1. Controllers, shared account, and scope of the Policy

The policy describes the processing of data of candidates, drivers, couriers, recommenders, clients, and individuals contacting us. It concerns the sites mbpartners.pl and ontimetaxi.pl, portals kierowca.mbpartners.pl and portal.ontimetaxi.pl and MB Partner and On Time Taxi's own mobile applications on Android and iOS. The transport and delivery platforms you cooperate with have their own privacy information.

1. MB PARTNER MARCIN BOHDANOWICZ, ul. Rewolucji 1905 r. 82, 6, 90-223 Łódź, NIP 8882894528, REGON 361683930, contact: kontakt@mbpartners.pl, is the data controller of its own account and its own collaboration processes, agreements, settlements, taxes, insurance, license services, and claims.
2. ON TIME TAXI LIMITED LIABILITY COMPANYul. Nad Rzeką 2, 26-067 Chełmce, KRS 0001060100, NIP 9592065735, REGON 526477901, contact: kontakt@ontimetaxi.plis the data controller concerning its own contracts, fleet and platform account, promotions, receivables, damages, taxes, carrier obligations, and claims.
3. The document or activity administrator is the entity conducting the specific process. Check the contract page, promotion organizer, or information provided with a given service. Both companies can enter into their own contracts; using the OTT brand does not automatically transfer all MB payer obligations to OTT.
4. MB PARTNER operates a shared CRM infrastructure, API, and technical account support, decides on onboarding and verification within the processes it supports, and coordinates privacy matters. The account and password are shared; each app can have a separate session, phone registration, and push setting. Logging into another portal does not create a second account nor by itself a new purpose for data utilization.
5. MB technically and accounting handles OTT-commissioned processes as a processor on its documented instruction. OTT conducts its own fleet, rental, and promotion processes. Necessary data for each company's own settlement, damage, or obligation may be transferred between separate controllers. For each activity, we distinguish the controller's own purpose from commissioned support; CRM ownership and contract name do not determine all roles.
6. OTT is serviced by persons employed at MB PARTNER, who also handle MB matters and have access to the entire shared CRM; access is not limited to OTT services only. For MB matters, they act within their assigned tasks, and for OTT's commissioned processes, MB acts on its documented instruction. Access to the entire database does not entitle one to use it for any purpose; health documentation, criminal records, and legalization require proper authorization and protection scope. Delegation between companies and the authorization of a specific employee are separate elements of this process.
7. MB PARTNERS CARS SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄul. Nad Rzeką 2, 26-067 Chełmce, KRS 0001034777, NIP 9592062151, may appear as the app publisher in the App Store. According to the accepted scope, this corresponds to app publication, without access for this company to driver data. The publisher’s name in the store itself does not change the administrator of your contract or documentation.
8. A data protection officer has not been appointed. Privacy matters are coordinated by MB PARTNER at the above address. You can also contact OTT directly regarding its processes.

2. Sources and categories of data

We receive data from you upon notification, registration, document submission, contract conclusion, order, contact, or use of services. For the given process, we also receive data from transport and delivery platforms, from the second controller MB/OTT, payment and delivery operators, authorized bodies, and public registers. Data not obtained directly from you include, among others, results and activity on the platform, settlements, vehicle data, and information needed to service a specific contract. Information on the appropriate source and scope is available during the process or upon your request.

• Identification and contact data: name, surname, date of birth, PESEL or appropriate identifier, nationality, address, phone, email, and city.
• Account, notification, contract, and cooperation status data; signatures and confirmations, history of changes relevant to service, data of recommending and recommended persons.
• Settlement data: bank account, revenue and remuneration, assignment duration, contributions, taxes, PPK, invoices, balance, fees, deposits, receivables, and payments. In the given function, also fuel card and transaction data.
• Identity documents, driving license, permissions, and licensing documentation; vehicle data, policies, rental or lending, reservations, damage, and return. The scope of documents depends on the service performed.
• Documents confirming student status or insurance, parental/guardian consent for appropriate actions, and documents of residence and legal employment delegation for a foreigner.
• In the TAXI process: required medical and psychological certificates on the existence or absence of contraindications and criminal record documents as permitted by law. We do not need full diagnoses, raw test results, or treatment histories for regular account management.
• Activity and settlement data received from platforms: orders, acceptances, and cancellations, revenues, and indicators used for performance presentation, cooperation conditions handling, or fraud clarification.
• Content of contacts, reports, and complaints, communication metadata, and call recordings if the call is recorded and you have been informed in advance.
• A pseudonymous User-ID linked to the account — if the GA4 measurement is implemented and you consent to analytics; the scope is described in section 12.

