Privacy policy

Who the controller is

The controller is Zordon Intelligence sp. z o.o., owner of the Toplista portal, ul. Piotrkowska 152/30, 90-063 Łódź, KRS 0001190915, VAT ID 7252358503. Data protection contact: privacy@toplista-oze.pl.

We have not appointed a data protection officer, because we do not process data on a large scale or special category data.

What we collect

Business owner account: name, e-mail address, password hash, address confirmation date.

Company profile: public registry data (name, VAT ID, address, phone) plus whatever the owner adds in the panel.

Enquiry to a company: name, e-mail address, optional phone and the message body.

Review: name or initial, rating, review body.

Analytics — only with your consent: the analytics cookie identifier, browser and device information, approximate location (city), visited addresses and events in the portal. Without consent we collect nothing from this list.

Why and on what legal basis

Account and profile — performance of a contract (Art. 6(1)(b) GDPR).

Enquiry to a company — your consent given with the checkbox (Art. 6(1)(a) GDPR); you can withdraw it at any time by writing to the contact address.

Analytics — your consent from the banner (Art. 6(1)(a) GDPR). Until you click "I agree", no analytics script loads.

Security and abuse prevention — legitimate interest (Art. 6(1)(f) GDPR).

We do not use your data for automated decision-making or for advertising.

Who receives the data

An enquiry reaches the company from the profile plus at most two other companies in the same category and city — three recipients in total. The list of companies is visible in the panel after the enquiry is sent.

Analytics: Google Ireland Limited (provider of Google Analytics 4) as a processor. Data may be processed outside the EEA under standard contractual clauses; Google receives the IP address at request time but does not share the full address with us.

Otherwise the data is seen only by infrastructure providers (hosting, e-mail) to the extent necessary to run the portal. We do not sell data and do not pass it to brokers.

How long we keep it

Enquiries: the company has 14 days to respond, and after 90 days we irreversibly delete contact data — name, e-mail and phone. Only an anonymous statistical trace remains.

Account: until the account is deleted, then 30 days for possible claims.

Technical logs and the event log: 12 months, without message content.

Analytics events: no longer than 14 months, in line with the retention setting in Google Analytics.

Your rights

You have the right to access, rectify, erase, restrict, port and object. You may withdraw consent at any time.

You may complain to the Polish Data Protection Authority (UODO). We answer requests within 30 days.

Security

Passwords are stored only as hashes. All traffic uses HTTPS. The email log holds no plain addresses — only a SHA-256 hash and a mask.

Panel access is limited to the account that actually manages the given profile.

Analytics, consent and opting out

We turn analytics on only with your consent. A banner appears on the first visit with two equal buttons: "I agree" and "No analytics". Clicking the second one does not restrict access to any portal content.

We store your choice in browser storage (localStorage, key tl_consent_v1), not in a cookie — it does not identify you and is never sent to us.

You can withdraw consent at any time: clear the site data in your browser (the button next to the address bar) and the banner returns on your next visit. You can also write to the contact address and provide the identifier from the _ga cookie — we will request deletion of the linked data on Google's side.

We do not use analytics for advertising, we do not build advertising profiles and we do not enable Google advertising features. The technical details are described on the cookies page.