Privacy Policy of the Dadalo.pl Website

Effective date: September 9, 2026 (replaces the version of October 15, 2025)

§1 Definitions

1. Website – the online publication available at dadalo.pl, together with the following related subdomains: dowody.dadalo.pl, signal.dadalo.pl, book.dadalo.pl, archiv.dadalo.pl, reader.dadalo.pl, and doc.dadalo.pl, operated by Signal Dadalo Media.
2. User – any natural person visiting the Website.
3. Controller – Maciej Lesiak, operating a proprietorship under which both Signal Dadalo Media (editorial activity) and the technical infrastructure supporting it operate.
4. Matomo – web analytics software, self-hosted and maintained by the Controller on its own server infrastructure.
5. Data – information about Users collected by the Matomo software, as well as data voluntarily provided by Users via email correspondence.
6. Matomo software operates exclusively on the dadalo.pl domain and the dowody.dadalo.pl subdomain. The remaining subdomains listed in para. 1 (signal.dadalo.pl, book.dadalo.pl, archiv.dadalo.pl, reader.dadalo.pl, doc.dadalo.pl) do not use Matomo or any other analytics tool and do not collect any data about Users.

§2 Data Controller

1. The Data Controller is Maciej Lesiak.
2. The Controller can be contacted at: info@dadalo.pl.
3. The Data referred to in this Policy is stored exclusively on the Controller’s own servers, on a self-hosted instance of the Matomo software. Data is not transferred, sold, or shared with any third parties, including providers such as Google.

§3 Scope and Purpose of Data Collection

1. Analytics and security (Matomo)

a. The dadalo.pl domain and the dowody.dadalo.pl subdomain use a self-hosted instance of the Matomo software for the purpose of maintaining visit statistics and detecting and preventing abuse directed against the Website. The remaining subdomains listed in §1 para. 1 are not covered by this mechanism, in accordance with §1 para. 6.

b. Collected data includes: IP address, browser type, operating system, pages visited, time spent on the Website, and referral source (referrer).

c. Visitor IP addresses are not anonymized. Given the nature of the Website’s activity, which includes investigative journalism and publications concerning public bodies, the Controller retains full IP addresses in order to identify automated traffic, reconnaissance attempts, and harassment or retaliatory actions directed at the editorial team. This data is not used to profile Users for marketing purposes and is not sold to any party.

d. Analytics data concerning individual visits (visit log) is accessible only to the Controller within the Matomo administration panel and is not published or shared with third parties, except where required by a legal obligation (e.g., at the request of an authorized authority).

2. “Do Not Track”

a. The Website honors the “Do Not Track” (DNT) browser setting. If a User’s browser has this option enabled, the Matomo system will not collect any information about that visit, regardless of the purpose stated in §3 para. 1.

b. The Controller notes that support for the DNT header is being phased out by browser vendors and may not be recognized by all browsers. For this reason, the Controller recommends using the mechanism described in §3 para. 3.

3. Opt-out

a. Regardless of browser settings, a User may disable Matomo tracking at any time using the widget available on this page:

b. This mechanism works by setting a technical opt-out cookie in the User’s browser. This is the sole purpose for which this specific cookie is used.

c. Some browsers automatically delete cookies after a certain period (e.g., Safari after 7 days, Firefox after 45 days, Chrome after 400 days). Users who visit the Website less frequently than this period should re-verify their opt-out status on each visit.

4. Email correspondence

a. Personal data (such as name, surname, email address) provided by Users through email correspondence is protected.

b. Under applicable law, this data is covered by journalistic confidentiality (Article 15 of the Polish Press Law). This means it will not be disclosed without the User’s consent, unless required by law.

c. This data is used solely for the purpose of correspondence and is not processed for any other purpose.

§4 Legal Basis for Processing

1. Processing described in §3 para. 1 (statistics and Website security) is based on Article 6(1)(f) GDPR, i.e., the Controller’s legitimate interest in operating website analytics and ensuring network and information security, as referenced in Recital 49 GDPR.
2. Processing of personal data provided via email correspondence (§3 para. 4) is based on Article 6(1)(b) or (f) GDPR, depending on the nature of the correspondence.

§5 Data Retention Period

1. Raw analytics data collected by Matomo (including IP addresses and the visit log) is retained for 365 days from the date of collection, after which it is automatically and permanently deleted.
2. Aggregated data (statistical reports that do not allow identification of individual visits) may be retained longer for the purpose of historical comparison of Website traffic.
3. Personal data provided via email is retained for as long as necessary to conduct the correspondence or as required by press law.

§6 User Rights

Users have the right to:

1. Obtain information regarding the processing of their data.
2. Access and rectify their data.
3. Request erasure of their data (the right to be forgotten).
4. Restrict the processing of their data.
5. Object to the processing of their data, in particular via the mechanism described in §3 para. 3.
6. Lodge a complaint with the supervisory authority, i.e., the President of the Polish Data Protection Authority (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

To exercise the rights listed in points 1–4, please contact: info@dadalo.pl.

§7 Cookies

1. The Website may use cookies to ensure the proper functioning of certain features.
2. The Matomo software creates its own cookies for traffic analysis purposes. These are exclusively first-party cookies, accessible only to the dadalo.pl domain. The Website does not use third-party cookies.
3. Users may manage cookies through their browser settings or via the mechanism described in §3 para. 3.

§8 Changes to this Privacy Policy

The Controller reserves the right to make changes to this Privacy Policy. Users will be informed of any changes through the publication of a new version of this document on the Website, along with its effective date.