Mobile applications and technical data

Applications provide account, documents, contracts, settlements, invoices, payments, fuel cards, reservations, fleet, commands, and appropriate promotions. MB Partner also includes thermal bag orders; OTT includes activity and program condition summaries. Access to a particular function depends on permissions and actual account data.

We process session and login information, IP address, request technical data, language, and trusted device identifier. For push notifications additionally: installation identifier in our system, FCM token, app brand, platform, notification permission, registration activity, message title and content, and delivery attempt result. The custom installation identifier differs from the Firebase Installation ID (FID) processed by Google.

You activate the camera to take a photo of a document. Alternatively, you can select an existing file. The app sends chosen files, not the entire gallery. In the described scope, it does not use the phone's GPS, contact book, microphone, or biometric login. Platform data may include city and transport activity information, regardless of phone permissions.

On Android, Google SMS User Consent can complete the login code from a single SMS with your one-time permission. It does not grant access to SMS history. You can refuse and enter the code manually. The current attempt listening lasts up to 5 minutes; this is not the log retention period on the server side.

3. Purposes and legal bases of processing

The indicated basis applies to a specific purpose and controller. We do not apply all bases interchangeably to each piece of information. The bases from Art. 6 of GDPR do not replace additional health, criminality, or device information access requirements.

Documents are not assigned to a single contract. Cooperation documentation is protected by any active contract; its retention period starts after the latest termination of all contracts. A regular copy of an identity document, selfie, and partner change screenshot have separate short terms from the end of verification or partner change, even with an active contract. A foreigner's identity document required for work legalization has its own rule. Dates are calculated on an ongoing basis considering separate obligations and blocks of specific matters.

4. Voluntariness of providing data

Providing data upon application is voluntary, but lack of data necessary for contact or verification may prevent service. Data indicated as necessary for entering or performing a contract, settlements, or fulfilling a specific legal obligation are required in this process. We indicate its purpose at the field or document; you should not send more documentation than required.

Refusal of marketing, optional push, analytics, or camera does not block the basic functions of the account. Refusal of the camera allows you to select an existing file. We currently do not run a separate newsletter; information sent via email/SMS may, however, have a marketing purpose, depending on the content.

In some courier services, collaboration with a person from 16 years of age is considered in accordance with the requirements of the specific service, law, and platform. Parent/guardian consent for an action regarding a contract is separate from consent for optional data processing. It does not mean allowing a minor to perform TAXI services or the right to collect all documents of an adult driver. We limit guardian data to the needs of proving authorization and the required consent for the action.

5. Data recipients

The scope of sharing depends on the purpose. Staff receives data necessary for the assigned task, and an external recipient — the scope relevant for the service. An entity acting on our behalf requires appropriate entrustment conditions; other recipients may process data as separate controllers.

Enova is a local HR and accounting database. The mere use of the software does not mean transferring the database to its producer. Paper documents remaining in accounting have limited access and a period appropriate for their category. Airtable is currently not used according to the owner's declaration; the scope of historical records, attachments, and copies needs to be explained separately.

6. Data transfer outside the European Economic Area

Our VPS cyber_Folks is located in Gdańsk, Poland, according to the confirmed organizational configuration. This does not mean that all data with Google, Apple, OpenAI, and other recipients remain in Poland or the EEA. Transfer outside the EEA may also result from remote access or further processing, regardless of the main database location.

Firebase Cloud Messaging operates on Google’s global infrastructure. The appropriate locations and security of external services depend on the actual agreement and configuration. Information about specific transfers and a copy of the applicable safeguards can be obtained from MB PARTNER's contact address.

7. Document retention and retention period

We determine the period separately for the document, purpose, controller, and payer. Contract termination, document expiration, account lock, removal of operational data, and archive deletion are different events. We do not apply a single rule "5 years after any contract" or "a year without logging in" to all person's data.

