DajTipa Privacy and Cookies Policy

This Privacy and Cookies Policy (the "Policy") sets out the rules for processing personal data of persons using the DajTipa website available at www.dajtipa.pl and related applications and services.

The controller of personal data is: JUZOMI spółka z ograniczoną odpowiedzialnością, ul. Gen. Władysława Sikorskiego 3/2, 53-659 Wrocław, Poland, KRS: 0000889291, NIP: 8971889776.

Contact for data protection matters: privacy@dajtipa.pl

The Controller exercises due care to protect the privacy of persons using the Service and to ensure that processing complies with Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR").

For the purposes of this Policy, consistently with the Service Terms of Service:

"Service" means the DajTipa platform together with related applications and services.

"Operator" or "Controller" means JUZOMI Sp. z o.o.

"Customer" means a person making a voluntary payment (tip) to a User.

"User" means a person with an Account in the Service enabling them to receive tips (tip recipient).

"Business Partner" means an entrepreneur cooperating with the Operator in a commercial capacity.

"Stripe" means Stripe Technology Europe Limited and entities belonging to the Stripe group.

"Venue" means a shared profile in the Service corresponding to one Tip Jar and representing an actual workplace or team, within which tips are divided among members in accordance with the selected distribution algorithm, as set out in the Terms of Service.

"Tip Jar" means a Service function enabling tips to be accepted for a Venue and divided among eligible members.

"Venue Member" means a User associated with a Venue on the basis of an accepted invitation.

"Venue Manager" means a User creating or managing a Venue, including a Venue Administrator who manages its settings and members.

"Shift" means a period during which a Venue Member participates in the distribution of tips transferred to the Venue.

3.1 Customers sending tips

We may process:

name and surname,

email address,

telephone number,

tip amount,

transaction information,

payment identifier,

transaction date and time,

IP address,

device and browser data,

data related to payment security.

3.2 Users (tip recipients)

We may process:

name and surname,

email address,

telephone number,

data required by Stripe Connect,

information required for identity verification,

history of received tips,

data required under AML/KYC regulations.

The bank account number and full settlement data necessary for funds payout are provided to and processed by Stripe within the User's Stripe Account. The Operator does not accept funds, does not maintain payment accounts and does not have access to funds held in Stripe Accounts, in accordance with the Terms of Service.

3.3 Business Partners

We may process:

contact person's name and surname,

position,

email address,

telephone number,

data concerning commercial cooperation.

3.4 Data related to the Tip Jar function

In connection with the use of the Tip Jar function (Venue mode), we may process:

information about membership in a Venue and the assigned role (Venue Administrator, Shift Manager, member),

the assigned functional group or weight within the distribution algorithm,

Shift records (start and end time, Venue, status),

tip distribution data (gross amount, fee, net amount, percentage share and identification of the Referrer),

Venue invitation data (email address of the invited person, status and invitation expiry date).

Some of the above data concerns other Users and is made available within the Venue to the extent necessary for the Tip Jar function to operate. The rules concerning controller roles in relation to such data are set out in §12.

We process personal data for the following purposes:

a) performance of the agreement - Article 6(1)(b) GDPR, in particular:

payment processing,

handling tips,

maintaining Accounts,

handling settlements performed through Stripe,

enabling the operation of Venues and the distribution of tips within the Tip Jar function.

b) compliance with legal obligations incumbent on the Controller - Article 6(1)(c) GDPR, in particular:

tax obligations,

accounting obligations,

obligations arising from requests by authorized authorities.

c) pursuing the Controller's legitimate interest - Article 6(1)(f) GDPR, in particular:

ensuring Service security,

detecting abuse and conducting the Controller's own verification and anti-fraud procedures,

protection against fraud and chargebacks,

pursuing and defending claims,

handling invitations to Venues sent to addresses indicated by the Venue Manager,

maintaining statistics and developing the Service.

d) on the basis of consent - Article 6(1)(a) GDPR, in particular:

marketing,

analytics requiring consent,

use of certain cookies.

Statutory anti-money laundering (AML) obligations as an obliged institution are performed by Stripe. The Operator's own verification and anti-fraud activities are based on legitimate interest and necessity for performance of the agreement, not on a legal obligation incumbent on the Operator.

