Privacy Policy
Version of 12.11.2026 (working draft pending legal review).
1. Data controller
The controller of your personal data is the private individual who runs the dejt.pl service. For any matters relating to your data, you can write to kontakt@dejt.pl.
2. What data we process and why
| Purpose | Data | Legal basis |
|---|---|---|
| Running your account and providing the Service | email, password (stored as a hash), name, date of birth, gender, town, photos, description, messages | Art. 6(1)(b) GDPR (contract) |
| Matching people based on preferences | who you are looking for, what you are looking for, information about your intimate life and orientation that follows from your profile and, if you provide them, intimate preferences, temperament and boundaries (visible only to logged-in users, never in internet search engines or in statistics) | Art. 9(2)(a) GDPR - your explicit consent, given at sign-up or when you first save your preferences, which you can withdraw by deleting your preferences or your account |
| Security, preventing fraud and multiple accounts, moderation | IP address, device identifier stored in a cookie, verification photo, reports, record of decisions | Art. 6(1)(f) GDPR (legitimate interest) and obligations under the Digital Services Act (DSA) |
| Personals and phone number (if you provide them) | content of personals, town, phone number (stored in encrypted form) and the setting for who can see it | Art. 6(1)(b) GDPR (contract) - providing your number is voluntary and you can remove it at any time |
| Email notifications | email, notification settings | Art. 6(1)(b) GDPR; you can turn off notifications about new messages in your settings |
| Visitor statistics (Google Analytics) | general addresses of pages visited, without profile identifiers, approximate location, device type | Art. 6(1)(a) GDPR - only with your consent given in the cookie banner |
| Reports of illegal content (DSA form) | address or description of the content, description of the violation, the reporter's email | Art. 6(1)(c) GDPR (obligations under the Digital Services Act) |
| Defending against claims and retaining evidence | reported content, record of moderation decisions | Art. 6(1)(f) GDPR |
3. How long we keep data
- Account data - until the account is deleted; after deletion your profile disappears immediately, and the data is permanently erased within 30 days.
- View-once photos from conversations - 90 days from sending (they disappear from the conversation after being viewed, but remain on the server, accessible only to the Administration and moderation in connection with a report).
- Reported content - 12 months from the report, as evidence, in a separate location accessible only to moderation. Record of moderation decisions - for as long as the account exists and for 12 months after it is deleted.
- Reports of illegal content (DSA form) - the content of the report and the reporter's email for 12 months from the decision.
- Verification photo with a handwritten note - deleted after the moderator's decision; we only keep its hash to detect reuse on other accounts.
- IP addresses and device identifiers - up to 30 days in the security history, except for the sign-up address, which is kept together with the account.
- Safe date - the trusted contact's name and email and the date plan are deleted 7 days after the date. The trusted contact receives information about the controller and can unsubscribe with one click.
- Daily activity log (date and account identifier, for site statistics) - 90 days.
- Database backups - up to 14 days.
Access by the Administration
The site's Administration has access to account data for the purposes of moderation and security (Art. 6(1)(f) GDPR).
4. Who we share data with
- OVH (OVH SAS, France) - the server on which the Service runs; data stays within the European Union.
- Brevo (Sendinblue SAS, France) - sending emails: address confirmations, password resets and notifications.
- Google Analytics (Google Ireland Ltd.) - only with your consent given in the cookie banner; Google may transfer data to the USA on the basis of standard contractual clauses and the EU-US Data Privacy Framework. We do not share account identifiers or the addresses of profiles and conversations.
- Public authorities - where required by law.
We do not sell data and we do not display personalized ads.
5. Cookies
We use essential cookies (login session, form protection, a device identifier to protect against multiple accounts, remembering your choice in the banner - the dejt_zgody cookie, 6 months). Google Analytics cookies (_ga) are set only with your consent. You can change your consent at any time using the "Cookie settings" link in the page footer.
6. Your rights
You have the right to access your data, to rectification, erasure, restriction of processing and data portability, to object to processing based on legitimate interest, and to withdraw your consent at any time (without affecting the lawfulness of processing carried out before withdrawal). You can change most of your data yourself in your profile and settings, and delete your account with a single button. For anything else, write to kontakt@dejt.pl. You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland).
You can download a copy of your data (profile, preferences, your messages, points history) yourself as a JSON file in Settings - using the "Download my data" button. There you can also hide your profile (a break from dating without deleting your account) or delete your account.
7. Automated decisions
The anti-spam filter may automatically suspend an account that sends large numbers of similar messages. Such a block is temporary, it is always reviewed by a human, and you can appeal against it. We do not make any other decisions with legal effects based solely on automated processing.