In our process for an order that constitutes the basis for insurance, the date of reporting to ZUS corresponds to the day of signing the appropriate contract. We establish the first appropriate order in the history of a given payer. This does not change statutory events initiating the retention of ZUS reports and pension-insurance evidence described below.

If a document is actually needed for several purposes, it remains until the end of the longest appropriate obligation; unnecessary scope is subject to limitation. Active cooperation protects the necessary documentation of this cooperation; after the termination of all contracts, its organizational period is counted from the latest end. A new agreement does not replace statutory dates applicable to other evidence, such as tax, ZUS report, or confirmation of hours.

Phone registrations and push history — accepted schedule of new releases

Registration without authenticated activity of the given installation for 30 days does not qualify for new dispatch and is directed for deletion in the next push cycle. The push deletion process is scheduled twice daily; with an operating schedule and effective processing of all overdue batches, the accepted execution time is up to the next 24 hours. Error or backlog requires repetition and is not marked as executed deletion. Dispatch attempt, employee action, and cron do not renew activity. Upon disconnection, we immediately stop qualification for new dispatches; disconnected or revoked registration is cleared after 30 days from the first disconnection, with the same execution rule. A new valid registration may reactivate its record.

We store push content and attempts for 6 calendar months from message creation; after this limit, the message is not made available in operational history and, along with attempts, is deleted in the next push cycle, under the execution rules described above. A deletion request includes superfluous data earlier. These are internal periods of our system, separate from Firebase, APNs, and copy rules.

Archive, derivatives, and backups

The system calculates the document retention period on an ongoing basis based on its type and the relevant event. We do not assign cooperation documentation to a single contract: an active contract protects this documentation, and its period runs after the completion of all contracts. A regular copy of identity, selfie, and partner change capture have separate short terms described in the table, even during active cooperation; a foreigner's document has its own legalization rule. The Chief Accountant is responsible for accounting and social security documentation, the Taxi License Administrator for license documents, and the Database Administrator for the technical execution and recording of deletion. Employees clarify deficiencies and handle justified exceptions and blocks. Once launched, the retention task deletes documents after the appropriate period and rechecking of current sources, blocks, and managed copies; reading or publishing the policy is not proof of deletion execution.

For each file, we indicate the starting event, the last day of storage "until," and separately the "deletion from" date — the next calendar day. For example, for verification completed 11.10.2026, a regular copy of an identity document has the last day 10.11.2026 and is subject to deletion from 11.11.2026; for selfie verified 11.10.2026 these are respectively 18.10.2026 and 19.10.2026. Deletion of managed copies occurs in the nearest retention task cycle after the last day when the document is qualified, has no block, and the operation ends successfully. An error requires repetition; the passing of the date is not confirmation of deletion. During ongoing appropriate cooperation or matter, the date dependent on its completion is not yet known; the lack of end of another unrelated contract does not extend this document. We do not re-provide the file after its successful deletion from current systems.

CyberStorage is the primary document storage space, without its own backup according to the adopted configuration; it is not a short-term safety copy. Every file, version, thumbnail, and confirmed export require an appropriate term for the data. A retained identifying PDF remains personal data even after the name is removed from the profile or affiliations are pseudonymized.

The server backup has a declared rotation of 28 days. Data deleted from the current system may remain in the copy until it expires; copies serve for emergency recovery and have limited access. After restoration, deletions and objections must be reapplied before resuming regular use. The rotation of this backup does not determine the document retention in CyberStorage or all copies with external providers.

After the cessation of all appropriate purposes, we delete or genuinely anonymize the data. A hash, hiding in the interface, or removing just the first name does not guarantee anonymity. During further statutory retention, we limit use and access to the appropriate purpose.

8. Hosting, security, and data on the phone

The system uses HTTPS, session control and permissions, and account and audit security. Access to the archive, health documents, and criminal records should be granted to individuals who need it for a specific duty. Passwords, SMS codes, or complete documents should not be sent through channels that do not require them to handle the case.

In applications, session tokens and trusted device secrets are stored in a secured system storage. Language and instruction preferences also remain, and when the push function is used, the channel setting and unique installation identifier. Logging out removes local session tokens and main account data from memory; it is not confirmation of the deletion of every preference, cache, or file saved by you outside the application space.