We obtain most data directly from the data subject. We may receive some data from other sources, in particular:

from Stripe and payment operators - transaction and verification data and signals regarding potential fraud,

from Business Partners - contact person data in the scope of commercial cooperation,

from Venue Managers - email addresses of persons invited to the Venue and data concerning the organization of the Venue.

For data not obtained directly from the person, we provide information about the categories of such data and their source in accordance with Article 14 GDPR.

Providing data necessary to process payments, maintain an Account and perform verification required by Stripe is voluntary but necessary to use the relevant Service functions. Failure to provide such data makes it impossible to create or maintain an Account or process a payment. Providing data required by tax and accounting regulations is a statutory requirement.

7.1 Stripe

The Service uses Stripe services. Data may be transferred to Stripe to the extent necessary to process payments, handle refunds, prevent fraud, perform AML/KYC obligations, verify Users and pay out funds.

For these operations, Stripe acts as an independent data controller. The rules for processing data by Stripe are set out in Stripe's privacy policy, available on Stripe's website.

7.2 Apple Pay

If a person uses Apple Pay, payment data may be processed by Apple in accordance with the rules applicable to Apple Pay. The Controller does not receive full payment card data. Use of Apple Pay is also subject to Apple's privacy rules.

7.3 Google Pay

If a person uses Google Pay, payment-related data may be processed by Google in accordance with the rules applicable to Google Pay. The Controller does not receive full payment card data. Use of Google Pay is also subject to Google's privacy rules.

To protect persons using the Service and payment security, the Controller may analyze IP addresses, device data, transaction history, information provided by payment operators and information about potential fraud or abuse. Such data may be used to prevent fraud, chargebacks and other abuses related to use of the Service.

For the purposes referred to in §8, the Controller and Stripe may use profiling consisting of automated assessment of transaction risk based on data such as IP address, device data and transaction history and characteristics.

Profiling may serve to identify increased transaction risk and result in a case being referred for additional verification or security measures being applied.

The data subject has the right to obtain human intervention, express their own position and contest a decision, to the extent arising from Article 22 GDPR. Requests in this respect may be sent to the address indicated in §23.

Data may be transferred to:

payment operators, in particular Stripe and Stripe group entities,

hosting providers,

IT infrastructure providers,

postal service providers,

analytics service providers,

law firms,

accounting offices,

auditors,

public authorities where required by law,

other Users within the Venue to which the data subject belongs - that is Venue Administrators and Shift Managers, to the extent necessary for the Tip Jar function to operate (membership, role, tip readiness, Shift status and tip distribution summaries).

The Controller may use services of entities processing personal data on the basis of data processing agreements. Processing may include, among other things, hosting, cloud services, analytics, technical support and electronic communication. The Controller may use further processors (sub-processors), ensuring the level of protection required by applicable law.

Use of the Tip Jar function involves processing Venue Members' data in the scope indicated in §3.4 in order to enable joint acceptance and distribution of tips.

To the extent that processing is necessary for the operation of the Service and the Tip Jar function, including creating and managing a Venue, handling invitations, running Shifts, determining and communicating share allocations to Stripe, and presenting tip distribution summaries, the controller of the data is JUZOMI Sp. z o.o.

To the extent that the Venue Manager uses members' data for its own purposes, in particular related to work organization, team management or settlements in the given place, the Venue Manager is a separate, independent controller of that data and independently performs obligations towards members under the GDPR. The Controller is not responsible for processing carried out by the Venue Manager for its own purposes.

A member's data concerning membership, role, tip readiness, Shift status and tip distribution summaries is available within the Venue to Venue Administrators and Shift Managers to the extent necessary for the function to operate. Joining a Venue is voluntary, and a Venue Member may cease participation at any time in accordance with the Terms of Service.

Personal data may be transferred outside the European Economic Area, in particular in connection with the use of Stripe, Google, Apple, analytics providers and cloud infrastructure providers.

Transfers take place only with appropriate safeguards required by the GDPR, in particular:

a European Commission adequacy decision, including - with respect to entities in the USA certified under the EU-US Data Privacy Framework - on the basis of an adequacy decision,

Standard Contractual Clauses (SCC),

other mechanisms provided for by the GDPR.

