Privacy Policy

1. General information

This Privacy Policy describes how personal data of clients and visitors of WCOB.pl ("Service", "Platform") is processed. WCOB.pl is a B2B platform for marketing agencies, SEO agencies, in-house teams and businesses, providing advertising services across a network of more than 1,000 local web portals in Poland.

Contact for data protection matters: bok@wcob.pl · phone +48 792 599 999 (Mon-Fri 9:00-17:00 CET). The controller has not appointed a Data Protection Officer (art. 37 GDPR); please contact the controller directly.

Personal data is processed in accordance with Regulation (EU) 2016/679 (GDPR) and the Polish Personal Data Protection Act of 10 May 2018.

2. Categories of data we process

2.1. Client account data

• e-mail address (login),
• password, stored only as a bcrypt hash (we never know the plain password),
• first and last name (optional), phone number (SMS verification and support contact),
• Google identifier when signing in with Google (OAuth 2.0): e-mail and basic profile only,
• panel language preference (PL/EN).

2.2. Invoicing data

Company name or full name, VAT ID (NIP), registered address, invoicing e-mail. For Polish companies the name and address are retrieved from the Ministry of Finance VAT register on the basis of the VAT ID.

2.3. Data of end clients managed by agencies

An agency client may enter data of third-party businesses (end clients) in order to deliver the ordered services. In that case the agency is the controller of the end client's data and WCOB acts as a processor (art. 28 GDPR). Such data may include: company name and registration numbers, address, contact details (phone, e-mail, website), opening hours, categories and descriptions, photos, logos and banners, geographic coordinates, social media links. The detailed terms of processing on behalf of the agency (subject matter, duration, nature and purpose, types of data, categories of data subjects, obligations of the parties, sub-processors, audits, return and deletion of data) are set out in Annex 1 to the Terms of Service - Data Processing Agreement, concluded upon acceptance of the Terms. The list of sub-processors is in section 5 of this Policy.

2.4. Data from Google Places

When a listing is imported from Google Maps we retrieve the Place ID, rating, number of reviews and review texts (optionally used by the client to generate descriptions with the AI assistant).

2.5. Technical data and logs

IP address, HTTP headers (User-Agent, Referer), timestamps of logins, panel actions and wallet transactions, failed login attempts (rate limiting: 5 attempts per 15 minutes per IP) and audit logs of administrator impersonation used for technical support.

2.6. Payment data

Full card or bank account details are never stored by WCOB. Payments are handled exclusively by the payment operator Tpay (Krajowy Integrator Płatności S.A.). We receive only a payment confirmation and transaction identifier.

2.7. Loyalty programme data

Lifetime spend aggregated per VAT ID across the WCOB ecosystem, the client's rank, rank history and discount logs. Accounts sharing the same VAT ID across our brands are treated as one client for rank purposes (necessary for performance of the contract).

2.8. Partner (affiliate) programme data

Partner code and link, verified company data (KYC), anonymised click statistics (timestamp, country/region, UTM source), identifiers of referred clients (shown to the partner only in anonymised form), commission and payout history. The attribution cookie is valid for 90 days (see section 9).

2.9. Analytics and marketing data (cookies)

Analytics and marketing cookies are loaded only after consent (Google Consent Mode v2). See section 9.

2.10. Data from connected external channels (Google Business Profile, Facebook, Instagram)

A client using the visibility care service may voluntarily connect their Google Business Profile, Facebook Page and linked Instagram account to the panel. The connection is made only through the provider's official authorisation (OAuth 2.0); WCOB never receives the client's passwords. We process:

• the identifier and name of the Google listing / Facebook Page / Instagram account selected by the client,
• access tokens issued by the provider, stored encrypted (AES-256-GCM) and used solely to publish content ordered by the client,
• public comments under posts published on the client's Page or account (text, author name, date), only to prepare reply suggestions that the client approves in the panel before they are sent,
• post and page statistics made available by the provider (reach, impressions, reactions, clicks) for the client's reports,
• identifiers and URLs of published posts (shown to the client in the panel and reports).

We publish in connected channels only content planned as part of the care service and visible to the client in the panel. We do not read private messages or friend lists. Data of other platform users is processed only to the extent of public comments under the client's posts and is not combined with any other data. The client may disconnect a channel at any time in the panel (tokens are then permanently deleted) or revoke access directly with the provider (Google: myaccount.google.com/permissions; Facebook: Settings → Business Integrations). Tokens are deleted when a channel is disconnected, when they expire at the provider, or when the care service ends.

