Privacy Policy

Effective from 2026-10-10

This is a translation. In case of any discrepancy, the Polish version prevails.

This policy explains how Volun3 processes personal data. It is the information required by Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, GDPR; in Polish: RODO). It also covers cookies.

1. Controller and contact

The service is provided by Szymon Haponiuk, a natural person running a sole proprietorship (jednoosobowa działalność gospodarcza) entered in the Polish Central Register and Information on Economic Activity (CEIDG), tax ID (NIP): 5214087024, REGON: 529722710, address: ul. Rydygiera 13/37, 01-793 Warszawa, Polska, email: shaponiuk@volun3.com (the “Provider”). The Provider has not appointed a data protection officer; write to the email address above about anything concerning personal data.

2. Two roles: controller and processor

The service is used by organisations (e.g. communities, associations, volunteer teams) that plan their members' schedules in it. The Provider therefore acts in two roles:

• The organisation is the controller of the data its admins enter about members and volunteers (people, roles, teams, events, assignments, availability, logins created for members). The Provider processes that data only on the organisation's behalf, as a processor, under the data-processing agreement annexed to the Terms of Use. Questions and requests about that data (e.g. to correct or erase it) should go to your organisation first; the Provider will help it handle them.
• The Provider is the controller of the data needed to provide and secure the service itself: the data of the person who creates an organisation, login data (to the extent needed to conclude and perform the service agreement), technical and security logs, message delivery data and correspondence sent to the Provider.

3. What data we process

• Login account: email address (used to sign in) and whether it has been confirmed, a hash of the password — never the password itself, chosen language and date format, stay-signed-in setting, admin permissions, date and version of the accepted Terms.
• A person in an organisation: first name, last name, email address, team memberships and skills (roles), active status.
• Schedule data: availability given for events with an optional note, role assignments, assignment confirmations.
• Technical data: the secret calendar address (token), one-time links (invites, password resets, email confirmations — stored as random tokens or their hashes), counters that limit sign-in and sign-up attempts (stored as irreversible hashes of the IP address or identifier, never the address itself), content and recipient of messages waiting to be sent.
• Visit statistics (only on the public pages — the home page, sign-up, guides, support and these documents — and only if you accept them in the cookie banner): the pages visited, the referring page, the type of device and browser, the approximate location derived from the IP address, and the identifier in the Google Analytics cookie. Pages inside an organisation are never tracked.
• Correspondence sent to the Provider (e.g. complaints, GDPR requests).

The service is not meant for special categories of data (Article 9 GDPR). Organisations should not enter such data, e.g. in notes or event descriptions.

4. Purposes and legal bases (where the Provider is the controller)

Purpose	Legal basis
Creating the account and organisation, providing the service, sending the messages needed to use it (address confirmation, password reset, invites, service announcements such as planned maintenance)	Art. 6(1)(b) GDPR — performance of the agreement for services provided electronically
Security of the service: protection against abuse and attacks (sign-in attempt limits, technical logs)	Art. 6(1)(f) GDPR — the Provider's legitimate interest
Asking users, in particular Organisation Admins, for their opinion of the service and suggestions for its development (non-commercial messages; you can ask us at any time to stop sending them)	Art. 6(1)(f) GDPR — the Provider's legitimate interest in improving the service
Statistics of visits to the public pages (Google Analytics), to learn how people find the service and improve it	Art. 6(1)(a) GDPR — your consent, which you can withdraw at any time under "Cookie settings" in the page footer; withdrawing it does not affect the lawfulness of earlier processing
Handling complaints and requests, contact with users	Art. 6(1)(b), (c) and (f) GDPR
Establishing, exercising and defending legal claims	Art. 6(1)(f) GDPR

Data entered by an organisation is processed for the purposes and on the legal bases determined by that organisation as controller.

5. Recipients

Data is never sold or shared for marketing. It may be received by:

• OVH SAS (Roubaix, France) — provider of the servers the service and its database run on; the servers are in OVHcloud's data centre in Beauharnois, Canada (see section 6);
• Amazon Web Services EMEA SARL (Luxembourg) — the Amazon SES service the app sends its emails through; it receives the recipient's address and the content of the message, processed in the EU (Stockholm, Sweden);
• Google Ireland Limited (Dublin, Ireland) — the Google Analytics service, as the Provider's processor, only for visitors who accepted analytics cookies on the public pages;
• calendar services (e.g. Google Calendar, Outlook, Apple Calendar) that fetch a person's calendar — only when that person adds their calendar address to them; those providers process the data under their own terms;
• admins of the organisation a person belongs to, for that organisation's data;
• signed-in members of an organisation, who see the name and email address of that organisation's admins on the Support page, so they know whom to ask for help;
• public authorities, where the law requires the data to be disclosed.

