Cookies and device storage

1. What cookies and local storage are

Cookies are small pieces of information stored by a browser on the user's device. The service may also use the browser's local storage. These mechanisms maintain sessions, protect forms and remember a selected setting.

2. Mechanisms currently used

• session cookie — maintains the session and sign-in; essential for the account;
• form-protection token — protects against unauthorised requests made on the user's behalf;
• km-theme in local storage — remembers the selected website colour theme;
• km-analytics-consent in local storage — remembers consent or refusal so the question is not repeated on every page;
• km-ga-purchases in local storage — after consent, remembers a limited list of anonymous purchase identifiers already sent, so refreshing the page does not duplicate the event.

Session and form-protection mechanisms are necessary to provide the requested service and ensure security. Remembering the theme serves a feature expressly selected by the user. These mechanisms do not require separate consent because they fall within the exception for data necessary to deliver the requested service. We do not use them for advertising or cross-site tracking.

3. Google Analytics

After voluntary consent, the public website starts Google Analytics 4 with measurement ID G-0X2TXZVZ3R. It helps measure visits, referral sources, devices, navigation on public pages and sales stages: viewing prices, selecting a plan, starting checkout and a confirmed purchase. For purchases, we send the plan and cycle name, net amount, VAT, PLN and an anonymous transaction identifier. We do not send names, email addresses, NIP numbers, pro forma numbers, form contents, trips or GPS points to Analytics.

Google Analytics may set _ga and _ga_* cookies, normally for up to 2 years, to distinguish users and maintain session state. Google signals and ad personalisation are disabled in the website code. Consent can be changed at any time using “Privacy settings” in the footer; after withdrawal, the tag will not load on subsequent page views. Existing cookies can be deleted in browser settings.

4. Other external services

The Features page embeds a YouTube video in privacy-enhanced mode from youtube-nocookie.com. The player loads with that page and attempts to start the video automatically with sound muted. This creates a direct connection between the browser and Google/YouTube and may involve the IP address, device and browser information, the visited page address and interactions with the player. Privacy-enhanced mode limits the use of playback for personalisation, but it does not eliminate the transmission of technical data. If external YouTube resources are blocked in the browser, the embedded video will not be displayed; a standard link to YouTube remains available.

Google reCAPTCHA loads only on the registration page to distinguish humans from bots. It may use Google cookies or device storage and analyse technical information and interactions. This mechanism is necessary to protect the public form; we do not use it for advertising. Details are set out in Google's privacy policy and terms.

Advertising and Google sign-in are not enabled. Viewing the payment page alone does not connect the browser to Paynow; a connection to the operator's service is made only after selecting the online payment button. On the Paynow website, the operator may use its own essential mechanisms under its privacy notice.

5. Maps

A map loads only on the specific trip page available to an administrator. Its content comes from Geoapify, an external mapping service using OpenStreetMap data. Technical requests are not the same as the commercial “map opening” described in the price list. Billing for logical openings is not yet active.

6. Managing device data

Cookies and local storage can be deleted in browser settings. Blocking essential cookies may prevent sign-in, registration, checkout or secure form submission. Deleting km-theme restores the default colour theme.

7. Changes

If further mechanisms not required for the service are introduced, users will receive appropriate information and an opportunity to decide before they are stored or accessed, where required by law.

Legal basis: Article 399 of the Polish Electronic Communications Law of 12 July 2024. Information about personal data processing is provided in “Privacy and GDPR”.