Privacy and Cookie Policy

Version effective as of 17 August 2026. Replaces the version of 5 May 2026.

Summary of Updates

This Privacy and Cookie Policy was updated on 17 August 2026 and restructured so that its organisation follows the function and purpose of data processing, rather than being organised solely by individual Service. The substantive changes compared to the previous version include:

• extending this Policy to cover a new service — the Tacho app (tacho.kocie.mba);
• changing the API address from app.kocie.mba/api to the dedicated subdomain api.kocie.mba;
• introducing a distinct category, "data stored exclusively locally by the User," covering both the driver working-time log in the Tacho app and shipment data in the EDI application;
• clarifying that the Tacho app uses the same interface mechanisms (language, theme, banners) and the same privacy-first analytics as the other applications;
• clarifying the scope of the section on infrastructure security;
• expanding the information on the right to lodge a complaint to include the supervisory authority with territorial jurisdiction other than the Dutch one;
• stating that the Services are intended for adult users.

1. Controller and Scope of the Policy

The controller of personal data and the entity responsible for the use of cookies (hereinafter: the "Controller") is DGSA drs. D. Kociemba, with its registered office in Eindhoven, Spalaan 6, 5628 ZG, the Netherlands, entered in the KVK register under number 95907130, VAT ID: NL005178103B20.

This Policy applies to the following services (hereinafter collectively: the "Services"): app.kocie.mba (ADR Application), edi.kocie.mba (EDI Application), tacho.kocie.mba (Tacho app), api.kocie.mba, adr-egzamin.pl, adr-polska.pl, damiankociemba.pl, dgsa-nederland.nl, learn.noviqa.group.

The Services are intended for adult users.

Questions concerning this Policy and the processing of personal data may be directed to: damian@kocie.mba.

2. General Principles

The Controller processes personal data in accordance with the principle of privacy by design, seeking to limit the scope of processed data to the necessary minimum and to eliminate the possibility of directly identifying the User wherever this is possible given the purpose of processing. In the case of the Tacho app and the EDI Application, this principle is implemented architecturally — by storing the User's business data exclusively on their own device, as described in detail in Section 5.

For the purposes of this Policy, "cookies and related technologies" means cookies within the meaning of the Polish Telecommunications Law, as well as local browser storage mechanisms (Local Storage).

3. Functional Data (Necessary for the Operation of the Services)

Data in this category is necessary for the proper functioning of the Services and for the provision of services expressly requested by the User. Under Article 173(3) of the Polish Telecommunications Law, the use of such data does not require separate User consent.

Interface preferences. The ADR Application, the EDI Application and the Tacho app store the User's interface settings in Local Storage, such as the selected language, display theme (light/dark), and the dismissal status of the installation banner. In the ADR Application, this is implemented, among others, through the variables appLang, theme, and smartBannerDismissed; in the Tacho app — through the variables tachoLocale, tachoDarkMode, and tachoInstallBannerDismissed. The EDI Application uses an analogous mechanism. This data allows the User's settings to be remembered between visits and is not transmitted to the Controller.

Session maintenance (Moodle). The MoodleSession file is necessary to maintain the login session on the educational platform. The MOODLEID file remembers the username, supporting the digital accessibility of the service.

Security and payments (Stripe). The adr-egzamin.pl service uses the Stripe payment gateway, which uses necessary cookies (e.g. __stripe_mid) to prevent fraud, including protection against cross-site request forgery attacks, and to securely process payment transactions. Processing of data in connection with payments may involve their transfer outside the European Economic Area; Stripe safeguards such transfers through standard contractual clauses approved by the European Commission.

Blocking or deleting data in this category may result in the Services not functioning properly, including the inability to log in to a course or the loss of saved interface settings.

4. Privacy-First Analytics

This section applies to all Services covered by this Policy, including the Tacho app.

In order to develop the Services, the Controller analyses how they are used (e.g. how the ADR calculator, the tunnel search tool, or individual features of the driver working-time log are used) using Matomo software installed on the Controller's server located within the European Union.

• Cookieless configuration — Matomo has been configured so as not to store any persistent cookies on the User's device for statistical purposes.
• IP address anonymisation — the User's IP address is automatically masked and processed only at an aggregated level.
• No transfer to third parties — statistical data is not shared with third parties or used to build marketing profiles.

The scope of data collected through analytics is limited to how the User interacts with the interface of the Service and does not include the content of data entered by the User — in particular, the content of the driver working-time log (Tacho app) or shipment data (EDI Application), described in Section 5.

