Privacy policy

Version dated 30 October 2026. Applies to topdrivers.pl, enquiries and purchases of sessions.

1. Data controller

The controller of your personal data is Mikołaj Konrad Grzejda, ul. Górczewska 15A/148, 01-186 Warszawa, Poland.

For matters concerning your personal data, contact:

• Email: [email protected]
• Telephone: +48 505 411 442
• Telegram: https://t.me/topdriverspl

2. Data, purposes and legal bases

I process information you provide when contacting me, purchasing or attending a session: your name, contact details, correspondence, payment information, and information about your work and earnings needed for the analysis.

I use these data for:

• Taking steps at your request before entering into a contract: Article 6(1)(b) GDPR. Other correspondence: Article 6(1)(f) GDPR; my legitimate interest is answering enquiries and maintaining contact.
• Providing the session, follow-up consultation and handling the guarantee: Article 6(1)(b) GDPR.
• Meeting tax obligations and handling complaints where required by law: Article 6(1)(c) GDPR.
• Establishing, exercising or defending legal claims: Article 6(1)(f) GDPR. My legitimate interest is protecting rights connected with my sales.
• Recording, preparing and publishing promotional materials: Article 6(1)(a) GDPR, based on separate, voluntary consents.

I do not need passenger data, identity document numbers or passwords to your accounts. Remove information about other people and anything unrelated to the analysis before sharing screenshots.

3. Recordings and promotional materials

You can attend a session without being recorded or consenting to promotion. This does not affect the price, scope of the service or guarantee.

We agree the scope before recording. Before publication, you separately approve the exact material, caption, disclosed data and publication channels. Paid advertising requires separate consent. A new channel or a substantial change to the material requires new approval.

I delete raw recordings once the necessary clips have been selected, and no later than 90 days after recording.

I retain and use approved promotional materials and selected files needed for editing until you withdraw consent or I stop using them to promote the service, whichever happens first. This does not justify retaining the entire unused conversation. At least once a year I review whether the materials remain necessary, current and within the scope of consent. I delete materials that are no longer needed for this purpose.

You can withdraw consent at any time by email or Telegram. Withdrawal does not affect the lawfulness of processing before withdrawal. I stop the use covered by your withdrawal without undue delay and remove the relevant publications and advertisements under my control. Other internet users may copy public materials.

4. Recipients and service providers

Providers receive the data needed to deliver the relevant service. I use:

Authorities may also receive data where authorised by law. Hostido handles domain registration; I do not use it to store client correspondence or recordings.

I store recordings, working notes and screenshots on my phone and computer, without automatic cloud backups of these files. Correspondence does pass through email and messaging systems, so not all data remain solely on my devices.

If you separately consent to publication of promotional material, recipients will also include viewers and the operators of the selected platforms: Meta Platforms Ireland Limited (Facebook and Instagram), Google Ireland Limited (YouTube), or TikTok Technology Limited and TikTok Information Technologies UK Limited (TikTok's joint controllers). We identify the selected profiles and advertising placements before accepting consent for a specific material. Purchasing a session alone does not cause your recording to be sent to these platforms.

5. Transfers outside the EEA

The services above use international infrastructure. Data may be processed outside the European Economic Area, including in the USA. Depending on the recipient and transfer, providers use European Commission adequacy decisions, including the EU–US Data Privacy Framework (DPF) for entities and data covered by certification, or Standard Contractual Clauses (SCCs).

• Cloudflare describes US transfers, the DPF and SCCs in its data processing agreement.
• Google describes transfers to its worldwide infrastructure, including Google LLC in the USA, and its use of the DPF and SCCs in its data transfer framework.
• Telegram identifies transfers to group companies in the British Virgin Islands and Dubai, United Arab Emirates, under SCCs. You can request information about the clauses from its EEA representative, EDPO, identified in sections 1.4 and 8.2 of Telegram's privacy policy.
• Zoom describes its use of the DPF and SCCs or other appropriate legal mechanisms for transfers to countries without an adequacy decision. Details and contact information are in Zoom's privacy statement.
• WhatsApp describes transfers including to the USA, the UK and Singapore, using applicable decisions, the DPF or SCCs, in the transfers section of its privacy policy.

