Politique de confidentialité

1. Data controller

The controller of the personal data processed in connection with the use of the Multiloq application (the Application), available at multiloq.com, is:

UNIT Wydawnictwo Informacje Branżowe Sp. z o. o.
ul. Ku Wiśle 7
00-707 Warszawa
NIP: 527-10-48-139
KRS: 0000030149
Sąd Rejonowy dla m. st. Warszawy w Warszawie, XIII Wydział Gospodarczy Krajowego Rejestru Sądowego
Capital social: 1 000 000,00 zł
E-mail: bok@multiloq.com

For matters relating to the protection of personal data, you may contact us at the e-mail address given above.

2. What data we process and on what basis

In addition, if you consent to analytics cookies, we process data on your use of the website (Google Analytics 4) on the basis of Art. 6(1)(a) GDPR — details in section 10.

Providing the data is voluntary but necessary in order to use the Application.

3. Data retrieved from your Google account (Google Business Profile)

Once a Google account is connected, the Application obtains access within the following permission (scope):

https://www.googleapis.com/auth/business.manage

Within this permission we retrieve and process solely:

• the list of accounts and locations linked to the connected Google account — name, address, city, website address and the location identifier in the API,
• the identifiers and statuses of posts created by the Application (including PROCESSING, LIVE, REJECTED),
• the access and refresh tokens required to perform operations on your behalf.

We use this data solely to provide the features of the Application, that is, to publish the content you have prepared on the locations you select and to report the status of those publications.

We expressly state that data obtained from Google APIs is not:

• sold or shared with third parties for marketing purposes,
• used to display advertising or to build advertising profiles,
• used to train artificial intelligence models or generalised models,
• shared with data brokers or analytics companies.

Access to this data is limited to authorised staff of the Operator, to the extent necessary for the maintenance and technical support of the Application.

4. Compliance with Google's policies (Limited Use)

Multiloq's use of information received from Google APIs, and its transfer of that information, adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Multiloq's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Revoking access to your Google account

You may disconnect your Google account from the Application at any time:

• in the Multiloq panel — with the Disconnect Google account button on the Locations screen (available to the Organisation administrator), or
• directly in Google, at myaccount.google.com/permissions.

When you disconnect in the panel, we revoke the grant at Google and promptly delete the stored tokens. When you revoke consent on Google's side, the tokens become invalid immediately and we delete them from our database without undue delay — upon the Application's next attempt to use them. In both cases the Application loses the ability to perform any operations on your locations. Posts published earlier remain in Google — you can manage them directly in Google Business Profile.

6. Data recipients

Data may be entrusted to processors acting on our instructions, under data processing agreements:

• server infrastructure providers (hosting),
• the accounting office.

Separate data controllers, to whom data is disclosed to the extent necessary to provide their services, are:

• Google LLC / Google Ireland Limited — for the operation of the Google Business Profile integration,
• payment operators (once paid plans launch) — when processing a payment, they act under their own rules, including payment-services regulations.

We do not sell personal data and we do not share it with third parties for marketing purposes.

7. Transfers outside the EEA

Data is processed on servers within the European Union. Any transfer of data outside the European Economic Area may take place solely to the extent arising from the use of Google's services, and is based on the standard contractual clauses approved by the European Commission.

8. Retention period and data deletion

• Account data is retained for the duration of the agreement and for 30 days after it ends (a window for possible account restoration).
• Data retrieved from Google Business Profile (the list of locations, post statuses) is retained for the duration of the agreement and deleted together with the account data — or earlier, upon request.
• Google tokens are deleted promptly after the Google account is disconnected, after consent is revoked on Google's side (upon the next attempt to use them) or after the account in the Application is closed.
• The event log is retained for up to 12 months.
• Billing data is retained for the period required by tax law (as a rule, 5 years).

To request earlier deletion of your data, write to the e-mail address given in section 1. We fulfil such requests without undue delay, no later than within 30 days, except for data we are required to retain under the law.

9. Your rights

You have the right to: access your data, rectify it, erase it, restrict its processing, data portability, object to processing based on legitimate interest, and withdraw consent at any time (without affecting the lawfulness of processing carried out before the withdrawal).

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.

10. Cookies

Strictly necessary (no consent required)

These files are required for the service to work, which is why they do not require consent:

Analytics (only with your consent)

We use Google Analytics 4 to understand how visitors use the site and what to improve. The Google Analytics script is not loaded until you give consent in the banner — before consent, no analytics file is created.

The tool is provided by Google Ireland Limited. Statistical data is collected in aggregate form and is not used for advertising or profiling; we use Google Consent Mode. The legal basis is your consent — Art. 6(1)(a) GDPR.

You may withdraw your consent at any time — click Cookie settings in the site footer and switch off the analytics category (existing analytics cookies are then removed), or delete this site's cookies in your browser settings — the banner will reappear. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

11. Security

We apply technical and organisational measures appropriate to the risk, in particular: encryption of transmission (HTTPS/TLS), storage of passwords solely as cryptographic hashes, role-based access control, separation of the data of individual organisations, and recording of operations in an event log.

12. No automated decision-making

We do not take decisions in relation to you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.

13. Changes to this Policy

We will give at least 14 days' notice of material changes to this Policy — by e-mail or through a message in the Application. The current version is always available at this address, together with the date of the last update.