens for push notifications, support requests and their content.

Drivers and carrier staff: assigned trips and schedule, leave requests, and in driver mode the GPS position of the vehicle, shared with passengers during a trip.

Device location: for passengers the app uses it only on the device to show nearby stops and does not send it to our servers. For drivers in driver mode the position is sent to the server during a trip. You can turn location access off in your phone's settings at any time.

Technical data: a request log (account identifier, address without query string, response code, time), error reports from the apps and the website (without the content of your data), and on the website visit statistics (Google Analytics).

3. Why and on what legal basis

Providing the service and running your account, including support — Art. 6(1)(b) GDPR (performance of a contract).

Security, abuse prevention, diagnosing errors, backups — Art. 6(1)(f) GDPR (our legitimate interest).

Website visit statistics and access to location — Art. 6(1)(a) GDPR (consent), which you can withdraw at any time.

Legal obligations (for example accounting) — Art. 6(1)(c) GDPR.

We do not sell data and do not use it for advertising or to track you across apps and websites.

4. Who we share data with

Infrastructure providers acting on our behalf: server hosting (Oracle Cloud), Cloudflare (protection and delivery of the website, backups in R2), Sentry (error reports, EU region), an e-mail delivery provider.

Google and Apple — only if you sign in with their account.

The carrier you belong to as a driver or employee sees the data needed to manage trips and schedules.

Some providers are based in the USA; transfers rely on the European Commission's adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.

5. How long we keep data

Until you delete your account. After deletion we erase personal data or irreversibly anonymise it; records that must stay in a carrier's history (for example completed trips) lose their link to you.

Backups are overwritten within about 12 months; the request log is kept briefly (usually a few weeks).

6. Deleting your account

In the app: Profile → "Delete account". On the website: Profile → "Delete account". You can also write from the e-mail address of the account to [email protected]. Details: etabus.com/en/account-deletion.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on our legitimate interest. A message to [email protected] is enough.

You have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw) or another EU supervisory authority.

Providing data is voluntary, but without it we cannot create or sign you in to an account.

8. Cookies and browser storage

The website uses browser storage to work: the sign-in session, your language and theme. For statistics (Google Analytics) we use cookies only with your consent. The mobile apps use neither Google Analytics nor advertising.

9. Children

The service is not directed at people under 16 and we do not knowingly collect their data.

10. Changes

We will announce material changes in the app or on the website. The current version is always at this address.