Cookie Policy

§ 1What cookies are

1. Cookies are small text files that a website stores in your browser’s memory. The site can read them on your next visit, which lets it remember, for example, that you are signed in or which language you chose.
2. This Policy describes cookies and similar technologies (localStorage, sessionStorage, session identifiers) used on two separate properties: the Application at app.legitview.eu and the public website at legitview.eu. The scope differs between them, which is why the lists are kept separate (§ 4 and § 5).
3. Cookies do not change your device’s configuration and do not run software installed on it.

§ 2Legal basis

1. Article 399 of the Polish Electronic Communications Law of 12 July 2024 (Journal of Laws 2024, item 1221), in force since 10 November 2024 — this provision replaced Article 173 of the former Telecommunications Law. It states that storing information, or gaining access to information already stored, in a terminal device requires the user’s prior consent, unless it is strictly necessary to provide the service the user has requested.
2. Article 400 of the Electronic Communications Law — sets the consent standard: GDPR requirements apply, so consent must be freely given, specific, informed, unambiguous and capable of being withdrawn.
3. Article 6(1)(a) GDPR — consent. This is the basis for visit statistics on the public website only.
4. Article 6(1)(f) GDPR — our legitimate interests. This is the basis for processing data from technical server logs (§ 9) and for maintaining the security of the Application.
5. Strictly necessary files do not require consent. Without them a signed-in session cannot be maintained, so using an account would be impossible.
6. Consent for non-essential files must meet the requirements of Article 4(11) GDPR. We obtain it through an active click. Pre-ticked boxes and the formula “continued use of the site means consent” are not consent for us — in line with the European Data Protection Board’s Guidelines 03/2022 on dark patterns.

§ 3Categories

1. Necessary — session, security, remembering your decision about cookies. The service does not work without them. No consent required.
2. Functional — remember user choices, such as the interface language. We keep them on the browser side.
3. Analytics — traffic measurement and statistics. We use them only on the public website and only after your consent. The measurement is anonymised: truncated IP address, no demographic data, no ad personalisation.
4. Marketing and tracking — ad profiling, retargeting, remarketing. We do not use them at all, neither on the website nor in the Application. We do not use Meta Pixel, Google Ads, Google Signals or any advertising platform.

§ 4List — the app.legitview.eu Application

This is the complete list. The Application contains no analytics or marketing files. The server configuration confirms this: the Content Security Policy sent with every page of the Application permits scripts, styles and typefaces only from the legitview.eu domain. Even if someone pasted third-party tool code into a template by mistake, the browser would not execute it.

§ 5List — the legitview.eu website

§ 6How consent works and how to withdraw it

1. On your first visit to the public website we show a banner with two equivalent buttons: “Accept” and “Reject”. Both are the same size and carry the same visual weight — refusing is no harder and no less visible than consenting.
2. Until you click “Accept”, the Google script is not loaded at all. We send no request to Google’s servers — neither before your decision nor after a refusal. Only your consent causes the measurement script to be added to the page.
3. After a refusal we do not ask again for six months. We use no cookie walls: refusing blocks access to no part of the site and limits nothing.
4. Withdrawing consent is as easy as giving it (Article 7(3) GDPR). The footer of the public website contains a “Change cookie consent” link, which reopens the banner and lets you change your decision in either direction. You can also delete the cookies in your browser settings (§ 8). Withdrawal does not affect the lawfulness of processing carried out beforehand.
5. In the Application we do not ask for consent, because there is nothing there that requires it — we display a one-off notice about the necessary files only.

§ 7Third parties

1. Google Analytics 4 — tool operator: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; global infrastructure: Google LLC, 1600 Amphitheatre Parkway, Mountain View, California, USA. Measurement ID: G-RV7PM9FHV9. It runs only on the public website and only after your consent.
   1. IP anonymisation is enabled — the address is truncated before storage.
   2. Disabled: Google Signals (demographic data from Google accounts), Google Ads integration, ad personalisation.
   3. Retention of event and user data: 14 months.
   4. The transfer of data to the USA relies on the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework of 10 July 2023 and on standard contractual clauses.
2. Typefaces — no third party any more. Until 31 October 2026 browsers downloaded typefaces directly from Google’s servers (fonts.googleapis.com, fonts.gstatic.com), which meant an IP address was transmitted to the USA on every page load — even before the visitor clicked anything. Since 1 November 2026 we serve typefaces from our own server. No request to Google is made on that account any more, and in the Application the Content Security Policy blocks it as well.
3. No other third parties. We do not integrate social media, we do not embed videos, maps or third-party chat, we use no advertising networks and we load no external libraries from other parties’ servers.

§ 8Browser settings

1. You can delete stored cookies at any time and set your browser to block them. Blocking the necessary files will make it impossible to use an account in the Application.
2. Instructions for popular browsers:

§ 9Server logs

1. Independently of cookies, the server records technical access logs: IP address, requested address, response code, request time, browser identifier and optionally the referring address.
2. The logs serve security and diagnostics only — detecting attacks, investigating failures and monitoring performance. Legal basis: Article 6(1)(f) GDPR.
3. We keep them for a maximum of 30 days, after which they are overwritten. We do not combine them with account data and do not use them for profiling.

§ 10Changes to this Policy

1. We may amend this Policy, in particular where the law, the technology or the set of files used changes.
2. We inform registered clients of material changes by e-mail to the address assigned to the Account, with at least 14 days’ notice. Editorial changes take effect on publication.
3. This Cookie Policy is an annex to the Privacy Policy; matters not covered here are governed by that Policy and by the Terms of Service.