Privacy policy
This Privacy Policy was updated on August 3, 2026.
The data controller is WTG Solutions sp. z o.o., with its registered office in Kraków, postal code 30-428, ul. Zdunów 22F/5, registered in the register of entrepreneurs maintained by the District Court for Kraków-Śródmieście, XI Commercial Division of the National Court Register under number 0001113840, NIP 6793303306.
Our Commitments
We are committed to maintaining the confidentiality and security of your personal data (Personal Data). As part of this commitment, our Privacy Policy governs our actions regarding the collection, use, and disclosure of personal data. This Privacy Policy contains information about the processing of personal data that we are required to present based on legal provisions.
Identification Purposes
We collect, share, and use personal data to enable access to the GuideTrackee® service and application, as well as to process and handle payments and process financial documents. We store personal data solely for the purpose of providing the GuideTrackee® service using the GuideTrackee® mobile application.
Consent
Your consent is required for the collection and use of Personal Data, unless required or permitted by law. Providing us with personal data is always your choice. However, the decision not to provide certain information will prevent us from providing the GuideTrackee® service through the GuideTrackee® mobile application.
Data We Collect
The personal data we collect in connection with providing the service is exclusively: device identifier, username, and device location provided by the application user for the purpose of operating the GuideTrackee® service. Separately, and only with your consent, we collect usage statistics about the website — their scope is described in the Web Analytics section.
Legal Basis for Data Processing
We process your personal data only when there is a legal basis for doing so, in particular:
- based on your consent (Article 6(1)(a) of the GDPR),
- when processing is necessary for the performance of a contract (Article 6(1)(b) of the GDPR),
- in order to comply with a legal obligation (Article 6(1)(c) of the GDPR),
- within the legitimate interest of the controller (Article 6(1)(f) of the GDPR), provided that this does not infringe your rights and freedoms.
Providing personal data is voluntary; however, failure to do so may make it impossible to provide the GuideTrackee® service.
Scope of Collected Data
We collect only the data necessary to provide the service, in particular the device identifier, username, and device location (if shared in the application by the user). We do not collect any personal data beyond this scope — except for the analytics data described in the Web Analytics section, which is collected only with your consent and can be withdrawn at any time.
Your Rights
Subject to applicable restrictions under the General Data Protection Regulation, you have the right to access personal data, the right to rectify incorrect and inadequate personal data, the right to erase personal data, the right to restrict the processing of personal data, the right to object, and the right to data portability.
Limitations on Personal Data Collection
We collect only the personal data that is necessary for the purposes we have defined. With your consent, we may collect personal data contained in the GuideTrackee® application and token registration process.
Principles of Use, Sharing, and Storage
Personal data may be used or disclosed only for the purpose for which it was collected, unless you have given consent or when required or permitted by law. Personal data will be used only during the use of the GuideTrackee® service, that is, when the tour associated with the registration token is in progress or suspended, and the application user has joined the tour.
Accuracy
Personal data will be stored in as accurate, complete, and current form as necessary to achieve the purposes for which it is to be used.
Openness
We will provide information about our policies and practices regarding personal data management.
Customer Access
Upon your request, we will inform you about the use and disclosure of your personal data and provide access to it. We will also enable possible verification of the accuracy of personal data and, if necessary, make appropriate changes. However, in certain circumstances permitted by law, we will not be able to provide certain information. For example, we will not be able to provide information if the matter concerns other persons or if it involves applicable legal and commercial restrictions or security provisions.
Cookies
Cookies are small text files stored by your browser on your device when you visit a website. We use strictly necessary cookies only — they maintain the logged-in user session and protect against CSRF attacks, that is, they do what the service could not function without. We do not use analytical, marketing or tracking cookies, and we do not use them for personalization. Visit statistics are collected with a tool that relies on no cookies at all — it is described in the Web Analytics section.
Most browsers are configured to accept cookies automatically; you can delete or block them in your browser settings. Blocking strictly necessary cookies, however, makes it impossible to sign in and use the GuideTrackee® service. The full list of the cookies we use, together with their retention periods, is available in our Cookie Policy.
Web Analytics
We count visits to the service using Vercel Web Analytics, a tool provided by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA), acting as a data processor within the meaning of Art. 28 GDPR.
Legal basis: your consent — Art. 6(1)(a) GDPR. Consent is collected through the banner shown on the website and in the operator panel. Until it is given, no analytics data is sent; you may withdraw it at any time (see Withdrawing your analytics consent below), and withdrawal does not affect the lawfulness of processing carried out before it.
The tool neither stores nor reads any information on your device — it uses no cookies (including third-party cookies) and no persistent identifier. A visitor is recognised by a hash created from the incoming request. The hash is valid for a single day and is then reset automatically, which means visitors cannot be tracked between different days, nor across different websites. We do not carry out profiling or automated decision-making based on this data.
Data recorded for a single event:
| Data | Notes |
|---|---|
| Event timestamp | |
| Page URL | identifiers (tour, user, token ids) are stripped before sending |
| Route pattern (Dynamic Path) | e.g. /blog/[slug] — the pattern only, without values |
| Referrer | |
| Query parameters (filtered) | sensitive parameters (token, code, email, access_code, invite) are removed before sending |
| Approximate location | country, region and city (e.g. PL, Mazowieckie, Warsaw) — derived from the IP address, which is not stored |
| Operating system and version | |
| Browser and version | |
| Device type | |
| Analytics script version |
The data is available in reports for 12 months (the reporting window of our plan); the provider reserves the right to store it for longer. Vercel Inc. processes it solely on our instructions; the transfer to the USA takes place on the basis of the Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR), incorporated into the data processing agreement concluded with Vercel Inc.
Withdrawing your analytics consent
You may withdraw your analytics consent at any time — as easily as you gave it (Art. 7(3) GDPR):
- on the website — the Change analytics consent link in the footer of every page,
- in the operator panel — the Analytics consent section in Settings.
In both places a single click removes the stored decision. From that moment on we send no analytics data, and the banner appears again so that you can choose anew. Withdrawal does not affect the lawfulness of the processing we carried out before it.
We store your decision in your browser's local storage, so it applies to that browser on that device — in another browser we will ask separately, and it has to be withdrawn there separately too. For the same reason, clearing this site's data in your browser settings also withdraws the consent.
What happens if you do not consent
We treat a refusal and the absence of a decision alike: we send no analytics data at all — no page views, no page addresses, no device or location information. The analytics script is still downloaded from our server in that case, because it is part of the page, but it passes nothing on and stores nothing on your device. The service works exactly the same — refusing does not restrict access to any feature.
The record of your decision
The decision itself — consent or refusal — is stored together with the date it was made in your
browser's local storage, under the key gt_app_cookies_consent. This record is necessary in
order to respect your choice and to demonstrate that consent was given (Art. 7(1) GDPR). It
contains no data that could identify you and is never transmitted to us — it stays in your
browser.
The record is valid for 365 days, after which we will ask again. We will also ask sooner if the scope of the analytics you consent to changes.
Handling Customer Complaints and Suggestions
Any questions and suggestions regarding our Privacy Policy or matters related to our operations can be directed to: office@guidetrackee.com