Information on the Processing of Personal Data

Legal basis: Article 5(1)(a) and Article 24(1) GDPR (the principles of transparency and accountability).

This policy sets out the rules for processing and protecting personal data provided by Users and Customers in connection with the use of the services and digital ecosystem of Dangerous Goods Safety Advisor drs. D. Kociemba, including the kocie.mba domains (app.kocie.mba, api.kocie.mba, edi.kocie.mba, tacho.kocie.mba), adr-egzamin.pl, and learn.noviqa.group (hereinafter collectively: the "Services"). The Services are intended for adult users.

1. Controller of Personal Data

The controller of your personal data is DGSA drs. D. Kociemba, with its registered office in Eindhoven, Spalaan 6, 5628 ZG, the Netherlands, registered in the Dutch Commercial Register (KvK) under number 95907130, VAT ID: NL005178103B20 (hereinafter: the "Controller").

The Controller may be contacted via:

• e-mail: damian@kocie.mba (preferred) or info@kocie.mba;
• postal address: Spalaan 6, 5628 ZG Eindhoven, the Netherlands.

2. Purposes and Legal Bases for Processing

The Controller processes your data for the following purposes:

a) Provision of services and delivery of software — to conclude and properly perform an agreement for the provision of advisory and training services (including the issuance of certificates) and to provide access to the functionality of the ADR Application and the EDI System. Legal basis: Article 6(1)(b) GDPR (necessity for the performance of a contract or the provision of a service by electronic means).

b) Payment processing — in the case of purchases in the online shop (Training, VIP Tokens), data is processed to handle the payment process. Legal basis: Article 6(1)(b) GDPR.

c) Compliance with legal obligations — to fulfil obligations arising from applicable law, in particular tax and accounting obligations. Legal basis: Article 6(1)(c) GDPR.

d) Contact and handling of enquiries — to conduct correspondence in response to your enquiries. Legal basis: Article 6(1)(f) GDPR (the Controller's legitimate interest).

e) IT infrastructure security and prevention of abuse — to protect servers against attacks (DDoS), to enforce request limits (rate limiting) in the ADR Application, the API, and the EDI Application, and to log access to the Moodle educational platform. Legal basis: Article 6(1)(f) GDPR.

f) Analysis of how the Services are used — to develop the functionality of the Services, including the Tacho app, on the basis of anonymised analytics data collected using Matomo software, described in detail in Section 3. Legal basis: Article 6(1)(f) GDPR.

g) Establishment, exercise, or defence of legal claims — to protect the Controller's rights relating to the performance of a contract or breaches of the Terms of Service. Legal basis: Article 6(1)(f) GDPR.

Scope not covered by this Policy. Data entered by the User as part of the driver working-time log in the Tacho app (including full name, date of birth, driving licence number, driver card number, and activity entries) is processed exclusively locally, on the User's device, and is not transmitted to the Controller in any respect. Consequently, the Controller does not process this data and does not act as a data controller with respect to it within the meaning of the GDPR. The same principle applies to data on recipients, senders, and cargo entered by the User in the EDI Application.

3. Categories of Personal Data Processed

The Controller processes the following categories of data, depending on the scope of use of the services:

• Identification data — full name (verification on the training platform).
• Contact data — e-mail address, telephone number, certificate shipping address.
• Transactional and company data — invoicing data, including tax/VAT ID.
• Training data — information required to issue a certificate (e.g. nationality, place and date of birth, learning-progress logs on the Moodle platform).
• Analytics data — anonymised data on how the Services are used, collected using Matomo software in cookieless mode with full IP address anonymisation. This category applies to all Services, including the Tacho app, and does not include the content of data entered by the User in the Tacho app log or in the EDI Application.
• Security log data (rate limiting) — IP addresses used to protect infrastructure and verify request limits in the ADR Application, the API, and the EDI Application, subject to immediate one-way hashing. This category does not apply to the Tacho app, which has no API or rate-limiting mechanism of its own.

Providing data is voluntary but necessary to conclude an agreement, purchase Training, or submit an enquiry. Using the Tacho app does not require providing the Controller with any personal data.