An access token is valid for 24 hours, a refresh token for 30 days with rotation upon renewal, an SMS login code for 10 minutes, and device trust for 180 days. These are the validity periods of permissions, separate from the record and log retention period. Revocation or expiration is to prevent further use of the credential.

Optional operational notifications

The new releases have a push channel that can be turned on and off separately in each application and on each phone. Refusal does not block documents and settlements in the application or portal. The channel serves information about your account, document, or settlement. We do not plan advertising, new offers, or marketing through push; the setting is not a marketing consent.

Google receives a delivery token, title, content, and technical identifiers of the message; on iOS, Apple APNs are involved in delivery. The notification may be visible on the lock screen. Details requiring protection should be read after logging in; the message should be general, e.g., "A new settlement is available. Check the app," without PESEL, diagnoses, criminal record information, and confidential amounts.

We do not plan to measure our own push opens or clicks. The technical history distinguishes between acceptance of the request by FCM, error, and omission; acceptance by the provider does not prove delivery or reading. Technical service data at Google may exist despite the lack of our own analytics for opens.

Disabling the channel is intended to stop new shipments after receiving this information. An operation performed offline may only reach after connection; a message already passed to the provider cannot be equated with a new sending after disconnection. Removing registration in CRM or the FCM token is not automatically the removal of the Firebase Installation ID. Google describes data phasing out after a successful request to delete the FID from current and backup systems within 180 days; this is the provider's period upon request, separate from our 30 days and 6 months.

9. Cookies and similar technologies

Cookies store information in the browser; similar functions may be served by local storage, tags, pixels, and identifiers. The mechanism distinguishes necessary and security categories, functional, analytical, and marketing. Optional categories require a proper choice. A session or privacy choice cookie is not consent for advertising.

The scope of tools depends on the site. The confirmed organizational scope includes GA4, Google Ads, and Meta on mbpartners.pl and ontimetaxi.pl. We do not automatically extend it to all portals or application screens. Moving from the application to the site or WebView means using the mechanisms of that site; it does not mean the operation of a web pixel on every native screen.

10. Consent panel and Consent Mode

The "Cookie Settings" panel allows for a separate functional, analytical, and marketing choice, rejection of optional categories, and later change. In the described portal mechanism, the choice is remembered in a host-only cookie mbpartner_cookie_consent for 180 days or until removal/change of the appropriate version of the information. Host-only applies to a specific host, so the choice is not automatically made available to all subdomains.

For Google, the analytical choice controls analytics_storage, and the marketing choice controls ad_storage, ad_user_data, and ad_personalization. The default state before choice is denied. Tags from other providers require their own appropriate activation conditions; merely including Consent Mode does not control all external scripts.

Withdrawal of consent is free and does not affect the legality of previous processing. Withdrawal is meant to stop operations dependent on this consent; previously obtained data require separate enforcement of appropriate rights and retention. Changing the category or purpose requiring a new choice is not automatically approved by the old cookie record.

11. Advanced Consent Mode and signals upon refusal

In Advanced Consent Mode, the container and Google tags may connect with Google in a denied state, before choice or after refusal. According to Google's documentation, limited signals may include the consent state, event time, browser information, referrer, limited page address, and campaign identifiers; transmission is associated with an IP address. The lack of an optional cookie does not imply no data transfer.

Statistical modeling and ad measurement are separate from cookie recording and personalization. Addresses and parameters passed to tools must be limited, without login tokens, PESEL, contract data, balance, and document contents. Data shared with conversion measurement tags requires its own information and proper basis; their scope is not resolved by simply opting out of contact list imports.

12. Google Analytics, Google Signals, and Google Ads

Google Analytics 4 is used to analyze website usage, and Google Tag Manager manages tags. The measurement may include the browser, device, approximate location derived from IP, visit source, pages, and events. Analytical and advertising goals and choices are separate.

The accepted GA4 configuration includes Google Signals, detailed device and location data, and ad personalization, together with Google Ads integration. Google Signals may link visit information with Google users with appropriate personalization settings for cross-device analysis and advertising functions. These are not exclusively anonymous visit counters. The service setting does not replace proper visitor consent and does not imply app access to the phone's GPS.