Use of data received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Use of Meta platform data complies with the Meta Platform Terms.

2.11. Purchases without an account and contact forms

Domains and Publication Packages can be purchased without prior registration. We then process: e-mail address, invoicing data (VAT ID with company name and address from the VAT register, or the full name of a private individual), IP address and order timestamp, Tpay transaction identifier. After payment an account is created for the e-mail address given (password set-up link valid for 7 days) or the purchase is assigned to an existing account with that e-mail. Matching is done by e-mail only, never by VAT ID.

Quote and contact forms (city advertising pages at wcob.pl/reklama, domain price proposals, the care service page) store: name or company name, phone, e-mail, subject and message, IP address and the source of the enquiry. Enquiries go to the controller's internal contact register (CRM) and are used only to answer the enquiry and prepare an offer.

2.12. Data processed with AI tools

At the client's request (content assistant, image generation, comment reply suggestions, the care service) content entered by the client and public data about the client's business (name, offer, reviews, website) are sent to AI model providers: Anthropic, PBC (Claude) and OpenAI, L.L.C. (GPT and image models). Under their commercial API terms these providers do not use the data to train models. We never send login data, payment data or personal data of other users to AI, except the text of public comments the client wants to reply to.

2.13. Form protection data

The registration form is protected by Google reCAPTCHA v3, which analyses technical browser signals (IP address, behaviour, Google cookies) to distinguish humans from bots. Google's Privacy Policy and Terms of Service apply.

3. Purposes and legal bases

4. Publication of business data in the portal network

Business data (of the client or end client) contained in NAP listings, classifieds, banners and sponsored articles is by nature public. By publishing such content the client agrees to its display on WCOB.pl and the portals of the network, indexing by search engines, archiving of public resources (Wayback Machine, Common Crawl) and use in quotations and summaries by AI models. The client may edit or delete the data at any time in the panel; search engine caches may keep it for several weeks.

5. Recipients of data (processors)

• Hosting and infrastructure - the hosting operator of the Service (currently CyberFolks / Cyber Folks S.A.);
• Payment operator - Krajowy Integrator Płatności S.A. (Tpay), Poznań, Poland;
• Google LLC - Google Sign-In, Google Places API, Google Business Profile API, Google reCAPTCHA v3, Google Analytics 4, Google Tag Manager (USA);
• Meta Platforms Ireland Ltd. - Graph API (Facebook Login for Business, publishing and reading comments on the client's connected Page / Instagram account);
• SMSAPI.pl - LINK Mobility Poland sp. z o.o. (SMS phone verification);
• Anthropic, PBC - Claude API (USA) and OpenAI, L.L.C. - GPT and image models (USA): only for content, images and reply suggestions ordered by the client; no training on client data;
• Fakturownia Sp. z o.o. (fakturownia.pl) - electronic VAT invoices;
• ConsentGuards - cookie consent management (operated by the controller);
• Ministry of Finance VAT register - verification of VAT ID and retrieval of company data (only the VAT ID is sent);
• Aftermarket.pl - domain registry where purchased domains are transferred (cession) to the buyer; buyer data required for the transfer (name, address, e-mail) is passed on;
• WCOB ecosystem companies - WizytowkiFirmowe.pl and MarketingHotelowy.pl (Single Sign-On and lifetime spend aggregation per VAT ID);
• Portal network - operators of the portals (the controller or affiliated companies) to the extent necessary to publish listings, classifieds and articles;
• Legal and accounting advisers - under confidentiality and only to the extent necessary;
• Public authorities - only where required by law.

We do not sell, rent or share personal data with third parties for their marketing purposes.

6. Transfers outside the EEA

Using the services of Google LLC, Anthropic, PBC, OpenAI, L.L.C. and Meta Platforms may involve transfers of data to the United States, based on the EU-US Data Privacy Framework (adequacy decision of 10 July 2023, where the recipient is certified) or the Standard Contractual Clauses approved by the European Commission (decision 2021/914), with supplementary measures (encryption in transit and at rest, access control). A copy of the relevant safeguards can be requested at bok@wcob.pl.

7. Retention periods

8. Your rights

You have the right of access to your data and to obtain a copy, the right to rectification, erasure ("right to be forgotten"), restriction of processing, data portability, the right to object, the right to withdraw consent at any time, and the right to lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl). Many actions can be performed directly in the client panel (editing data, disconnecting channels). For other requests contact bok@wcob.pl.

Data and account deletion: a step-by-step guide, including how to disconnect Facebook, Instagram and Google and how to request deletion of data obtained from these platforms, is available at wcob.pl/data-deletion. Requests are fulfilled within 30 days, except for data we must keep by law (invoices, accounting records).

9. Cookies

The Service uses cookies: necessary (PHP session, login, CSRF token, cookie banner choice, panel language; session or up to 7 days; no consent required), functional (user preferences; up to 30 days; consent), the partner attribution cookie (set at the user's explicit request, i.e. after clicking a partner link with ?ref=; contains only the partner identifier; 90 days, the current period is published in the Partner Programme rules; strictly necessary to provide the requested service of assigning the user to the partner under art. 399(3) of the Electronic Communications Law, therefore no separate consent is required; not used for tracking or profiling and not shared with third parties), analytics (Google Analytics 4 with Consent Mode v2; up to 14 months; consent) and marketing cookies (remarketing and conversion tracking, if active; up to 90 days; consent). You can manage cookies in your browser settings.

10. External tools and services

• Google Analytics 4 (Consent Mode v2) - traffic analysis with anonymised IP; loaded only after consent; data kept up to 14 months.
• Google Sign-In (OAuth 2.0) - login with a Google account; we receive only the e-mail, Google identifier and basic profile; never the Google password.
• Google Places API - retrieval of business data (Place ID, ratings, reviews, location) from Google Maps at the client's request, under the Google Maps Platform licence.
• Google Business Profile API - publishing posts and photos in the Google listing the client has connected as part of the care service (scope: business profile management). Access can be revoked in the panel or at myaccount.google.com/permissions.
• Meta Platforms (Facebook, Instagram) - publishing posts, reading public comments under the client's posts to suggest replies, and reading post statistics on the Facebook Page and Instagram account the client has connected (Facebook Login for Business, Graph API). Access can be revoked in the panel or in Facebook Settings → Business Integrations.
• Tpay - online payments (bank transfers, BLIK, cards); full card or account data never reaches WCOB.
• SMSAPI.pl - verification SMS messages; the phone number and code are passed only during verification.
• Anthropic / Claude API and OpenAI API - optional AI assistant for content, images, content review and reply suggestions; prompts and content entered by the client are sent to the provider (USA); the providers do not use the data to train models; the client decides what to send.
• Google reCAPTCHA v3 - protection of the registration form against bots; Google analyses browser signals and returns a risk score only.
• ConsentGuards - cookie consent management; the consent state is stored in a cookie in the browser.
• Fakturownia - electronic VAT invoices; invoicing data and amount are passed on.
• Ministry of Finance VAT register - verification of active VAT status and retrieval of company name and address by VAT ID (only the VAT ID is sent); necessary for KYC and invoicing (art. 6(1)(c) GDPR).
• Aftermarket.pl - domain registry in which purchased domains are transferred to the buyer.
• WCOB ecosystem - one account shared between WCOB.pl, WizytowkiFirmowe.pl and MarketingHotelowy.pl (Single Sign-On): login data, company data and lifetime spend are processed jointly; one account, one wallet and one rank across the ecosystem.

11. Data security

HTTPS/TLS 1.2+ for all traffic (HSTS), bcrypt password hashing, encrypted backups, database access restricted to required IP addresses, role-based access, separated environments, prepared statements, CSRF tokens, security headers, rate limiting, audit logs of administrative actions, daily backups with 30-day retention, regular software updates and code security reviews, secrets kept outside the public directory, masking of e-mails, phones and VAT IDs in system logs, and AES-256-GCM encryption of access tokens of connected channels.

12. Data breaches

In the event of a personal data breach likely to result in a risk to individuals, the controller notifies the Polish supervisory authority within 72 hours (art. 33 GDPR), informs the affected individuals if the risk is high (art. 34 GDPR) and takes remedial and preventive measures.

13. Final provisions

This Policy may be updated when the law, the structure of the services, external tools or the infrastructure change. A new version is published on the Service (privacy policy page with version history) at least 14 days before it takes effect, with the effective date and the scope of changes; clients are additionally informed of material changes by e-mail or a notice in the panel, and consumers by e-mail. The current Polish version is always available at wcob.pl/polityka-prywatnosci and this English version at wcob.pl/privacy-policy. Polish law applies to matters not covered here.