Koszyk+ Privacy Policy
1. Controller and scope
The data controller is DMCOREX SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. Marszałka Józefa Piłsudskiego 34, 32-555 Zagórze, Poland, KRS 0001240695, NIP 6282305706, REGON 544704613. Privacy contact: kontakt@dmcorex.pl.
This policy applies to the Koszyk+ mobile application with package identifier pl.koszykplus.app.
2. Data processed by the app
- Google/Firebase account data: user identifier, email address and authentication data;
- profile and plan data: account status, trial, Premium, limits and promotional codes;
- technical and security data: FCM token, document identifiers, synchronisation versions and an administrative-operation log containing the action type, administrator identifier and — until account deletion — the identifier of the affected account;
- group data: group names, names set within groups, member identifiers and email or QR invitations;
- shopping data: products, quantities, units, shops, reservations, buyers, purchase status, sent lists and group history;
- local data: private basket, private history, settings, synchronisation cache and diagnostic report;
- information voluntarily sent to support or in a data-rights request.
3. Storage
The private basket and private history are generally stored locally on the device. Groups, invitations, membership, shared products, sent lists and group history are stored in Firebase because they must be synchronised between users.
4. Purposes and legal grounds
Data is processed for sign-in and account operation, group synchronisation, invitations and lists, notifications, history, account limits, Premium and promotional-code administration, authorised administrative operations, security, error diagnosis and legal compliance. The applicable legal grounds are Article 6(1)(b), (c) or (f) GDPR.
5. Notifications
The app uses Firebase Cloud Messaging. The device token is used only for Koszyk+-related notifications, such as invitations, lists and group changes. Notifications can be limited or disabled in the app and Android settings.
6. Microphone and speech recognition
Microphone access is used only when voice input is started. Koszyk+ does not save its own audio files. Recognition may be performed by an Android/Google system service under that provider's terms.
7. Diagnostics
Diagnostics help identify errors. Reports remain local and are not automatically sent to DMCOREX. The user decides whether to export and share a report. It may contain technical events, error messages, operation times and shortened identifiers.
8. Recipients and sharing
Google/Firebase may process data as the infrastructure provider. Information needed for shared shopping is visible to members of the same group. Koszyk+ does not sell user data, share it with advertisers or use it for behavioural advertising. Data may be disclosed where required by law.
9. Transfers outside the EEA
Google/Firebase may process data outside the European Economic Area. Where applicable, safeguards recognised by law are used, such as an adequacy decision or standard contractual clauses.
10. Retention
Data is retained only as long as needed to provide features, fulfil a user's request or meet legal duties. Temporary data may be automatically deleted. Administrative-operation logs are retained for no more than 24 months for security and accountability; after account deletion, the direct account identifier in such logs is replaced with a technical hash. Local data remains on the device until deleted, app data is cleared or the app is uninstalled.
11. Account and data deletion
The account can be deleted in the app under Settings → Account → Delete account. The Firebase Authentication account and associated app data are deleted. If the deleting user owns a group, that group and its data are also deleted; membership is removed from other groups.
The account can also be deleted without installing the app on the Account and data deletion page. The user verifies ownership by signing in with the same Google account used for Koszyk+. After an additional confirmation, the server automatically deletes the verified account and associated data; no manual administrator processing is required. Local diagnostic reports on a device may require separate deletion in the app or Android settings.
12. Rights
Users may request access, rectification, deletion, restriction, portability where applicable, and may object. They may also lodge a complaint with the competent supervisory authority. Requests can be sent to kontakt@dmcorex.pl.
13. Security
Google/Firebase authentication, access controls and server-side functions are used for operations requiring authorisation. The administration panel requires a separate server-verified role, and operations affecting accounts, Premium and promotional codes are recorded in a security log. No system can completely eliminate all risk.
14. Data not collected for Koszyk+'s own purposes
Koszyk+ does not require GPS location or phone contacts, does not display ads and does not perform advertising profiling.
15. Voluntary provision of data and consequences of not providing it
Providing data is voluntary, but some data is necessary to enter into and perform the agreement for account-based features. Without sign-in data, an account cannot be created and group features cannot be used. Without group, invitation or shopping-list data, the requested synchronised feature cannot be performed.
16. Automated decision-making and profiling
Koszyk+ does not make decisions about users solely by automated means that produce legal effects or similarly significantly affect them. The app does not perform advertising profiling.
17. Changes
This policy may be updated as the app or law changes. The update date is shown at the beginning of the document.