Privacy Policy

Last updated: 16 October 2026

This Privacy Policy describes which personal data we process when you use getfrom.eu (the “directory”), the purposes and legal bases of the processing, and your rights. It is based on the EU General Data Protection Regulation (GDPR), the Polish Personal Data Protection Act of 10 May 2018 (ustawa o ochronie danych osobowych) and, with regard to cookies, Article 399 of the Polish Electronic Communications Law of 12 July 2024 (Prawo komunikacji elektronicznej).

1. Controller

The controller of personal data processed on this website is:

Bismit Maciej Bis
Instalatorów 5A/180
02-237 Warszawa, Poland
VAT ID: PL8652547088
REGON: 362681235
Email: contact@getfrom.eu

Questions concerning data protection may be sent to the email address above or submitted through the contact form.

2. Overview

The directory can be browsed and searched without an account and without providing any personal data. Personal data is processed in the following cases:

• for technical reasons, on every visit to the website (server and security logs, section 3);

• where you consent to analytics cookies (section 5);

• when you send a message or submit a shop (sections 7 and 8);

• when you purchase a membership and use your account (sections 9 and 10).

We do not sell personal data, do not use it for advertising purposes and do not make automated decisions within the meaning of Art. 22 GDPR.

3. Hosting, Cloudflare and server logs

Hosting. The website is hosted on servers provided by OVH sp. z o.o., ul. Swobodna 1, 50-088 Wrocław, Poland, which processes data on our behalf and solely in accordance with our instructions (Art. 28 GDPR).

Cloudflare. Requests to the website are routed through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, which protects the website against attacks and improves its performance. For this purpose, Cloudflare processes IP addresses and technical request data. The legal basis is our legitimate interest in operating a secure and reliable website (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-U.S. Data Privacy Framework, and our agreement with Cloudflare incorporates the EU Standard Contractual Clauses.

Server logs. On each visit, the server automatically records technical information: the IP address, the date and time of the request, the requested page, the referring page, and the browser and operating system used. This information is required to deliver the website, ensure its security and identify errors (Art. 6(1)(f) GDPR). Logs are deleted after no more than 14 days, unless they are needed to investigate a specific security incident.

Protection against misuse. To prevent automated misuse, the number of requests per IP address is limited. For this purpose, IP addresses are stored temporarily, predominantly in hashed form, and deleted automatically after a few minutes (Art. 6(1)(f) GDPR).

4. Cookies

Cookies are small files stored by the browser on the user’s device. We use cookies that are strictly necessary to provide the website and the services requested, which do not require consent (Art. 399 of the Electronic Communications Law, Art. 6(1)(f) GDPR), and analytics cookies only with your consent (Art. 399 of the Electronic Communications Law, Art. 6(1)(a) GDPR).

You can disable analytics cookies at any time; any Google Analytics cookies already set are then deleted. Cookies can also be blocked or deleted in the browser settings; however, blocking strictly necessary cookies prevents signing in and submitting forms.

5. Google Analytics

With your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), to understand how the directory is used, for example which pages are visited and how visitors reach the website. No Google services are loaded before consent is given.

Google Analytics uses cookies and processes information about the device and its use of the website, including a pseudonymous identifier. For users in the EU, Google Analytics 4 does not log or store IP addresses. Google signals and the use of data for advertising purposes are disabled. The data is retained for 2 months and then deleted automatically.

The legal basis is your consent (Art. 6(1)(a) GDPR, Art. 399 of the Electronic Communications Law), which may be withdrawn at any time with effect for the future by disabling analytics cookies; the Google Analytics cookies are then deleted. Google may transfer data to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework. Google processes the data as our processor under a data processing agreement. Further information is available in the Google Privacy Policy.

6. Cloudflare Turnstile

To protect our forms (sign-in, password reset, contact and shop submission) against spam and automated abuse, we use Cloudflare Turnstile, a service provided by Cloudflare, Inc. (see section 3). Turnstile is loaded only on pages containing these forms. It verifies that a form is used by a person by analysing technical information such as the IP address and browser characteristics, and does not use cookies for tracking purposes.

The legal basis is our legitimate interest in protecting the website and its users against abuse (Art. 6(1)(f) GDPR). The verification does not require consent, as it is strictly necessary to provide the form requested by the user (Art. 399 of the Electronic Communications Law). Further information is available in the Cloudflare Privacy Policy.