In GA4 services where the User-ID function is implemented, we can link the activity of a logged-in user across different devices, browsers, and sessions using a pseudonymous identifier assigned to their account. This is used for analyzing website and portal usage and reducing multiple counts of the same person. It applies to measurements within the same GA4 service and services covered by its actual implementation. Selecting User-ID in the reporting panel does not transmit the identifier—its provision by the website or portal is also necessary.

We condition the use of User-ID on consent for analytics. We do not transmit the identifier before such a choice or upon refusal; after consent withdrawal or logging out, we stop assigning new events to the account identifier. Measurements without cookies in Advanced Consent Mode do not constitute consent to send User-ID. Analytical consent does not automatically activate advertising goals, which require proper marketing choice.

User-ID does not contain a first name, last name, email address, phone number, PESEL, or identity document data. We also do not use email or phone hash or FCM notification token for this purpose. Since we can link the identifier to the account, this is pseudonymization, not anonymity. We distinguish User-ID from browser/device identifier, Google Signals, and form data used for Google Ads extended conversions. The User-ID description covers websites and portals; it does not change the described scope of mobile Firebase.

GA4 event data has a 14-month retention period, and user identifier data has a 14-month retention period with a reset upon new activity. The reset does not renew the age of each old event. After the period expires, Google deletes data on a monthly cycle. For age, gender, and interests, 2 months apply. This same period covers collected User-ID data when the function actually receives the account identifier. We do not use GA4 export to BigQuery. Retention does not automatically limit standard aggregate reports.

Google Ads is used for measuring conversions, remarketing, and evaluating campaign effectiveness within the scope of proper marketing choice, separate from analytical. Extended conversions may use email, phone number, first name, last name, city, and country from the registration form for conversion matching and campaign optimization. Data may be normalized and hashed; hashing is not automatically anonymization. Merely creating an account does not express consent for this purpose. Without proper marketing choice, the portal does not provide these form data to tag.

We do not transmit scans, health data, KRK, PESEL, or confidential contract documents to Google Analytics. Information: Google privacy policy, GA4 data retention User-ID function and Google Ads extended conversions.

13. Meta Pixel and ad audience

Meta Pixel, with proper marketing consent, may process visits and actions on the site, IP, browser, device, referrer, cookies, and advertising identifiers. It is used to measure ad effectiveness, audience groups, remarketing, and personalization.

The registration tag may, with proper marketing consent, use advanced matching with email and phone to measure ad effectiveness. The identifier hash can still be used for matching a person; we do not treat it as anonymous statistics. Account registration and analytics choice do not replace marketing choice.

Information: Meta privacy policy and Meta cookie policy.

14. Contact, chat, call recordings, and voluntary reviews

Thulium is used for MB/OTT contact, handling requests and conversations. The optional chat widget is activated according to the appropriate functional choice; refusal does not limit contact via email. The chat may process the session identifier, IP address, device information, and voluntarily submitted content. Do not submit passwords, one-time codes, diagnoses, or unnecessary identity scans.

If a phone call is recorded, you will receive information before the recording. The purpose, basis, and alternative available contact should be indicated for proper service. Recordings have a declared maximum period of 365 days. We store requests and metadata up to 24 months from the closing of the case, and call metadata without a separate case — from its conclusion. We separate necessary evidence of a specific case with appropriate justification and period.

Separate consent for review requests through TrustMate

Invitations concern the services of MB PARTNER Marcin Bohdanowicz. ON TIME TAXI does not operate this invitation channel. With your separate, voluntary consent, MB PARTNER Marcin Bohdanowicz may commission TrustMate S.A. to send an email requesting a review, reminders, and thanks. We do not use SMS channels in this process. The selection indicates the administrator, purpose, and email channel; it is not pre-marked. Refusal, lack of review, or withdrawal of consent do not affect the contract or settlements. Consent to offers or familiarization with the Policy does not replace this choice.