A copy of the safeguards used may be obtained by contacting the Controller at the address indicated in §23.

The Service may use analytics and diagnostic tools, in particular PostHog, Google Analytics and other analytics or monitoring tools. These tools are used to analyze how the Service is used, improve service quality, detect errors and increase security. Analytics tools using cookies other than necessary cookies are launched only after consent is given, in accordance with §19.

Some analytics tools may operate without using cookies or other technologies requiring user consent. In such a case, data is processed on the basis of the Controller's legitimate interest consisting in analyzing Service use, improving service quality and ensuring security.

We store data for the period necessary to achieve the processing purposes:

Account data - until the Account is deleted and the limitation period for claims expires,

accounting and tax documentation - for 5 years counted from the end of the calendar year in which the tax payment deadline expired or the accounting obligation arose,

transaction data - for the period required by law, no shorter than the accounting documentation retention period,

Venue invitation data - until the invitation expires and for the period necessary to handle possible claims or complaints,

Shift and tip distribution data within the Tip Jar function - for the period appropriate for transaction data and accounting and tax documentation,

security logs - up to 24 months,

analytics data - for no longer than 26 months, and where processing is based on consent - until consent is withdrawn,

data processed on the basis of consent - until consent is withdrawn.

The Controller applies appropriate technical and organizational measures ensuring protection of personal data appropriate to the risk, in accordance with Article 32 GDPR, including measures ensuring confidentiality, integrity and availability of data.

The Service is intended only for adults. The Controller does not intentionally process data of minors. If the Controller becomes aware that an Account has been created by a minor, the Controller may suspend or delete the Account.

The data subject has the right to:

access data,

rectify data,

erase data,

restrict processing,

data portability,

object,

withdraw consent,

lodge a complaint with the President of the Personal Data Protection Office.

Requests may be submitted to the address indicated in §23. The Controller handles requests without undue delay, generally within one month, and free of charge, subject to exceptions provided for in the GDPR. To handle a request, the Controller may require confirmation of the applicant's identity. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

The Controller maintains a register of consents granted and acceptances of the Terms of Service and Privacy Policy, including the date, time, IP address and version of the documents in force at the time of acceptance.

The Service uses cookies and similar technologies. Their use is governed by the GDPR and electronic communications regulations (Electronic Communications Law). Cookies other than necessary cookies are used only after the person using the Service gives prior consent.

The Controller may also use analytics solutions that do not use cookies or similar technologies requiring user consent. In such a case, data is processed on the basis of the Controller's legitimate interest consisting in analyzing Service operation and improving the quality of services provided.

18.1 Necessary cookies

These are used for Service operation, login, security and payment processing. Their use does not require consent.

18.2 Analytics cookies

These are used to measure traffic, analyze behavior and develop the Service. Their use requires consent.

18.3 Functional cookies

These are used to remember preferences and improve convenience of using the Service. To the extent that they are not strictly necessary, their use requires consent.

The table below indicates cookies used in the Service.

Local Storage and Session Storage

The Service also uses Local Storage and Session Storage technologies of the web browser. They are not cookies, but they enable data to be stored on the user's device.

On pages used to process tip payments, the Service does not use analytics or marketing cookies requiring user consent. Aggregated and anonymous statistics provided by Cloudflare Web Analytics, which do not use cookies and do not identify users, may be used to monitor traffic.

The list of cookies and similar technologies used may change as the Service develops, new functionalities are implemented or changes are made by external service providers such as Stripe, Google or Cloudflare.

A person using the Service may manage cookie settings using browser settings and the consent management tool available in the Service. Consent may be withdrawn at any time, as easily as it was given, in particular through the consent management tool. Limiting the use of cookies may affect the operation of some Service functions.

The Controller may update this Policy. The current version is always published in the Service. In the event of material changes, persons using the Service may be informed through the Service or by email.

For matters concerning personal data protection, please contact:

privacy@dajtipa.pl

JUZOMI Sp. z o.o., ul. Gen. Władysława Sikorskiego 3/2, 53-659 Wrocław, Poland.

The request should include data enabling identification of the person to whom the request relates.