Privacy Policy

Effective from 2026-10-10

This is a translation. In case of any discrepancy, the Polish version prevails.

This policy explains how Volun3 processes personal data. It is the information required by Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, GDPR; in Polish: RODO). It also covers cookies.

1. Controller and contact

The service is provided by Szymon Haponiuk, a natural person carrying out unregistered activity (działalność nierejestrowana) in Poland, address: ul. Rydygiera 13/37, 01-793 Warszawa, Polska, email: shaponiuk@volun3.com (the “Provider”). The Provider has not appointed a data protection officer; write to the email address above about anything concerning personal data.

2. Two roles: controller and processor

The service is used by organisations (e.g. communities, associations, volunteer teams) that plan their members' schedules in it. The Provider therefore acts in two roles:

• The organisation is the controller of the data its admins enter about members and volunteers (people, roles, categories, events, assignments, availability, logins created for members). The Provider processes that data only on the organisation's behalf, as a processor, under the data-processing agreement annexed to the Terms of Use. Questions and requests about that data (e.g. to correct or erase it) should go to your organisation first; the Provider will help it handle them.
• The Provider is the controller of the data needed to provide and secure the service itself: the data of the person who creates an organisation, login data (to the extent needed to conclude and perform the service agreement), technical and security logs, message delivery data and correspondence sent to the Provider.

3. What data we process

• Login account: email address (used to sign in) and whether it has been confirmed, a hash of the password — never the password itself, chosen language, stay-signed-in setting, admin permissions, date and version of the accepted Terms.
• A person in an organisation: first name, last name, email address, category memberships and competencies (roles), active status.
• Schedule data: availability given for events with an optional note, role assignments, assignment confirmations.
• Technical data: the secret calendar address (token), one-time links (invites, password resets, email confirmations — stored as random tokens or their hashes), counters that limit sign-in and sign-up attempts (stored as irreversible hashes of the IP address or identifier, never the address itself), content and recipient of messages waiting to be sent.
• Correspondence sent to the Provider (e.g. complaints, GDPR requests).

The service is not meant for special categories of data (Article 9 GDPR). Organisations should not enter such data, e.g. in notes or event descriptions.

4. Purposes and legal bases (where the Provider is the controller)

Purpose	Legal basis
Creating the account and organisation, providing the service, sending the messages needed to use it (address confirmation, password reset, invites, service announcements such as planned maintenance)	Art. 6(1)(b) GDPR — performance of the agreement for services provided electronically
Security of the service: protection against abuse and attacks (sign-in attempt limits, technical logs)	Art. 6(1)(f) GDPR — the Provider's legitimate interest
Handling complaints and requests, contact with users	Art. 6(1)(b), (c) and (f) GDPR
Establishing, exercising and defending legal claims	Art. 6(1)(f) GDPR

Data entered by an organisation is processed for the purposes and on the legal bases determined by that organisation as controller.

5. Recipients

Data is never sold or shared for marketing. It may be received by:

• OVH SAS (Roubaix, France) — provider of the servers the service and its database run on, and of the email service the app sends messages through; data is processed on servers in the European Union;
• calendar services (e.g. Google Calendar, Outlook, Apple Calendar) that fetch a person's calendar — only when that person adds their calendar address to them; those providers process the data under their own terms;
• admins of the organisation a person belongs to, for that organisation's data;
• signed-in members of an organisation, who see the name and email address of that organisation's admins on the Support page, so they know whom to ask for help;
• public authorities, where the law requires the data to be disclosed.

6. Transfers outside the European Economic Area

The Provider does not transfer data outside the European Economic Area. If a person adds their calendar to a service outside the EEA, that happens at their own request.

7. How long we keep data

• Login data — until the login is deleted (by you in your settings, or by the organisation) or the whole organisation is deleted.
• A person's data in an organisation — until you delete your account together with your data in your settings, the organisation deletes the person, or the whole organisation is deleted. The Provider keeps no backups, so deletion is final.
• Email messages — the content is erased from the database when the message is sent; the recipient, subject and delivery status are kept for 14 days and then deleted.
• Attempt-limit counters (hashes of IP addresses and identifiers) — up to 24 hours.
• One-time links — valid for 1 hour (password reset) or 7 days (email confirmation); an invite — until it is used or the organisation deletes it.
• Server technical logs (IP address, time and address of the request), if kept — up to 30 days.
• Correspondence and data needed to defend claims — until the limitation periods expire.

8. Your rights

You have the right to access your data and receive a copy (Article 15 GDPR), to rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and to object to processing based on legitimate interest (Article 21). You can change your first name, last name, language and password yourself in your account settings. There, under “Your data”, you can also download a copy of your data (a JSON file) and delete your account: either together with your personal data (your profile, availability and assignments are erased at once and your organisation's admins are told, so they can replace you in upcoming events), or only your login, leaving your organisation's record of you in place. Send any other request to shaponiuk@volun3.com — we will reply within one month. If the request concerns data your organisation controls, we will pass it on and help the organisation handle it.

9. Complaint to the supervisory authority

You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl) if you believe the processing of your data infringes the GDPR.

10. Is providing data mandatory?

Providing data is voluntary, but without an email address and a password you cannot create an account or use the service.

11. Automated decisions

The service makes no decisions with legal effects based solely on automated processing and does not profile users. Schedule hints (e.g. who is available) only assist the organisation's admin, who decides on assignments.

12. Security

Measures include: encrypted connections (HTTPS), passwords stored only as cryptographic hashes, a strong-password requirement, sign-in attempt limits, protection against CSRF and XSS attacks, separation of each organisation's data, a Provider admin panel reachable only locally through an encrypted tunnel, and data minimisation (e.g. erasing message content once sent).

13. Cookies and browser storage

The service uses only cookies and browser storage that are strictly necessary for the service or that remember settings you choose yourself. We use no analytics or advertising cookies and no third-party tracking tools, and fonts and scripts are served from our own server. Such storage does not require consent (Article 399(3) of the Polish Electronic Communications Law); you can delete or block it in your browser settings, but signing in will then stop working.

Name	Type	Purpose	Lifetime
session	cookie	keeps you signed in, protects forms against CSRF attacks	until the browser is closed
remember_token	cookie	keeps you signed in after the browser is closed	30 days by default
kch-theme	local storage	chosen theme (light/dark)	until deleted
kch_grid_density	local storage	schedule layout (compact/comfortable)	until deleted
kch_collapsed_cats	local storage	collapsed categories in the schedule	until deleted

The app installed on your home screen (PWA) caches only style sheets, scripts and icons in the browser — none of your data.

14. Changes to this policy

We will announce material changes to this policy in the service in advance. The current version is always available at /privacy.