When sending invitations, MB PARTNER is the data controller, and TrustMate acts on its behalf as a processor based on an entrustment agreement, which can be concluded electronically. We provide the email address and minimal data necessary for the invitation after the service, without identity documents, health data, KRK, and settlements. Consent can be withdrawn via the provided opt-out mechanism or contact with MB PARTNER. After receiving consent withdrawal, we stop further messages for this purpose, including reminders already scheduled in TrustMate. The service is performed by authorized personnel; withdrawal of consent does not affect the compliance of earlier processing.

If you do not provide a review within 60 days from sending the invitation, TrustMate deletes the data provided for this purpose in accordance with § 14 sec. 4 of its regulations. This does not replace previous handling of consent withdrawal or objective cessation. If you provide a review, it may be displayed publicly, also on the partner's pages and in searches. Regarding its service and reviews, TrustMate acts as an independent administrator. Withdrawal of consent for invitations does not itself remove the public review.

TrustMate S.A., ul. Bartoszowicka 3, 51-641 Wrocław: privacy policy, terms of service and public entrustment agreement. The period of 14 days for deleting entrusted data after the termination of the company's agreement with the provider is separate from the withdrawal of the recipient's consent and the rules of public review.

15. Form protection — reCAPTCHA

We protect registration and password recovery forms with Google reCAPTCHA Enterprise; in applications, an appropriate security page is displayed in an embedded view. Google evaluates technical signals such as IP, browser, device, time, and interaction method, and the verification token reaches our API. This is not Firebase Authentication or earnings analytics.

The purpose of account security and limiting automated submissions may be based on Art. 6 sec. 1 lit. f GDPR regarding necessity and proportionality. For the storage/retrieval of information on a device, a separate assessment of Art. 399 PKE and actual necessity is required; the security name alone does not establish an exception for all Google operations.

In case of an issue with the form, you can contact directly via email. Google information: privacy and terms of service.

16. Key cookies and similar identifiers

The table separates the identifier's existence time on the device from data retention on the provider's side. External cookies names and periods are typical; the final table requires confirmation on each domain.

17. Change of privacy choice

Use the “Cookie Settings” panel on the appropriate page to reject, modify, or withdraw optional consents. You can also remove cookies and site storage in your browser settings. Blocking the necessary session may prevent logging in; refusing an optional category should not block the basic account service.

Disable push in the appropriate app or phone settings; the setting of one app or installation does not automatically change the choice on another phone or second brand. You can withdraw email/SMS marketing by the provided mechanism or contacting the appropriate administrator.

Deleting the app, cookie, or withdrawing permission does not mean deleting all data previously obtained by the controller and providers. A request concerning such data is considered according to sec. 19. Marketing choice, familiarization with the policy, and parental consent for the contract are separate actions.

18. Analysis, profiling, and human involvement

We analyze activity and settlements to present results, control correctness, and explain abuses. OTT may present order acceptance/cancellation rates, revenues, and comparisons of days and hours. Data may come from platforms and settlements; it does not require phone GPS. Historical summary or forecast is not a guarantee of future earnings.

Authorized MB employees use integration with the corporate ChatGPT Business for statistics, calculations, and reports on performance or abuse. The tool’s reading provides information; it does not prove the execution of settlement, approval, deletion, or change of status. The AI result requires verification by an employee with the ability to change it before applying consequences.

The company declares the use of statistical and settlement data without personal data; however, the actual level of aggregation requires verification. An amount or assessment linked to a person's ID, device, or linkable case may be personal data. For ordinary analysis, do not transfer entire scans, PESEL, health judgments, or KRK. Analysis of identifiable performance/risk may be profiling despite human involvement.

OpenAI indicates that corporate Business data is not used by default for model training. This does not mean lack of storage. Removing a workspace member does not itself delete chats, files, and canvas documents; according to published Business rules, they may remain indefinitely. Chat deletion is a separate operation, usually intended for permanent deletion within 30 days, with legal, security, or prior de-identification exceptions described by the provider. Separately saved files and projects have their own rules. Information: user access cycle and OpenAI security and retention.

Our adopted rule requires the removal of its working conversations and separately saved files in Library/Space and projects no later than 30 days from the end of the case/analysis. We transfer the necessary result earlier to the CRM for a period appropriate to this result. Deleting the conversation itself does not remove the separate file in Library/Space, and deleting the project, disconnecting the integration, or withdrawing access to the employee does not replace checking all copies. The deletion order at the provider and its further cycle are separate from our 30-day term.