6. Transfers outside the European Economic Area

The servers the service and its database run on are in Canada (OVHcloud's data centre in Beauharnois, Quebec), so the data stored in the service is transferred outside the European Economic Area. The European Commission has found that Canada ensures an adequate level of protection for personal data processed by commercial organisations (Decision 2002/2/EC), so the transfer relies on that adequacy decision (Article 45 GDPR) and needs no further safeguards.

Google Analytics data may be transferred to Google LLC in the United States. Google LLC is certified under the EU–US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023, so the transfer relies on that decision (Article 45 GDPR). It happens only if you accept analytics cookies.

The Provider makes no other transfers outside the EEA. If a person adds their calendar to a service outside the EEA, that happens at their own request.

7. How long we keep data

• Login data — until the login is deleted (by you in your settings, or by the organisation) or the whole organisation is deleted.
• A person's data in an organisation — until you delete your account together with your data in your settings, the organisation deletes the person, or the whole organisation is deleted. The Provider keeps no backups, so deletion is final.
• Email messages — the content is erased from the database when the message is sent; the recipient, subject and delivery status are kept for 14 days and then deleted.
• Attempt-limit counters (hashes of IP addresses and identifiers) — up to 24 hours.
• Visit statistics in Google Analytics — 14 months; the Google Analytics cookies expire after 13 months, or when you withdraw consent.
• One-time links — valid for 1 hour (password reset) or 7 days (email confirmation); an invite — until it is used or the organisation deletes it.
• Server technical logs (IP address, time and address of the request), if kept — up to 30 days.
• Correspondence and data needed to defend claims — until the limitation periods expire.

8. Your rights

You have the right to access your data and receive a copy (Article 15 GDPR), to rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and to object to processing based on legitimate interest (Article 21). You can change your first name, last name, language, date format and password yourself in your account settings. There, under “Your data”, you can also download a copy of your data (a JSON file) and delete your account: either together with your personal data (your profile, availability and assignments are erased at once and your organisation's admins are told, so they can replace you in upcoming events), or only your login, leaving your organisation's record of you in place. Send any other request to shaponiuk@volun3.com — we will reply within one month. If the request concerns data your organisation controls, we will pass it on and help the organisation handle it.

9. Complaint to the supervisory authority

You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl) if you believe the processing of your data infringes the GDPR.

10. Is providing data mandatory?

Providing data is voluntary, but without an email address and a password you cannot create an account or use the service.

11. Automated decisions

The service makes no decisions with legal effects based solely on automated processing and does not profile users. Schedule hints (e.g. who is available) only assist the organisation's admin, who decides on assignments.

12. Security

Measures include: encrypted connections (HTTPS), passwords stored only as cryptographic hashes, a strong-password requirement, sign-in attempt limits, protection against CSRF and XSS attacks, separation of each organisation's data, a Provider admin panel reachable only locally through an encrypted tunnel, and data minimisation (e.g. erasing message content once sent).

13. Cookies and browser storage

The service uses cookies and browser storage that are strictly necessary for the service or that remember settings you choose yourself; such storage does not require consent (Article 399(3) of the Polish Electronic Communications Law). On the public pages we also use Google Analytics cookies, but only after you click "Accept" in the cookie banner (Article 399(1)); if you click "Reject" or do nothing, Google's script is not loaded at all. You can change your choice at any time under "Cookie settings" in the page footer. We use no advertising cookies, and pages inside an organisation set no analytics cookies. You can delete or block cookies in your browser settings, but signing in will then stop working.

Name	Type	Purpose	Lifetime
session	cookie	keeps you signed in, protects forms against CSRF attacks, remembers the language you chose	until the browser is closed
remember_token	cookie	keeps you signed in after the browser is closed	30 days by default
kch-theme	local storage	chosen theme (light/dark)	until deleted
kch_grid_density	local storage	schedule layout (compact/comfortable)	until deleted
kch_collapsed_cats	local storage	collapsed teams in the schedule	until deleted
kch_analytics_consent	local storage	your choice in the cookie banner	until deleted
_ga, _ga_<id>	cookie (Google Analytics, only after consent)	tells repeat visits to the public pages apart, for visit statistics	13 months

The app installed on your home screen (PWA) caches only style sheets, scripts and icons in the browser — none of your data.

14. Changes to this policy

We will announce material changes to this policy in the service in advance. The current version is always available at /privacy.