1.Controller and contact
The controller of personal data processed on the website kouryer.com, in the contact form and in the Panel is Michał Fox, trading as Kouryer, in Kraków, Poland (hereinafter "Kouryer", "we", "us").
For anything about personal data, write to hello@kouryer.com. We reply without undue delay and within one month at the latest.
Capitalised terms have the meaning given in the Terms of Service. Sections 9 and 10 cover people at companies we contact on behalf of our clients.
2.The website and cookies
The Website uses no analytics, advertising tools or social media plugins. Fonts and all other files are served from our own server, so browsing the Website sends no data to other companies.
The server logs technical details of each request: IP address, date and time, page address, response code and browser identifier. We use them only to keep the service secure and to diagnose errors, on the basis of our legitimate interest (Article 6(1)(f) GDPR), and keep them for up to 30 days.
In your browser we store only what the Website and the Panel need to work: your language choice, theme, sign-in session and Panel settings. The full list is in the Cookie Policy.
3.Contact form and correspondence
The contact form collects your name, work email, company website, company country, target market, an optional description of your ideal clients, the Plan you chose if you came from the pricing page, the language version and the time of sending.
We process form data and email correspondence to answer your inquiry and prepare a proposal, at your request before entering into a contract (Article 6(1)(b) GDPR), and for further correspondence on the basis of our legitimate interest (Article 6(1)(f) GDPR).
To protect the form against floods of submissions, the server holds the IP address and time of sending in memory for 10 minutes. The IP address is not stored with the submission.
We keep form data and correspondence for 12 months after our last contact. If we enter into an Agreement, we keep them for its duration and the periods in section 13.
4.Panel account
When an account is opened we collect the company name and website, your name, email address, chosen Plan and language. Passwords are stored only as a scrypt hash with a random salt. To record acceptance of the documents we store the version of the Terms, the date of acceptance and whether you asked us to start before the withdrawal period ended.
In the Panel we also process the data you and your team enter: the company and offer description, tone, the name and job title of the person signing Messages, the audience, the Exclusion list with who added each entry, calendar settings (provider, account, booking link, hours), Users with their addresses, roles and last activity, notification settings, notes, reply labels and call outcomes.
A password reset link is single-use and valid for 60 minutes.
We process account data to perform the Agreement (Article 6(1)(b) GDPR). We process the data of Users added by the Client on the basis of the Client's and our legitimate interest in letting the Client's team work in the Panel (Article 6(1)(f) GDPR).
An account whose Setup fee was not paid is deleted when the payment term in the Terms of Service ends, or earlier at your request. After the Agreement ends the account is read-only for 30 days, and we then delete it within 30 days, except for the data in section 13.
5.Tickets and attachments
In the Tickets section we process the subject, type and urgency of the matter, the messages from you and the Account manager, and attached files: up to 5 files per message, each up to 10 MB, in PNG, JPG, WEBP, PDF, CSV, XLSX, DOCX and TXT formats.
Attachments are stored on our server. Only the account that added them and our team serving that account can access them.
We process Tickets to perform the Agreement (Article 6(1)(b) GDPR), and complaints also to meet a legal obligation (Article 6(1)(c) GDPR). They are kept together with the account.
Please do not add to Tickets data we do not need for the matter, in particular special category data.
6.App and push notifications
The Panel can be installed as an app. On your first visit to the Panel the browser registers a service worker script that stores the offline page, icons and app files described in the Cookie Policy. These files contain no account data.
Push notifications work only if you turn them on in the Panel settings and allow them in your browser. We then store the subscription address at your browser's push service, the encryption keys, the notification categories you chose, your language, the browser identifier and the dates you turned them on and changed them.
Notifications are delivered by the push service of your browser vendor: Google (Chrome), Mozilla (Firefox), Apple (Safari) or Microsoft (Edge). The notification content is encrypted and the vendor cannot read it, but it sees the subscription address and the time of sending.
The legal basis is your request for the service (Article 6(1)(b) GDPR). We delete the subscription when you turn notifications off in the Panel, when the push service rejects it as expired, or together with the account.
7.Payments and invoices
For invoices we process the company name, address, tax or VAT ID and invoice email, as well as payment and Tenure history.
Card payments are handled by the payment operator shown in the Panel. We never receive the full card number; we only see the card type, the last four digits and the expiry date.
We process billing data to perform the Agreement and meet tax obligations (Article 6(1)(b) and (c) GDPR) and keep it for 5 years from the end of the tax year in which the tax payment deadline passed.
8.Data we process for our clients
We process the data of Contact persons at Target companies on the instructions of the Client, who is its controller. In doing so we act as a processor under the Data Processing Agreement.