Before you consent to publication, I also provide information about the selected platform and its transfers. Operators' rules are available in Meta's policy, Google's policy and TikTok's policy. TikTok describes its global group infrastructure and its use of adequacy decisions or SCCs. Consent to publication does not replace the legally required transfer mechanism.

You can email [email protected] for information about safeguards relating to your data or how to obtain a copy. The links above also explain mechanisms and how to contact providers.

6. Retention periods

• Enquiries that do not lead to a purchase: up to 6 months after the correspondence ends.
• Working notes and unpublished screenshots relating to the service: up to 90 days after session support and guarantee handling end.
• Raw recordings: deleted once the necessary clips have been selected, no later than 90 days after recording.
• Approved promotional materials and selected files needed for editing: as described in section 3, until consent is withdrawn or promotional use ends, whichever happens first, with a review at least annually.
• Tax and settlement documents: until the relevant tax liability becomes time-barred, generally 5 years from the end of the calendar year in which the tax payment fell due. Suspension or interruption of the limitation period may extend this.
• Data necessary for disputes or claims: until the applicable claim limitation period expires; if proceedings take place, until their final conclusion and completion of necessary enforcement. The period depends on the type of claim: the general period is 6 years, while business-related claims generally have a 3-year period, and special provisions may set shorter periods. Time is calculated from when the claim becomes due, applying statutory year-end, suspension and interruption rules. I do not automatically retain all data for the longest of these periods.
• Evidence of consents and withdrawals: only as needed to demonstrate lawful processing and defend claims, until the applicable claim limitation period expires.

Longer retention applies only to data needed for a specific purpose, not automatically to an entire recording or all screenshots.

Consent evidence includes the necessary confirmation of the date, scope and version of the approved material and any withdrawal. It does not justify further promotional use or retention of the entire conversation. Accountability also follows from Articles 5(2) and 7(1) GDPR.

7. Your rights

Subject to the conditions in the GDPR, you may request access, rectification, erasure, restriction of processing and data portability. You may also object to processing based on legitimate interests and withdraw consent.

You have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

Providing data needed for contact and performance of the contract is voluntary, but without it I may be unable to answer or provide the service. Promotional consents are entirely voluntary.

The right to erasure does not require deletion of documents that must be retained by law or data necessary for establishing, exercising or defending legal claims.

8. Website, cookies and technical data

https://topdrivers.pl is hosted on Cloudflare Pages. When you visit, its infrastructure handles information including your IP address, request date and time, requested page, browser and device details, and connection diagnostics. These are used to deliver the website, identify errors and protect against abuse. My legal basis is Article 6(1)(f) GDPR: the legitimate interest in operating and securing the website.

I do not keep my own archive of visit logs. Provider infrastructure retention depends on the purpose: handling requests, diagnostics, detecting and investigating incidents, and legal obligations. Section 11 of Cloudflare's privacy policy describes retention criteria including necessity for the purpose, the nature of the data and legal requirements.

The website has no order form, user accounts, embedded social media players, Google Analytics or Meta Pixel tracking tools. Its code does not store cookies or data in localStorage. Telegram and email links open the relevant external service when selected.

Cloudflare protection may use strictly necessary technical cookies when performing security checks, such as cf_clearance (confirmation of a completed check) or __cf_bm (bot protection). Their presence depends on the active protection feature. __cf_bm expires after 30 minutes of inactivity; cf_clearance duration depends on Cloudflare's challenge settings. Names, purposes and behaviour are described in Cloudflare's cookie documentation. I do not use these cookies for advertising or cross-site tracking.

I do not make decisions about you based solely on automated processing that produce legal or similarly significant effects, or carry out marketing profiling on this website. Adding analytics or advertising tools will require updating the information and obtaining user consent where required.