Polityka prywatności

Last updated: July 19, 2026.

This Privacy Policy describes the rules for the processing of the personal data of users of the psallio.com service, available at https://www.psallio.com (hereinafter the "Service"). This document fulfills the information obligation arising from Article 13 and Article 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the "GDPR").

1. Data Controller and contact details

The controller of personal data is Twoje-Miasto Sp. z o.o. with its registered office at ul. Szosa Toruńska 13-15, 86-300 Grudziądz, entered in the register of entrepreneurs of the National Court Register kept by the District Court in Toruń, 7th Commercial Division of the National Court Register, under KRS number: 0000354832, NIP: 876-24-29-504, REGON: 340743090 (hereinafter the "Controller" or the "Service Provider").

In all matters relating to the processing of personal data and the exercise of the rights available under the GDPR, you may contact the Controller by e-mail at: kontakt@psallio.com.

The Controller has not appointed a Data Protection Officer (IOD). Contact concerning personal data protection matters takes place directly with the Controller at the e-mail address indicated above.

2. What data we collect and how

In connection with the provision of the service in the SaaS (software as a service) model, the Controller processes the following categories of data:

• Account data - the name of the team (schola, community), e-mail address and password. The password is stored solely in a hashed (irreversible) form and is not known to the Controller.
• Billing data - data necessary to process payment for the selected plan. Payments are handled by an external operator (Paddle), which acts as the merchant of record (Merchant of Record). The Controller does not store full payment card details; it receives only information about the transaction status and the data necessary to confirm the purchased access.
• Content created by the user - songs, lyrics, chords, setlists and other materials entered or uploaded by the user in the course of using the Service.
• Technical data - IP address, server logs (date and time of access, requests), device and browser data, and information stored in cookies. This data is collected automatically while using the Service.

As a rule, personal data is obtained directly from the user. Some data (in particular information on payment status and transaction confirmation) is received by the Controller from the Payment Operator Paddle to the extent necessary to confirm the purchased access.

3. Purposes and legal bases for processing

The Controller processes personal data for the following purposes and on the basis of the following legal bases arising from Article 6 GDPR:

Consent to the processing of data for marketing purposes and to optional cookies is voluntary and may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal.

4. Data recipients

Personal data may be disclosed to the following categories of recipients:

• Payment Operator - Paddle.com Market Limited (Judd House, 18-29 Mora Street, London EC1V 8BT, United Kingdom, company number 08172165), acting as the Merchant of Record (merchant of record / reseller). Paddle is a party to the payment transaction concluded with the user: it accepts the payment, issues sales documents (invoices, receipts), settles VAT, and handles refunds and complaints relating to the payment itself. With regard to the data processed in connection with the execution and settlement of the payment, Paddle acts as a separate, independent data controller, and not as a processor acting on behalf of the Controller. The rules for the processing of data by Paddle are set out in Paddle's privacy policy available at https://www.paddle.com/legal/privacy, and the transaction terms for buyers at https://www.paddle.com/legal/checkout-buyer-terms.
• Provider of technical infrastructure and hosting - the Service operates on the SYSPiR technical infrastructure maintained by Twoje-Miasto Sp. z o.o.; data is processed on servers located in Poland / the European Union.
• Dostawca sieci dostarczania treści (CDN) - Bunny (BunnyWay d.o.o. z siedzibą w Słowenii, na terenie Europejskiego Obszaru Gospodarczego). Ruch do Serwisu obsługiwany jest za pośrednictwem sieci CDN, co wiąże się z przetwarzaniem adresu IP użytkownika oraz danych technicznych żądania w celu dostarczenia treści Serwisu oraz zapewnienia jego bezpieczeństwa i wydajności.
• Entities providing support - providers of technical, IT and maintenance services supporting the operation of the Service, to the extent necessary to provide those services.

With entities that process personal data on behalf of the Controller (processors), data processing agreements compliant with Article 28 GDPR have been concluded.

5. Transfer of data outside the European Economic Area

As a rule, personal data is processed within the European Economic Area (EOG). In some cases, data may be transferred outside the EOG:

• Paddle (United Kingdom) - the transfer of data to the United Kingdom takes place on the basis of a European Commission decision confirming an adequate level of personal data protection in that country (adequacy decision). In the event of a further transfer to third countries, Paddle applies appropriate safeguards, in particular standard contractual clauses approved by the European Commission.

Serwis nie korzysta z zewnętrznych czcionek internetowych (np. Google Fonts) - czcionki są hostowane lokalnie na serwerze Serwisu, dlatego ich wyświetlanie nie powoduje przekazywania adresu IP użytkownika do podmiotów w państwach trzecich, w tym do firmy Google w Stanach Zjednoczonych.

The user has the right to obtain a copy of the safeguards applied by contacting the Controller at kontakt@psallio.com.

6. Data retention period

Personal data is stored for the period necessary to achieve the purposes for which it was collected:

• account data and user content - for the duration of the Account and the term of the Agreement, and after its termination for the period necessary to establish, pursue or defend against claims (claim limitation periods);
• billing data and accounting documents - for the period required by tax and accounting law, as a rule for 5 years counted from the end of the calendar year in which the tax payment deadline fell;
• technical data and logs - for the period arising from the legitimate interest of the Controller, in particular to ensure the security of the Service;
• data processed on the basis of consent - until it is withdrawn.

7. Rights of data subjects

Every person whose data is processed has the following rights:

• the right of access to the data and to obtain a copy of it;
• the right to rectification (correction) of the data;
• the right to erasure of the data (the "right to be forgotten");
• the right to restriction of processing;
• the right to data portability;
• the right to object to processing based on the legitimate interest of the Controller;
• the right to withdraw consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

To exercise the above rights, please contact the Controller by e-mail at: kontakt@psallio.com.

8. The right to lodge a complaint with a supervisory authority

The data subject has the right to lodge a complaint with a supervisory authority, which in Poland is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO), ul. Stawki 2, 00-193 Warszawa, if they consider that the processing of their personal data infringes the provisions of the GDPR.

9. Voluntary nature of providing data

Providing personal data is voluntary but necessary to set up an Account and use the Service. Providing account data and billing data is a condition for the conclusion and performance of the Agreement - failure to provide it makes it impossible to set up an Account and use the paid features of the Service. Providing data for marketing purposes is entirely voluntary and does not affect the ability to use the service.

10. Automated decision-making and profiling

The Controller does not make decisions concerning users based solely on automated processing of data, including profiling, that would produce legal effects concerning them or similarly significantly affect them.

11. Cookies

Serwis wykorzystuje wyłącznie niezbędny, techniczny plik cookie sesji użytkownika oraz - w trakcie realizacji płatności na żądanie użytkownika - pliki cookies operatora płatności. Serwis nie stosuje cookies analitycznych, marketingowych ani innych cookies wymagających zgody i nie wyświetla banera zgody na cookies. Szczegółowe informacje o stosowanych plikach cookies, ich rodzajach, celach oraz sposobie zarządzania nimi opisuje odrębna Polityka cookies.

12. Changes to the Privacy Policy

Administrator zastrzega sobie prawo do wprowadzania zmian w niniejszej Polityce prywatności, w szczególności w przypadku zmiany przepisów prawa, zakresu świadczonych usług lub stosowanych rozwiązań technicznych. Aktualna wersja dokumentu jest zawsze dostępna w Serwisie pod adresem /polityka-prywatnosci. Data ostatniej aktualizacji wskazana jest na początku dokumentu. W sprawach nieuregulowanych zastosowanie ma prawo polskie oraz RODO.