Section 9 describes this processing from the point of view of the person we write to. You can send questions about it to us, and we pass them to the client on whose behalf we wrote.
9.If we wrote to you on behalf of a client
Who is responsible for your data. The controller is the company on whose behalf you received the message, named in its signature and footer. Kouryer runs the outreach for that company as a processor, on its instructions.
Where we got your data. From publicly available sources, mainly your company's website, as well as public business registers and publicly available professional profiles, or from our client, who named your company as a potential partner. We do not buy email lists.
What data. Your name, job title, business email address, company name and website, country and city, the fact about your company that prompted the contact, and the correspondence if you reply.
Why and on what basis. To ask whether our client's offer for companies like yours may interest you. The legal basis is the controller's legitimate interest (Article 6(1)(f) GDPR) in business contact with a person whose role relates to the offer. We only write to business addresses. In countries where sending commercial information by email requires prior consent, the first message contains no offer and only asks whether you want to receive it. The details are in the Outreach Policy.
How to opt out. Reply to the message with one word, for example "no", or use the opt-out link. It takes effect immediately, across every campaign of every Kouryer client, and needs no other details. We keep only your address on the Suppression list (section 10) so that nobody writes to you again.
How to ask for access or erasure. Write to hello@kouryer.com or reply to the message. We pass your request to the controller within 3 Business days and help carry it out. On a request for erasure we delete your data from every campaign, except the Suppression list entry.
How long. For the duration of the campaign and of our client's agreement with us; after it ends we delete the data at the latest after the 30-day read-only period and a further 30 days. If you reply with interest, your details and correspondence go to our client, who is then solely responsible for them.
Who sees your data. The client on whose behalf we write and the people on our team running its campaign. The data is stored on servers in Poland.
Your rights. You have the right to object, to access, rectification, erasure and restriction, and to complain to a supervisory authority (section 14). We always honour an objection to contact, without asking for a reason.
10.Suppression list
We keep the Suppression list as a controller, so that a person who opted out or objected receives no message in any campaign of any of our clients.
The list holds only the email address or domain and the opt-out date. It holds no names and no correspondence.
The legal basis is our legitimate interest in respecting objections and opt-outs (Article 6(1)(f) GDPR). We keep an entry for as long as we contact companies on behalf of clients, because deleting it would create a risk of contacting the person again.
If you still want an entry deleted, write to hello@kouryer.com. We will explain the consequences and act on the request if you confirm it.
11.Recipients of data
Data may be received only by these categories of recipients:
- the server provider in Poland on whose servers the Website, the Panel and our mail server run;
- browser push notification services (Google, Mozilla, Apple, Microsoft), only if you turn notifications on;
- the payment operator, when you pay by card;
- our client, for the data of people we write to on its behalf;
- public authorities, only where the law requires it.
We do not sell personal data or share it for advertising.
12.Transfers outside the EEA
We store data in Poland. It may leave the European Economic Area only in the cases in section 11.1 points 2 and 4: to push notification services, in encrypted form, and to a client based in a third country, on the basis of standard contractual clauses or a European Commission adequacy decision.
13.Retention periods
| Data | How long |
|---|---|
| Server logs | up to 30 days |
| Contact form and correspondence without an Agreement | 12 months after the last contact |
| Account, settings, Tickets and attachments | for the term of the Agreement, 30 days read-only after it ends, and up to 30 days for deletion |
| Push notification subscriptions | until notifications are turned off, the subscription is rejected or the account is deleted |
| Invoices and billing data | 5 years from the end of the tax year |
| Data needed to establish or defend legal claims | until the claims are time-barred, usually 3 years |
| Data of people we write to on behalf of clients | as in section 9.7 |
| Suppression list | as in section 10.3 |
14.Your rights
You have the right to access your data, have it rectified or erased, restrict its processing and receive it in a portable format, and to object to processing based on legitimate interests. We always honour an objection to direct marketing.
Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.
You can complain to the Polish President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw) or to the supervisory authority where you live or work, for example the ICO in the United Kingdom or the OAIC in Australia.
Providing data in the form and when opening an account is voluntary, but without it we cannot answer your inquiry or enter into the Agreement. We do not make decisions based solely on automated processing that produce legal effects for you.
We do not sell or share personal information within the meaning of US state privacy laws.
15.Security
We apply measures appropriate to the risk: encrypted connections, hashed passwords, a signed session that page scripts cannot read, roles and permissions in the Panel, separation of client data and servers in Poland. Details are in the Data Processing Agreement.
If a personal data breach is likely to result in a high risk to you, we will tell you without undue delay.
16.Changes to this policy
We announce material changes on the Website, and to clients also by email and in the Panel. Previous versions are available on request.
This Privacy Policy applies from 24 October 2026.