Essential cookies
These cookies are necessary for you to use the website and its functions. They cannot be turned off.
Privacy Policy
Information on how Alvis processes and protects the personal data of platform users, in accordance with GDPR.
Translation of the Polish original. Clause numbering is unchanged. Polish original
I. GENERAL PROVISIONS
1. This Privacy Policy sets out the rules for processing and protecting the personal data of Users of the Website and the ALVIS mobile application.
2. The controller of personal data is Alvis sp. z o.o., with its registered office in Poland, hereinafter referred to as the Controller.
3. The Controller processes personal data in accordance with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
4. The Controller may be contacted regarding personal data protection at: kontakt@alvis.pl.
5. Use of the Website means that the User has read this Privacy Policy.
II. DEFINITIONS
Personal Data – any information relating to an identified or identifiable natural person.
Cookies – text files stored on the User's terminal device and used to provide the services available on the Website.
Newsletter – an Electronic Service provided by Alvis by electronic mail (email), consisting of Users voluntarily receiving periodic information about the Website, including services, news and promotions.
Website/Platform – the website available at
User – a natural person using the Website and/or the ALVIS mobile application.
Account – the User's individual account within the Website, enabling, among other things, data storage, posting opinions and use of the functionalities offered by the Platform.
Profile – the publicly accessible part of the User's Account, comprising information made available by the User on the Website, particularly about experience, qualifications, preferences and other data relevant to using the Platform.
Third Country – a country outside the European Economic Area (EEA).
III. SCOPE OF PERSONAL DATA PROCESSING
The Controller processes Users' Personal Data for the following purposes:
providing platform services and intermediating the conclusion of Care Agreements (Article 6(1)(b) GDPR),
handling settlements and fulfilling contractual obligations (Article 6(1)(c) GDPR),
analytical and statistical purposes (Article 6(1)(f) GDPR),
direct marketing within the scope of the consent given (Article 6(1)(a) GDPR),
ensuring the security of the services provided (Article 6(1)(f) GDPR),
enabling use of the interactive features of the Website and/or application (Article 6(1)(b) GDPR).
fulfilling tax and reporting obligations.
IV. TYPES OF DATA PROCESSED
Depending on the Website functionalities used and obligations imposed by law (including tax obligations and obligations towards competent public authorities), the Controller may process the following Personal Data of Users:
• first name and surname,
• email address,
• telephone number,
• residential address or address where the service is performed,
• date of birth,
• tax identification number (e.g. NIP or PESEL),
• country of tax residence,
• payment and transaction history data,
• information about remuneration and amounts paid out through the Platform,
• data on activity on the Website (e.g. IP address, cookies, system logs),
• geolocation data (with the User's consent),
• data on the use of Website and application functionalities,
• other data provided voluntarily by the User in connection with using services or in response to a request from authorised authorities.
The Controller may also be required to disclose certain data to relevant public authorities (e.g. tax authorities or law enforcement agencies) in cases provided for by law.
The Controller does not verify the accuracy of data provided by the User. The User bears sole responsibility for the accuracy, completeness and currency of the data they use when using the Website.
V. DATA RETENTION PERIOD
Users' Personal Data are retained for the period necessary to achieve the purposes of processing and thereafter according to the following rules:
Data relating to settlements and agreements – retained for the period required by the Accounting Act. Such data may also remain available to Users within their Website Accounts for a longer period.
Data processed on the basis of consent – retained until the User withdraws consent.
Technical data, including server logs – retained for no longer than 24 months, unless longer retention is necessary for security, detecting abuse or fulfilling legal obligations.
Other data – retained for as long as necessary to achieve the purposes of processing or for the period required by law.
After the retention period ends, data are deleted or anonymised unless the law provides otherwise.
After the User deletes their Account, Personal Data will be retained for the period necessary for:
Fulfilling legal obligations (e.g. tax and accounting requirements) – at least 5 years from the end of the year in which the last transaction took place.
Establishing, pursuing or defending claims – until the limitation period for claims expires, in accordance with applicable law.
Archiving activities for security and compliance purposes – for a maximum of 3 years after Account deletion, unless another legal basis exists for retaining the data longer.