7. Contact form and email

When you contact us, we process your name, email address, the selected topic, your message and, in the case of a shop report, the shop concerned and the reason for the report. To prevent abuse, the IP address and browser details are also stored. This data is used to respond to your enquiry. The legal basis is our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR) or, where the enquiry relates to a contract, Art. 6(1)(b) GDPR.

Messages are deleted automatically 12 months after receipt, unless longer retention is necessary, for example for the establishment or defence of legal claims.

8. Shop submissions

When a shop is submitted through the Submit a shop form, we process the shop details provided, the submitter’s email address (optional), the IP address and browser details. The shop details are used to review the shop and, if it is accepted, to list it in the directory. The email address is used solely to contact the submitter with questions about the shop. The legal basis is our legitimate interest in operating and improving the directory and protecting the form against abuse (Art. 6(1)(f) GDPR).

The IP address, browser details and email address are removed from the submission automatically after 6 months.

9. Membership and payment

Memberships are sold and billed by Creem (creem.io), which acts as reseller and merchant of record. The checkout is displayed on our website in a secure window provided by Creem; Creem’s script is loaded only when you start a purchase, for example by selecting “Become a member”. Payment details are entered directly with Creem; we do not receive or store card or bank details. Creem processes personal data as an independent controller, in accordance with its own privacy policy.

Creem provides us with your name, email address and subscription status (for example active, cancelled or renewal date), together with Creem’s customer and subscription identifiers. This data is used to create your account, provide access to member features and manage your membership. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR).

10. Account, saved shops and shared lists

Account. An account contains your name, email address, a securely hashed password and your membership status. We send the emails required to operate the account, such as the welcome email with a sign-in link, password reset emails and email address confirmations. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR).

Saved shops and lists. We store the shops you save and the lists you create. A shared list, including its name, the shops it contains and your account name, is visible to anyone with its link. Shared lists are excluded from search engine indexing. Sharing may be disabled at any time, after which the previous link no longer works.

Deletion. You may delete your account at any time under My account › Settings, whereupon your account, saved shops, lists and membership records are deleted from our systems. Deleting the account does not cancel payments with Creem; the membership should therefore be cancelled beforehand.

11. Emails

Emails are sent through OVH sp. z o.o. (see section 3), which processes the recipient’s email address and the content of the email on our behalf (Art. 28 GDPR). Emails awaiting delivery are stored temporarily on our server; records of failed deliveries are deleted after no more than 30 days.

12. Links to shops

Following a link to a shop takes you to an external website. No personal data is passed on to the shop. The link contains the parameter “utm_source=getfrom.eu”, which identifies the directory as the source of the visit. These are not affiliate links, and we do not receive commission on purchases made in the listed shops. From that point, the shop’s own privacy policy applies. We only record the total number of times a shop’s details are opened, which is not linked to any individual.

13. Recipients and transfers outside the EU

Personal data is disclosed only to the service providers named in this Privacy Policy, to the extent necessary for the purposes described: our hosting provider, Cloudflare, Google (only with your consent), Creem and our email provider. Some of these providers are based in the USA or may access data from there. Transfers to the USA are based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and, where required, on the EU Standard Contractual Clauses (Art. 46 GDPR).

Data may also be disclosed to public authorities where we are legally obliged to do so (Art. 6(1)(c) GDPR).

14. Retention periods

Personal data is retained only for as long as necessary for the purposes described above, in particular:

• server logs: up to 14 days;

• contact messages: 12 months;

• IP address, browser details and email address in shop submissions: 6 months;

• account data, saved shops and lists: until the account is deleted;

• Google Analytics data: 2 months.

Where the law requires certain data to be retained for longer, it is kept only for the period required.

15. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you (Art. 15 GDPR);

• rectify inaccurate data (Art. 16 GDPR);

• have your data erased (Art. 17 GDPR);

• restrict the processing of your data (Art. 18 GDPR);

• receive your data in a structured, commonly used format (Art. 20 GDPR);

• withdraw your consent at any time with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR). Where data is processed on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you may object to the processing at any time on grounds relating to your particular situation. We will then cease processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for the establishment, exercise or defence of legal claims.

Requests to exercise these rights may be sent to contact@getfrom.eu. We will respond within one month.

Right to lodge a complaint. You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement. In Poland, the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

16. Provision of data

Providing personal data is not required to browse the directory. Certain services, however, cannot be provided without it: in particular, an email address is required to respond to enquiries and to create a membership account.

17. Changes to this Privacy Policy

This Privacy Policy may be updated to reflect changes in our services or in the law. The current version is always available on this page, with the date of the most recent update shown at the top.