Privacy policy

Version of 30 October 2026. Applies to the coffeerace.pl website, the Coffee Race App, Coffee Race events and our social media profiles. The Polish version prevails in case of discrepancies.

1. Data controller

The controller of your personal data is Piotr Dziewulski, running the sole proprietorship Lazy Legs Coffee, ul. Goleszowska 3/109, 01-249 Warsaw, Poland, Tax ID (NIP) 5252346717, REGON 142884820 — “we” or “Coffee Race”.

2. Contact about your data

For anything related to your data, use our contact form (topic “Other”). We have not appointed a data protection officer — it is not required at our scale.

3. The coffeerace.pl website

3.1. Visits and server logs

When you open the website, the server automatically records technical logs including your IP address, date and time, the page requested and your browser type. We do this to keep the site running and secure (e.g. detecting attacks) — based on our legitimate interest (Art. 6(1)(f) GDPR). The logs are kept by our hosting provider for 8 days.

3.2. Contact form

We use your name, e-mail address, chosen topic and message only to reply and correspond with you (Art. 6(1)(f) GDPR; if you ask about taking part in an event or a partnership — also Art. 6(1)(b) GDPR). The message goes to our mailbox and a copy is stored in the site admin. The form uses no cookies. Your IP address is only used for a short-term sending limit (spam protection) — stored as an encrypted hash for up to one hour and never linked to the message. We keep messages for up to 12 months after the correspondence ends, unless needed longer, e.g. for partnership settlements.

3.3. Cookies and browser storage

Without your consent the website only uses essential cookies. Statistics and media players are enabled only after you consent in the banner (Art. 6(1)(a) GDPR in conjunction with Art. 399 of the Polish Electronic Communications Law). You can change or withdraw your consent at any time via “Cookie settings” in the footer of every page; withdrawal does not affect the lawfulness of earlier processing.

3.4. Statistics — Google Analytics

If you consent to statistics, we use Google Analytics 4 (Google Ireland Limited) to learn how many people visit the site and which content is read. Google receives information such as the pages you visit, approximate location (city, country — derived from your IP address, which is not stored), device and browser type, and an identifier stored in the _ga cookie. We don’t combine this with other information about you and don’t use it for advertising (Google signals are off). Google Analytics data is kept for 14 months. Google may transfer data to the USA — under the European Commission’s EU–US Data Privacy Framework decision and standard contractual clauses.

3.5. Podcast and videos — Spotify, YouTube

Spotify (Spotify AB) and YouTube (Google Ireland Limited) players load only after you consent to “Media” — until then a placeholder with a link to the service is shown. Once a player loads, that service receives your IP address and browser information and may set its own cookies under its privacy policy.

4. Coffee Race App

The app runs in the browser at app.coffeerace.pl. Using it is voluntary; some features require an account.

4.1. Account

To create an account you provide an e-mail address (sign-in link or password) or sign in with Google — then we receive your e-mail address and name from Google. You can add or change your name or nickname in your profile. We automatically assign you a start number. Your password is stored only by our sign-in provider (Google Firebase) in encrypted form — we have no access to it. Legal basis: performance of the contract for electronic services under the terms of use (Art. 6(1)(b) GDPR).

4.2. Taking part in events

We record which cafés you completed (QR scan), whether you reached the finish, free coffee redemption, the number of Instagram shares and your chances to win a prize. We also save your route plan (café order) if you create one. Prize results are announced by start number, without names or e-mail addresses. Legal basis: Art. 6(1)(b) GDPR; scan verification and abuse prevention — Art. 6(1)(f) GDPR.

4.3. Location and camera

• QR scan: with your phone’s permission the app sends your position once to check that you are within 100 m of the café. It is discarded immediately — we store neither the position nor your ride history, not even in logs.
• Nearest city, route order from your position: calculated on your phone only and never sent anywhere.
• The camera is used only to read the QR code on your device. We don’t store photos.

4.4. Your activity and content you add

• Favourites (cafés, shops, routes, events, groups) — visible only to you.
• Ratings (1–5) of cafés, shops and routes and appreciation stars for cafés — only totals and averages are public, not who rated.
• User routes — once approved, they are public and show the author’s name (name or nickname from the profile).
• Group rides — the organiser’s name, start place and time are visible to others; when you tap “I’m riding”, others only see the number of riders.
• Café and bike group suggestions, profile ownership requests (e-mail and message) and “Contact us” messages (name, e-mail, topic, message) — visible only to the administrator.
• Surveys — answers are stored without a link to your account (month only).
• Game — the leaderboard shows your profile name or “Rider #number”.
• Brewing assistant — saved recipes are visible only to you; a recipe shared to the common library shows the author’s name and start number. After account deletion, shared recipes remain attributed to “Coffee Race”, without a link to you.
• Profile photo stays on your phone only — we never upload it.

Legal basis: Art. 6(1)(b) GDPR (app features); content moderation and security — Art. 6(1)(f) GDPR.

4.5. Distance challenges and Coffee Race Time Trial

You upload a ride from a file (FIT, GPX, TCX). We don’t store the file itself. For distance challenges we keep a ride summary: start and end time, distance, moving time, elevation gain, device name and a file hash (so the same ride isn’t counted twice) — until you delete the ride or your account. For Time Trials we keep the result and the track segment from start to finish — only for result verification by the organiser; the segment is deleted once results are final, no later than 30 days after the challenge ends. Leaderboards show your profile name and start number to signed-in users. Legal basis: Art. 6(1)(b) GDPR.