VI. DATA RECIPIENTS
The Controller may transfer Personal Data to the following recipients:
business partners supporting service delivery (e.g. payment operators, hosting services),
providers of analytics and marketing tools (e.g. Google Analytics, Facebook Pixel),
providers of electronic communication services, including SMS, email and newsletter systems (in particular Bird B.V.) – for service, transactional and marketing communications (newsletter), within the scope of consent given and applicable law,
public authorities pursuant to applicable law,
pet caregivers and owners to the extent necessary to provide care services,
IT and technical support providers – to ensure proper operation of the Website,
external legal and tax advisory firms – where legal proceedings or advice relating to service delivery are required,
financial institutions – in connection with payment and settlement processes.
Data may also be transferred to other recipients where this follows from law or the User's individual consent.
The Controller transfers Personal Data only to entities that ensure appropriate technical and organisational measures and, for processors, under data processing agreements. Recipients process data only to the extent and for the purposes necessary to provide services to the Controller.
The Controller does not make decisions producing legal effects concerning the User solely on the basis of automated data processing.
The Controller is not liable for acts or omissions of these entities insofar as they become independent data controllers and are responsible for processing under separate legal provisions or their own rules.
In respect of Personal Data processed in connection with Care Services, Users may act as separate Personal Data controllers. Alvis is not liable for Users' processing of Personal Data outside the operation of the Website and outside the purposes arising from this Privacy Policy.
VII. USERS' RIGHTS
Every User has the right to:
access their data, including obtaining a copy of the data being processed,
rectify data that are inaccurate or incomplete,
request erasure where processing is no longer necessary or is unlawful,
restrict processing in certain cases, e.g. while an objection is being considered,
object to processing based on the Controller's legitimate interest,
port data to another controller to the extent provided for by law,
withdraw consent to processing at any time where processing is based on consent,
lodge a complaint with the President of the Polish Personal Data Protection Office if the User believes processing infringes the law.
Users may exercise their rights by contacting the Controller using the contact details provided.
IX. SELECTED DATA PROTECTION METHODS
The Controller applies appropriate technical and organisational measures to protect Personal Data, such as:
Login and personal data entry areas are protected at the transmission layer (SSL certificate). This encrypts the personal data and login details entered on the page on the User's computer, so they can only be read on the destination server.
Users' passwords are stored in hashed form. The hash function is one-way – its operation cannot be reversed, which is the current standard for storing Users' passwords.
The Controller periodically changes its administrative passwords.
Physical protection of access to servers, such as access controls and monitoring.
Regular security audits and staff training.
X. SERVER LOGS
Information about Users' activity on the Website may be recorded in server logs. These data include:
IP address,
date and time of connection,
browser information,
pages visited within the Website.
These data are used exclusively for technical purposes relating to administration of the Website and ensuring its security.
XI. DATA TRANSFERS OUTSIDE THE EEA
Personal Data may be transferred outside the European Economic Area only on the basis of standard contractual clauses approved by the European Commission. The Controller takes all steps to ensure an adequate level of data protection in such situations.
When transferring data to third countries, the Controller uses standard contractual clauses (SCCs) and, where necessary, additional technical and organisational measures in accordance with European Data Protection Board guidelines.
XII. Data transfers in fulfilment of tax obligations (DAC7)
Under the EU DAC7 Directive and the Act of 9 March 2017 on the Exchange of Tax Information with Other Countries, the Controller, acting as a platform operator, is obliged to provide certain data about Users providing services through the Platform to the competent tax authorities.
This obligation applies only to Users meeting the reporting conditions specified in DAC7, particularly with respect to revenue earned and the number of transactions carried out through the Platform.
The data provided to tax authorities may include:
First name and surname Residential address Date of birth Tax identification number (NIP/PESEL)
Country of tax residence Information about remuneration earned by the User for care services provided through the Platform Number of transactions and total payouts made in the relevant tax year Details of the payment account used to receive funds.
Data are transferred pursuant to applicable law to fulfil reporting obligations under DAC7 and EU and Polish legislation. Only data required by law are transferred.
A User acting as a service provider on the Platform undertakes to supply complete, accurate and up-to-date data, and to supplement or verify them if the Controller requests this in connection with fulfilling DAC7 obligations.
XIV. CHANGES TO THE PRIVACY POLICY
The Controller reserves the right to amend this Privacy Policy. Users will be informed of all changes by a notice on the Website and an email, with appropriate advance notice of at least 14 days.
XV. CONTACT
For questions about this Privacy Policy or to exercise your rights, please contact the Controller at: