This is an English translation provided for convenience. In case of any discrepancy, the Polish version prevails. Wersja polska
Booklio Privacy Policy
Version 1.0, effective from 5 November 2026.
This Privacy Policy explains which personal data we process as a controller in connection with the Booklio service, for what purposes and on what legal basis, to whom we disclose them, how long we keep them and what rights data subjects have. Capitalised terms have the meaning given to them in the Terms.
1. Controller
- The controller of the personal data described in this Privacy Policy is NORDLOGIS SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, registered office: ul. Starowiejska 16/2, 81-356 Gdynia, entered in the Register of Entrepreneurs of the National Court Register (KRS) under number [KRS number: to be completed], registry court: [registry court: to be completed], NIP 5862378673, REGON [REGON: to be completed], share capital: [share capital: to be completed], e-mail: [Booklio e-mail address: to be completed] (“we” or the “Provider”).
- In personal data matters you can contact us at [data protection e-mail address: to be completed] or by post at our registered office address.
- We have not appointed a data protection officer; in all personal data matters please contact us at the address given in section 2.
2. When we are the controller and when we process data on behalf of the Client
- We are the controller of Users’ data with respect to operating their Accounts, logging in and the security of the Service, data of persons representing Clients and Clients’ contact persons, data needed for settlements with Clients, correspondence, support requests and complaints, and Service usage statistics.
- Data that the Client and the Users enter into the Service as part of their business — in particular data of the Client’s employees and drivers, business partners and their representatives, data from invoices and transfers, GPS positions and trip events, messages and recordings in conversations — are processed by us as a processor on behalf of the Client under the Data Processing Agreement. The Client is the controller of those data and matters concerning them should be addressed to the Client.
3. Purposes and legal bases of processing
| Purpose | Data | Legal basis |
|---|---|---|
| Conclusion and performance of the Agreement with the Client, including the Account of the person concluding the Agreement | first name, surname, e-mail address, telephone, company data, login data | Article 6(1)(b) GDPR; for the Client’s representatives — Article 6(1)(f) GDPR (our legitimate interest in concluding and performing the Agreement) |
| Operating the Accounts of Users designated by the Client and providing the Service | first name, surname, login, e-mail address, telephone, role, profile photo, preferences (language, appearance, list views) | Article 6(1)(f) GDPR — our and the Client’s legitimate interest in making the Service available to persons authorised by the Client |
| Security of the Service, detection of abuse, accountability | login log (time, IP address, browser), log of write operations, security events, data of devices connected to the Mobile Apps | Article 6(1)(f) GDPR and, as regards the obligations under Article 32 GDPR, Article 6(1)(c) GDPR |
| Service usage statistics (section 5) | screens opened, number of saves, minutes of active work — attributed to a person | Article 6(1)(f) GDPR — our and the Client’s legitimate interest in assessing the use and development of the Service |
| Settlements, issuing invoices, retention of tax and accounting records | identification data of the Client and its representatives, payment data | Article 6(1)(c) GDPR (tax and accounting law) |
| Correspondence, support requests, complaints, information about changes to the Service and the Terms | contact data, content of correspondence and requests | Article 6(1)(b) and (f) GDPR |
| Establishment, exercise and defence of legal claims | data necessary to prove a claim or defence, including the record of acceptance of the Terms (date, version, IP address, browser) | Article 6(1)(f) GDPR |
4. Cookies and browser storage
- The Service uses only cookies and browser storage necessary for its operation and for remembering settings. We do not use advertising cookies or third-party analytics tools.
- In particular we use:
Name / type Purpose Retention session cookie keeping the User logged in and maintaining the session until logout, at most 5 days remember_methe “Remember me” option at login up to 1 month csrfTokenprotection of forms against CSRF attacks until the end of the browser session bookliio_langremembering the interface language 1 year browser storage (localStorage) appearance and layout settings (dark mode, list columns and views, panels), screen lock after inactivity, recently used business partners and products in forms, the e-mail address and photo of the last logged-in person on the login screen until deleted in the browser browser notification subscription Windows/browser notifications about events in the Service — after consent is given in the browser until consent is withdrawn or logout - Cookie and storage settings can be changed in the browser; blocking them will prevent logging in or the use of some features.
