PRIVACY &
COOKIES.

1. Who we are

Polka is run by SOLEK DIGITAL LTD, a company registered in England and Wales (company number 16185233), whose registered office is 34 Jesson Street, West Bromwich, B70 6PR. We are the controller of the personal data described in this policy, which means we decide how and why it is used.

If you have any questions about your data, or want to use any of your rights, email hello@getpolka.app. We read every message and reply in Polish or English.

This policy covers getpolka.app, the Polka app, and using Polka at the till in a Polka shop. It explains what we collect, why, who sees it, how long we keep it and what your rights are.

2. What we collect

When you create an account: your first and last name, email address, password, and — only if you choose to give it — your postcode. We also record your language, whether you want marketing emails, and when you joined. Your password is stored in a scrambled (hashed) form that nobody at Polka can read.

When you shop with Polka: each time you use Polka at a shop, we record the shop, the date and time, the amount you paid, and the pierogi you earned or used. From this we work out your balance at each shop. We also record which offers you view or use.

When you register a shop: the shop’s name, address and postcode, your name, email address and phone number, how many locations you have and which till system you use. If your shop then joins, we also keep the shop agreement and the details needed to collect your subscription by Direct Debit, which our payment provider handles.

When you contact us: your name, email address, the subject you choose and your message, plus anything else you decide to tell us.

When you use the website or app: technical information such as your IP address, browser or device type, app version and the pages or screens you use, which our systems log to keep Polka secure and working. See cookies for what we store in your browser.

We do not ask for your bank or card details, and we do not collect sensitive information such as health data or your ethnic origin. Please do not include it in messages to us.

3. How we use it and why

UK data protection law says we need a lawful basis for each use of your data. Here is what we do and the basis we rely on:

• Running your account and the pierogi scheme — creating your account, recording pierogi, showing your balances, offers and activity, and letting you use your code at the till. Basis: performing our contract with you (our terms of use).
• Showing a shop your activity at that shop, so it can serve you and honour your pierogi (see section 4). Basis: performing our contract with you.
• Service emails — confirming your account, password resets, reminders before pierogi expire, and important changes to Polka. Basis: performing our contract with you.
• Telling you when a Polka shop opens near you and about offers worth knowing about, by email or in the app. Basis: your consent, which you can withdraw at any time using the link in every email or in the app.
• Using your postcode to show you which Polka shops are nearest. Basis: our legitimate interest in making Polka useful to you. The postcode is optional.
• Following up a shop registration, calling you back and setting your shop up. Basis: taking steps at your request before entering into a contract, and then performing the shop agreement.
• Answering your messages. Basis: our legitimate interest in helping you.
• Keeping Polka secure, preventing fraud and misuse of pierogi, and fixing problems. Basis: our legitimate interest in running a safe and reliable service.
• Understanding how Polka is used, using combined figures (for example, how many members visit each week) to improve the service and to give shops statistics about their own customers. Basis: our legitimate interest in improving Polka.
• Meeting our legal duties, such as keeping accounting records and responding to lawful requests from authorities. Basis: legal obligation.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do not sell your personal data, and we do not use it for third-party advertising.

4. Who can see it

The shops you use. When you use Polka at a shop, that shop (or the chain it belongs to) can see your name, your member number, your pierogi balance at that shop, and the date, amount and pierogi of each purchase you make there with Polka. It can also see whether you are a regular or have not visited for a while, so it can send you an offer through Polka. A shop never sees what you do at other shops, and it does not get your email address, phone number or postcode — offers reach you through Polka. Each shop is responsible for how it uses what it sees, in line with data protection law and its agreement with us.

Our service providers, who help us run Polka and only use your data on our instructions: website and app hosting, email delivery, app stores and push notifications, our payment provider (for shops’ Direct Debits), and customer support tools. We have contracts with them that protect your data.

Others, only when needed: our professional advisers (such as accountants and lawyers); the police, HMRC or other authorities when the law requires it or to prevent fraud; and, if our business is ever sold or restructured, the new owner, who would have to keep treating your data in line with this policy.

5. Where it is stored

Your data is stored in the UK or the European Economic Area wherever possible. If a provider processes it anywhere else, we make sure it is protected to the standard UK law requires — for example, by sending it only to countries the UK recognises as having adequate protection, or by using the UK’s approved contract terms (the International Data Transfer Agreement or Addendum).

6. How long we keep it

• Your account: for as long as it is open. If you close it, we delete or anonymise your account details within 90 days.
• Purchase and pierogi records: six years after the purchase, because shops and we need them for accounting, refunds and disputes. After you close your account, these records are no longer linked to your name.
• Accounts that are never used: if an account has had no activity for three years, we will email you and then close it.
• Shop registrations that do not go ahead: 12 months. Records for shops that join are kept for the length of the shop agreement and six years afterwards.
• Messages to us: two years after the conversation ends.
• Security logs: up to 90 days, unless we need them longer to investigate a problem.
• Your marketing choices: for as long as your account exists, plus a record that you opted out, so we do not contact you again by mistake.

7. Keeping it safe

All connections to Polka are encrypted, passwords are stored hashed, and access to personal data is limited to the people who need it to run Polka. If something ever goes wrong with your data in a way that puts you at risk, we will tell you and, where required, the Information Commissioner’s Office.

8. Cookies

Cookies are small files a website stores in your browser. We use only the ones Polka needs to work, and we do not use advertising or tracking cookies:

• Sign-in cookie — keeps you logged in as you move around the site. It lasts until you close your browser or, if you tick “Keep me signed in”, until you log out or the sign-in expires.
• Security cookie — protects our forms against a type of attack called cross-site request forgery. It lasts until you close your browser.
• Form message cookie — shows the confirmation message after you send a form, and is removed straight away.
• Your cookie choice — when you accept or decline cookies, we remember your answer in your browser’s local storage so we do not ask again.
• Shop dashboard cookies — if you run a shop, a few more cookies keep you signed in to the shop dashboard securely.

These are strictly necessary, so the law does not require your consent for them. If we ever add optional cookies, such as analytics to see which pages are used, we will only set them if you click Accept on the cookie notice, and we will list them here first. Choosing Decline never stops you using Polka.

You can delete or block cookies in your browser settings, but if you block the necessary ones you will not be able to log in.

9. Your rights

You have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct anything that is wrong or incomplete;
• ask us to delete your data;
• ask us to restrict how we use your data;
• object to us using your data on the basis of legitimate interests — and to stop marketing at any time, whatever the reason;
• ask for the data you gave us in a format you can take to another service;
• withdraw your consent at any time, where we rely on it.

To use any of these rights, email hello@getpolka.app. It is free, and we will reply within one month. We may ask you to confirm your identity first. Some rights have limits — for example, we may need to keep purchase records for accounting — and if so we will explain why.

If you are unhappy with how we have handled your data, please tell us so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

10. Children

Polka is for people aged 18 and over. We do not knowingly collect data from anyone younger. If we find that we have, we will delete it.

11. Changes and contact

We will update this policy when we change how we use personal data or when the law changes, and we will post the new version here with a new date. If a change matters to you, we will tell you by email or in the app before it takes effect.

Questions go to hello@getpolka.app or SOLEK DIGITAL LTD, 34 Jesson Street, West Bromwich, B70 6PR.