4.6. Café loyalty programme

Your stamp card is stored in your account. When you request a stamp, the café sees only your start number — never your name or e-mail. Free coffee codes are single-use. Legal basis: Art. 6(1)(b) GDPR.

4.7. Push notifications

If you enable notifications (in-app button and phone permission), we store a Firebase Cloud Messaging device token (Google), your chosen city and notification types. Legal basis: your consent (Art. 6(1)(a) GDPR). Turn them off in Profile → Notifications or in your phone settings; the token is deleted when you turn them off, with your account, or when it expires.

4.8. Event e-mails

Only if you consent (the box is never pre-ticked), we send — as Coffee Race Crew — news about Coffee Race events, special projects and occasional partner offers and discounts. We process your e-mail address and your consent decision; proof of consent (text, version, date, where given) is kept as long as needed to demonstrate it. Legal basis: consent (Art. 6(1)(a) GDPR and Art. 398 of the Polish Electronic Communications Law). Withdraw any time: Profile → Event e-mails or the “Unsubscribe” link in every message. Sending will be handled by an external e-mail service provider acting on our behalf — we’ll name it in section 7 before the first mailing.

4.9. Café, bike shop and group accounts

If you manage a café, bike shop or group profile, we process your e-mail address and the profile data you enter (description, hours, photos, links, offers). Profile data is public in the app. Legal basis: Art. 6(1)(b) and (f) GDPR.

4.10. Statistics, security and device storage

• App statistics are anonymous daily totals only (e.g. screen views) — no personal identifier, no IP address, no cookies.
• Abuse prevention: Firebase App Check with reCAPTCHA Enterprise (Google) verifies that requests come from the genuine app; Google analyses device and browser information for this. We also apply rate limits. Legal basis: Art. 6(1)(f) GDPR.
• Device storage: the app stores in your browser your sign-in session, language, light/dark mode, chosen city, profile photo, recently loaded content (for offline use) and app files. It uses no advertising or analytics cookies.
• Maps (OpenFreeMap) — your browser loads map tiles from the provider’s servers, which see your IP address. Weather (MET Norway) — fetched by our server; no data about you or your position is shared. The in-app blog loads posts from coffeerace.pl.

5. Coffee Race events

Taking part. You join Coffee Race events through the app — an account and QR scans are all it takes; we don’t collect data via other forms. Events are for adults only.

Prizes. Winners are announced by start number. We announce them e.g. during a live stream on the Coffee Race Instagram. Prizes are collected in person at the finish café (usually within a week) by showing your start number in the app. We don’t share winners’ data with prize partners and don’t collect shipping or tax data. Legal basis: Art. 6(1)(b) GDPR.

Photos and videos. We take photos and videos at events and publish them on the website and our social media. Participants may appear as part of coverage of a public event (Art. 81(2)(2) of the Polish Copyright Act); publication serves event promotion (Art. 6(1)(f) GDPR). If you don’t want a photo of you published — let us know and we’ll remove it.

6. Social media

We run profiles on Instagram and Facebook (Meta Platforms Ireland Limited), a Strava club and a podcast on Spotify. When you follow us, comment or message us, we process the data visible in your profile and the content of the interaction — to run the profile and reply (Art. 6(1)(f) GDPR). For Facebook and Instagram page insights we are joint controllers with Meta. These services process data under their own privacy policies.

7. Who receives data

We entrust data only to companies that help us run the website and the app, under data processing agreements or terms:

Recipient	Purpose
LH.pl Sp. z o.o.	hosting of coffeerace.pl and e-mail
Google Ireland Limited (Firebase)	app: servers, database (Warsaw, europe-central2 region), sign-in, push notifications, App Check / reCAPTCHA
Google Ireland Limited	Google Analytics and YouTube — website, with consent only
Spotify AB	podcast player — with consent only
OpenFreeMap	map tiles in the app
e-mail service provider (named before the first mailing)	sending event e-mails — only to people who consented

Only the controller accesses the data on our side. Cafés and partners don’t receive your personal data (exception: your start number in the loyalty programme). Data may leave the European Economic Area only via Google — under the EU–US Data Privacy Framework decision and standard contractual clauses. We may disclose data to authorities when required by law.

8. How long we keep data

• Account and app data — until you delete your account. Deletion removes data immediately; backups may keep it for up to 14 days. Published routes, approved suggestions and shared recipes remain without a link to you.
• Contact form — 12 months after the correspondence ends.
• Consents (e-mail, notifications, cookies) — until withdrawn; proof of consent — as long as needed to demonstrate it.
• Google Analytics — 14 months; server logs — 8 days.

9. Your rights

You have the right to access your data, rectify it, erase it, restrict processing, data portability and to object to processing based on our legitimate interest. Where processing is based on consent, you can withdraw it at any time. Delete your account in the app: Profile → Delete account; for anything else contact us (section 2) — we reply within one month. You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

10. Other information

• Voluntary: providing data is voluntary, but you can’t create an account without an e-mail address and we can’t reply without the contact form details.
• No profiling: we make no decisions about you based solely on automated processing that produce legal effects. The automatic scan check (time, distance) only applies the event rules.
• Age: the app and events are for adults (18+).
• Security: connections are encrypted (HTTPS), only authorised people have access to data and database permissions are restricted by security rules.
• Changes: we’ll announce significant changes to this policy on the website and in the app. The current version is always at this address.

Change cookie settings