Google/Meta advertising profiling is separate from operational analyses and is subject to the description in sec. 12–13 and appropriate choices. Calculation rules apply the terms of the contract or program; you can report a questionable result by email for manual verification, receive an explanation, and contest the data. A claim after the result is not evidence of human involvement before the decision.

19. Your rights and deletion of a joint account

To the extent provided by GDPR, you may access and obtain a copy of the data, rectify it, request its deletion or restriction, and, when conditions are met, transfer the data. You may object to processing on the basis of legitimate interest due to reasons related to your situation and at any time object to direct marketing, including related profiling. You may withdraw consent without affecting the legality of prior actions.

Direct your request to kontakt@mbpartners.pl; for OTT matters also to kontakt@ontimetaxi.pl. MB coordinates processing and forwarding to the appropriate data controller, which does not relieve it of responsibility. In case of justified doubts, we verify your identity to the extent necessary to protect against unauthorized operations.

We respond without undue delay, generally within a month of receiving the request. For justified complexity or number of requests, the deadline can be extended by another two months; we inform about the extension and reasons within the first month. In case of refusal, we explain the reason and available protection measures. You may file a complaint with the President of UODO: uodo.gov.pl, and seek judicial protection.

Deleting the MB Partner / On Time Taxi account

You can submit a request via Menu → Delete account in the app, through the MB Partner portal, the OTT portal or email. It includes a joint account for both brands. Uninstalling the app does not delete the account.

With active contracts, you receive information about the effects and the option to report their termination. An employee handles the termination according to the contract; the declared operational standard of 7 days is not a guarantee of deleting all data. Deregistration from ZUS has its statutory period counted from the cessation of the insurance title.

Access blocking, contract termination, and data deletion or anonymization are separate stages. A request does not remove the obligation to retain specific tax, insurance, or necessary case evidence, but an active contract does not block the deletion of irrelevant data and disabling an optional channel. Remaining data have the scope, basis, and term appropriate for the category in item 7.

The response should separately indicate: deleted operational data, retained documents and their bases/periods, individual exceptions, actions undertaken by the recipients, and the expiration of copies. The retained identifying original in the archive does not allow for a complete anonymization of data. A technical queue, backup, or waiting for contract termination do not substitute for a request response within the GDPR timeframe.

20. Publication, historical versions, and informing about changes

The policy informs about the data; review, reading, or confirmation of its receipt is not consent for marketing, any new purpose, or automatic acceptance of a contract change. A purpose requiring separate consent is not initiated by the mere publication of the policy.

The new version has a number and date upon publication. Portals make the currently published policy and historical versions available with date and status indication; previous MB and OTT documents remain in history. A draft by an employee does not replace the current public version. Main company websites should direct to the appropriate portal policy according to the publication configuration, and applications provide its link.

We inform about significant changes on the portal, and for selected email channels, also active individuals via email message. After logging in, a window shows the version and description of changes, as well as a link to the full content and history. The "I have read" button records confirmation of a specific version, while "Later" postpones the information without confirmation and without blocking the portal. Sending a message, its acceptance by transport, and clicking confirmation are separate states; mere display or sending does not prove familiarization. MB/OTT confirmation is common for the same person and publication. We store confirmation of the current version until it is replaced, afterwards 24 months; it is not consent for marketing or TrustMate.

Translations PL/EN/UK/RU/BE refer to the designated source version and require consistency of meaning. A translation correction does not independently change the processing purpose. You can clarify doubts by contacting the administrator.

21. Contact

Coordination of a joint account, documents, applications, security, and requests: MB PARTNER MARCIN BOHDANOWICZ, ul. Rewolucji 1905 r. 82 lok. 6, 90-223 Łódź, NIP 8882894528, kontakt@mbpartners.pl.

Own contracts, fleet, promotions and OTT processes: ON TIME TAXI SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. Nad Rzeką 2, 26-067 Chełmce, KRS 0001060100, NIP 9592065735, kontakt@ontimetaxi.pl.

The current published policy and history are made available in the MB Partner portal and the On Time Taxi portal. For matters related to a specific company’s operations, you can contact them directly.