PlonHub Privacy and Cookie Policy

This Privacy Policy sets out the rules for processing personal data and using cookies in the PlonHub website available at plonhub.com (the „Service").

Capitalised terms not otherwise defined in this document have the meaning given to them in the Terms of Service.

1. Data controller and contact

The controller of personal data is Damian Pieszczyński, conducting business activity under the name „Damian Pieszczyński", Al. Jana Pawła II 64/36, 00-170 Warszawa, Poland, NIP 5242324387 (the „Controller").
On all matters concerning the processing of personal data, the User contacts the Controller at: rada-starszyzny@plonhub.com.
The Controller has not appointed a data protection officer.

2. What data we process and its sources

The Controller processes data provided by the User and data collected automatically in connection with the use of the Service.
Categories of data processed:
1. Account and profile data: e-mail address, password in hashed form, User name, Channel identifier, display name, profile description, avatar and Channel graphics, language;
2. external login data: the Google account identifier and related authentication data — where Google login is selected;
3. Content posted by the User: Video Materials together with metadata, Comments, reactions, Subscriptions;
4. usage data: session data, timestamps, playback statistics (playback time and progress), information about the device and browser;
5. data of non-logged-in Users concerning playbacks and reactions, identified by means of a hash created from the IP address and browser data (User-Agent);
6. data related to reports and moderation: the content of the report, its reason, and the resolution;
7. communication data: records of e-mails sent (recipient address, subject, delivery status).
Providing data is voluntary but necessary to create an Account and use functions requiring registration. Failure to provide data prevents the provision of those Services.

3. Purposes, legal bases, and retention periods

Purpose of processing	Categories of data	Legal basis (GDPR)	Retention period
Creating and operating an Account, providing the Services, including hosting and sharing Content, Subscriptions, and notifications of new Video Materials	Account and profile data, external login data, Content, usage data	Art. 6(1)(b) (performance of a contract)	For the period the Account is operated; after its deletion, data is deleted and backup copies within up to 30 days
Ensuring the security of the Service, preventing abuse, rate-limiting, counting playbacks and reactions, internal statistics	Usage data, IP address, hash of IP address and browser data	Art. 6(1)(f) (legitimate interest of the Controller)	Up to 12 months; aggregated statistical data — indefinitely in a form preventing identification
Handling reports, moderating Content, and keeping documentation required by the rules on digital services	Report and moderation data, Account data	Art. 6(1)(c) (legal obligation) and Art. 6(1)(f)	For the period necessary to handle and demonstrate compliance, no longer than the limitation period for claims
Handling complaints and establishing, pursuing, or defending claims	Account data, usage data, correspondence	Art. 6(1)(f) (legitimate interest)	Until the limitation of claims
Sending e-mails related to Account servicing (confirmations, verification, password reset)	E-mail address, records of dispatches	Art. 6(1)(b) and Art. 6(1)(f)	For the period the Account is operated; records of dispatches — up to 24 months
Audience analytics using external tools (Google Analytics) and cookies other than necessary	Cookie identifiers, data on use of the Service	Art. 6(1)(a) (consent)	Until consent is withdrawn or the cookies expire
Marketing and advertising activities — if introduced in the future	Data indicated when giving consent	Art. 6(1)(a) (consent)	Until consent is withdrawn

4. Cookies and analytics tools

The Service uses cookies and similar technologies. The following are used:
1. necessary cookies — required for the Service to function, including authentication, session maintenance, and security; their use does not require consent;
2. analytics cookies — used to analyse how the Service is used, applied only after consent has been given;
3. marketing cookies — applied only after consent has been given, where advertising activities are introduced.
The Service uses the Google Analytics 4 tool provided by Google Ireland Limited for statistical purposes, using a consent management mechanism (Consent Mode). Before consent is given, the tool does not store or read analytics cookies and operates on a limited basis; after consent is given, the tool collects data in full scope, including by means of cookies.
The User gives and withdraws consent to cookies other than necessary via the consent mechanism available in the Service and by changing browser settings. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
The User may change cookie preferences at any time on the dedicated cookies page available in the Service.

5. Data recipients and processors

Personal data is entrusted for processing to entities providing the Controller with services necessary to operate the Service:

Entity	Scope	Location
OVHcloud	Hosting of the Service and database	European Economic Area
BunnyWay d.o.o. (bunny.net)	Storage and delivery (CDN) of Video Materials	European Economic Area (Slovenia)
Mailjet (Sinch)	Sending e-mails	European Economic Area (France)
Google Ireland Limited	Authentication (Google login) and analytics (Google Analytics)	European Economic Area / United States

Data may be disclosed to public authorities entitled to obtain it under the law.
Video Materials, Comments, the User name, and Channel data marked as public are available to other Users and visitors of the Service — in accordance with the visibility settings selected by the User.

6. Transfers of data outside the EEA

Data processed by the entities indicated in § 5 section 1 is, as a rule, stored within the European Economic Area.
As regards the use of Google services (login and analytics), data may be transferred to the United States. The transfer takes place on the basis of a European Commission adequacy decision (the Data Privacy Framework, in which the provider participates) and standard contractual clauses.

7. Rights of the data subject

The User has the right to: access data, rectify data, erase data, restrict processing, data portability, and object to processing based on the Controller's legitimate interest.
To the extent that processing is based on consent, the User is entitled to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
The User exercises the rights referred to in sections 1 and 2 by contacting rada-starszyzny@plonhub.com or — as regards data erasure — by deleting the Account.
The User has the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa).

8. Children's data

An Account may be created by a person who is at least 13 years of age. A person under 16 years of age uses the Service, to the extent requiring consent, with the consent of a parent or legal guardian.
Upon obtaining justified information that data concerns a person under 13 years of age, or a person under 16 years of age processed without the guardian's consent, the Controller takes steps to delete such data.

9. Automated decision-making and profiling

The Controller does not take decisions with respect to the User based solely on automated processing, including profiling, that would produce legal effects concerning the User or similarly significantly affect them.

10. Data security

The Controller applies technical and organisational measures ensuring protection of data appropriate to the risks, including storing passwords in hashed form, encrypting data transmission, and limiting access to data to authorised persons.

11. Amendments to the Privacy Policy

The Controller is entitled to amend the Privacy Policy in the event of a change in the law, a change in the scope or manner of providing the Services, or a change in the tools used in the Service. The Controller informs of an amendment to the Privacy Policy by publishing the amended version in the Service and, to Registered Users, also by electronic means.