5. Data Stored Exclusively Locally by the User

Two Services — the Tacho app and the EDI Application — allow the User to enter data of significant business or personal relevance, which is stored exclusively on their own device and is not transmitted to, or stored on, the Controller's infrastructure.

Tacho app. Data entered by the User as part of the driver working-time log — including full name, date of birth, driving licence number, driver card number, and activity entries — is stored exclusively in the local memory of the User's browser (Local Storage). The only network connection unrelated to the analytics described in Section 4 is a one-time download of an external technical library (jsPDF), used solely to generate PDF reports, from a publicly available content delivery network (CDN), upon first use of this feature — no personal data is transmitted as part of this connection, only the library's code. The tacho.kocie.mba domain is hosted via Cloudflare solely for the purpose of securely delivering the application's files; unlike app.kocie.mba and edi.kocie.mba, this service does not have its own API or a rate-limiting mechanism based on the processing of IP addresses, as it does not have server infrastructure performing such functions.

EDI Application. Similarly, data concerning recipients, senders, and cargo, entered by the User as part of transport documents, is stored locally and managed independently by the User.

In both cases, data leaves the User's device only when the User independently initiates its export (e.g. in JSON or PDF format), in order to share it with, for example, an employer, or to create a backup copy. The Controller has no access to data exported in this way. The User may at any time permanently delete this data from within the relevant application.

6. Marketing Files

The Controller does not use marketing cookies, tracking pixels, or third-party remarketing tools.

7. Infrastructure Security and Prevention of Abuse

The processing of IP addresses for purposes related to infrastructure security constitutes a separate basis for processing from the anonymised analytics described in Section 4. Logging and verification of network parameters, including IP addresses, at the server infrastructure level is necessary to ensure security, prevent abuse, and maintain the stability of the Services. The legal basis for this processing is the Controller's legitimate interest (Article 6(1)(f) GDPR).

Depending on the Service, this is implemented as follows:

• ADR Application and EDI Application, including the API — the kocie.mba domain and the subdomains app.kocie.mba, api.kocie.mba, and edi.kocie.mba are protected by Cloudflare's security infrastructure, which analyses network traffic in real time to counter DDoS attacks and malicious software. If unusual network traffic is detected, access to the Service may be automatically blocked. These Services are additionally subject to daily request limits (rate limiting); to enforce these limits and prevent automated data scraping (web scraping), the User's IP address is irreversibly hashed immediately upon reaching the server, and request limits are counted solely on the basis of this anonymised string, without storing the original IP address.
• Tacho app — see Section 5. This service does not have its own API or a mechanism based on the processing of IP addresses for rate-limiting purposes; the domain is protected by Cloudflare solely at the level of static file delivery.
• Moodle platform — for security purposes, to verify the progress of training courses, and to prevent account takeovers, the platform routinely logs IP addresses in system login logs.
• Other informational and utility Services — adr-egzamin.pl, adr-polska.pl, damiankociemba.pl, and dgsa-nederland.nl use Cloudflare protection. If unusual network traffic is detected, access to the site may be automatically restricted in order to ensure its availability to other Users.

8. Managing Your Settings

The User may block specific categories of cookies in their browser settings and delete cookies stored on their device after finishing use of a Service. The Controller's analytics system respects the browser's "Do Not Track" setting — enabling it excludes the User's visit from anonymous statistics.

The rules for deleting data stored locally in the Tacho app and the EDI Application are described in Section 5.

9. User Rights

The User has the right to access their data, rectify it, erase it, and restrict its processing, as well as the right to lodge a complaint with a supervisory authority.

A complaint may be lodged either with the Dutch supervisory authority (Autoriteit Persoonsgegevens), which has jurisdiction on the basis of the Controller's registered office, or with the supervisory authority competent for the User's place of habitual residence, place of work, or place of the alleged infringement — in the case of Poland, this is the President of the Personal Data Protection Office (UODO).

The Controller uses data processors within the meaning of Article 28 GDPR, including providers of hosting and security infrastructure, the educational platform provider, and the payment gateway provider, with each of whom appropriate data processing agreements have been concluded.

Given the fully anonymised nature of the data processed within the analytics system, the exercise of certain rights with respect to this data (e.g. the right to delete a specific record) may be objectively impossible due to the absence of any link between this data and an identifiable natural person.