5. Login logs and usage statistics
- We record logins (time, IP address, browser, login type) and write operations performed in the Service (who, when, which screen, IP address) for security and accountability purposes.
- We keep named Service usage statistics: the number of screens opened, saves and minutes of active work (a minute is counted when the Service tab is visible and activity has been detected in recent minutes). The statistics are available to the Client’s Service administrator and kept for 12 months. The Client informs its Users of such measurement.
6. Mobile Apps
- The Booklio Navigator and Booklio Base apps connect to an Account using a one-time code. In the database we store a hash of the device key (not the key itself), a device description, a notification token and information whether a screen lock is enabled in the app — for authentication, security and the delivery of notifications.
- The Booklio Navigator app sends the device position (coordinates, speed, heading) while the app is open and — where the Client uses this feature — in the background, only during an order shown to the driver. Location data, photographs, trip reports and messages are processed by us as a processor on behalf of the Client, who decides on the purpose and scope of monitoring and informs drivers about it.
- Notifications to phones are delivered through Google services (Firebase Cloud Messaging) and Apple services (APNs). When the app lock is enabled, the content of notifications is limited to general information.
7. AI Features
- The AI Features of the Service (reading documents and photographs, transcription and translation of speech, the voice assistant, suggestions) send the necessary content for processing by OpenAI. That content is processed to perform the given feature on behalf of the Client.
- The results of the AI Features may contain errors and require verification by the User. We do not take decisions based solely on automated processing which produce legal effects concerning persons or similarly significantly affect them (Article 22 GDPR).
8. Recipients of data
- Data may be transferred to entities processing them on our behalf, in particular: the hosting provider ([hosting provider: to be completed]), the e-mail provider ([SMTP mail provider: to be completed]), OpenAI, Google, Apple, HERE and providers of IT and accounting services — only to the extent necessary to provide their services.
- Users’ data are available to the Client that authorised them, in particular to the Client’s Service administrator (list of Accounts, login and operation logs, usage statistics).
- Data may be disclosed to public authorities where required by law.
9. Transfers of data outside the European Economic Area
Some providers (in particular OpenAI, Google and Apple) may process data in the United States. Transfers take place, where applicable, on the basis of a European Commission adequacy decision (including under the EU-U.S. Data Privacy Framework if the provider participates in it) or standard contractual clauses adopted by the European Commission. A copy of the safeguards can be obtained by contacting us.
10. Retention period
- Account data are kept for as long as the Account is used and, after its deletion or termination of the Agreement, for the period needed to export and delete data (Terms § 17) and until the limitation period for claims expires.
- Settlement documents are kept for the period required by tax and accounting law.
- Usage statistics are kept for 12 months. Login and operation logs and records of acceptance of the Terms are kept for the term of the Agreement and until the limitation period for claims expires.
- Data processed on the basis of legitimate interest are kept until an effective objection is raised, unless we demonstrate compelling legitimate grounds for further processing.
11. Rights of data subjects
- Every person has the right of access to data, rectification, erasure, restriction of processing, data portability (to the extent of Article 20 GDPR) and the right to object to processing based on legitimate interest.
- Please send requests to [data protection e-mail address: to be completed]. In matters concerning data of which the Client is the controller (section 2(2)), please contact the Client; we will forward any request we receive to it.
- Every person has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).
12. Voluntary provision of data
Providing data is voluntary but necessary to create and operate an Account and to conclude and perform the Agreement. Providing data for settlements is a statutory requirement.
13. Changes to the Privacy Policy
The Privacy Policy is versioned together with the Terms. We inform about material changes in the Service or by e-mail. Earlier versions are available in the version archive.