4. Data Retention Period

Your data will be retained for the period necessary to achieve the purposes referred to in Section 2:

• Contract performance and settlements — for the duration of the agreement, and thereafter for the period resulting from tax regulations (up to 7 years).
• Certificates and confirmations — data contained in training completion certificates and confirmations (and associated Moodle platform accounts) is retained for 5 years, allowing a duplicate document to be issued in the future (legitimate interest).
• Security log data (rate limiting) — retained short-term, generally no longer than 48 hours, solely to reset daily limits in the ADR Application, the API, and the EDI Application, unless a security breach has occurred resulting in a permanent block. This category does not apply to the Tacho app.
• Analytics data (Matomo) — retained in accordance with the data retention configuration set within the Controller's analytics system.
• Tacho app log data and EDI Application shipment data — not retained by the Controller for any period, as it is never transmitted to the Controller; the retention period on the User's device depends solely on the User's own decision.

Data may be retained for longer if necessary for the establishment, exercise, or defence of legal claims. After the periods indicated above have elapsed, data will be permanently deleted or anonymised.

5. Recipients of Personal Data

To ensure the proper provision of services, your data may be entrusted to:

• Payment processors — payments are handled by Stripe, Inc. Data necessary for a transaction is transmitted directly to Stripe, which acts as an independent controller (Stripe's policy: stripe.com/privacy).
• Security infrastructure providers — network traffic to the Services, including the Tacho app, is routed through the global filters of Cloudflare, Inc. for protection against attacks. In the case of the Tacho app, this protection covers only the static file delivery layer — this service does not use the IP-address-based rate-limiting mechanism referred to in Sections 3 and 4.
• IT and hosting service providers — companies providing server maintenance services (including OVH). The contact form is built on the infrastructure of Mobirise (the Netherlands), which relays messages without permanently storing them on its servers.
• Accounting and logistics providers — accounting firms, law firms, and courier/postal companies handling the shipment of certificates.

All entities cooperating with the Controller guarantee the application of appropriate data protection measures.

6. Data Security Measures

The Controller implements rigorous technical measures to ensure the security of processed data (privacy by design). Communication with the Services takes place via TLS/SSL encryption.

In systems storing sensitive data (e.g. the Moodle administration panel), multi-factor authentication (MFA) or hardware security keys (FIDO2) are used.

For analytics purposes, the Matomo platform is used in cookieless mode, fully anonymising IP addresses; this applies to all Services, including the Tacho app.

In applications exposing API resources, the IP addresses of users used to manage request limits are one-way hashed within a fraction of a second, making them impossible to decode afterwards.

The Controller does not use automated decision-making producing legal effects, nor marketing profiling, within the meaning of Article 22 GDPR.

7. Rights of the Data Subject

You have the following rights:

• the right of access to your data (Article 15 GDPR) and rectification (Article 16 GDPR);
• the right to erasure ("the right to be forgotten" — Article 17 GDPR), subject to limitations arising from legal obligations (e.g. tax regulations);
• the right to restriction of processing (Article 18 GDPR) and to data portability (Article 20 GDPR);
• the right to object to processing (Article 21 GDPR);
• the right to withdraw consent at any time, where applicable.

To exercise these rights, please contact: damian@kocie.mba.

You have the right to lodge a complaint either with the Dutch supervisory authority (Autoriteit Persoonsgegevens, AP — autoriteitpersoonsgegevens.nl), which has jurisdiction on the basis of the Controller's registered office, or with the supervisory authority competent for your place of habitual residence, place of work, or the place of the alleged infringement — in the case of Poland, this is the President of the Personal Data Protection Office.

The above rights do not apply to Tacho app log data or EDI Application shipment data, to the extent that this data is never transmitted to the Controller — the User manages this data independently, directly within the relevant application.

8. Transfers of Data Outside the European Economic Area (EEA)

Your core personal data is hosted on servers located within the EEA — OVH servers in France for the training platform, and in Poland for the main websites and applications, including the Tacho app. In connection with the use of global service providers such as Stripe (payments) and Cloudflare (infrastructure security and anti-DDoS protection), necessary transactional data or network parameters (e.g. IP traffic) may be processed in third countries, including the USA. The Controller ensures that such transfers take place on the basis of lawful mechanisms (e.g. the Data Privacy Framework for the USA, or Standard Contractual Clauses approved by the European Commission).

9. Changes to the Privacy Policy

The Controller reserves the right to make changes to this Privacy Policy in order to reflect ongoing developments in IT architecture and legal requirements. The current version will always be available within the Services.