privacy policy
§ 1. general provisions
This Privacy Policy sets out the rules for the processing of personal data of users of the website cos.place (hereinafter the “Service”) by COS.PLACE SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (hereinafter the “Controller”).
The Service is a social platform that enables users to publish photos, maintain profiles, use content feeds, communicate, participate in discussions, create events, and use group accounts.
The Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter the “GDPR”), the Polish Act of 10 May 2018 on the Protection of Personal Data, and other applicable laws.
§ 2. data controller
The Controller of personal data is COS.PLACE SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. Jana Kilińskiego 9/52, 80-452 Gdańsk, Poland, Tax ID (NIP): 9571195415, Business Registry Number (REGON): 54325148600000, National Court Register Number (KRS): 0001205415.
The Controller can be contacted regarding the processing of personal data and the exercise of data subjects’ rights at contact@cos.place.
§ 3. categories of personal data processed
The Controller processes account data, including email address, username, information necessary for authentication, and account settings. Passwords should not be stored in plain text.
In connection with maintaining profiles and publishing content, the Controller processes photos, thumbnails, descriptions, mentions, tags, information about characters assigned to publications, co-creator credits, and other information shared by Users.
The Controller processes information about activity within the Service, including likes, comments, saved and shared posts, followed accounts, interactions with content, and data necessary for displaying feeds and basic statistics.
In connection with communication, the Controller processes the content of private messages and group chats, information about conversation participants, and data related to notifications.
Within forums, events, and group accounts, the Controller processes the content of threads and replies, information about events and event registrations, group membership, roles, and actions taken within group accounts.
The Controller also processes technical and security-related data, including session identifiers, IP addresses, browser and device data, and login information, to the extent related to the operation of the Service.
In connection with handling reports, the Controller processes the content of correspondence and data provided by Users. Newsletter-related data is processed when Users use that service.
§ 4. purposes and legal bases for processing
Personal data is processed for the purpose of registering and maintaining accounts, authenticating Users, providing profiles, and ensuring the basic functionality of the Service. The legal basis is Article 6(1)(b) of the GDPR, to the extent necessary for the performance of a contract.
Personal data is processed for the purpose of publishing and displaying photos, image carousels, tags, co-creator credits, comments, likes, saves, and shares, as well as operating forums, messages, events, and group accounts. The legal basis is Article 6(1)(b) of the GDPR, to the extent necessary for the provision of these services.
User activity data is processed for the purpose of displaying content feeds, tag-based search, handling notifications, and providing basic account and post statistics. The legal basis is Article 6(1)(b) of the GDPR, to the extent necessary for the provision of selected features.
The Controller processes data to ensure the security of the Service, prevent abuse, protect accounts, and moderate content. The legal basis is Article 6(1)(f) of the GDPR (the Controller’s legitimate interest), taking into account Users’ rights and freedoms, particularly those of children.
Personal data is processed for the purpose of handling inquiries and reports and for establishing, pursuing, or defending legal claims. The legal basis is Article 6(1)(b) or (f) of the GDPR, as appropriate to the purpose of processing.
Personal data is processed to comply with the Controller’s legal obligations, based on Article 6(1)(c) of the GDPR.
Where the optional newsletter is used, personal data is processed based on the User’s consent, in accordance with Article 6(1)(a) of the GDPR. Consent may be withdrawn at any time.
§ 5. content feeds, search, and statistics
The Service provides the “For You,” “Following,” “Latest,” and “Popular” content feeds. The selection and order of displayed content may take into account information about publications, followed accounts, tags, and activity within the Service.
Advanced search enables users to find content based on tags and other labels assigned to publications.
The Service provides Users with basic statistics regarding their accounts and posts. The scope of statistics relates to activity and interactions within the Service.
The Controller does not currently use Google Analytics or advertising-tracking tools. Feed and statistics features are part of the operation of the Service and do not, in themselves, constitute the use of data for behavioral advertising.
§ 6. publishing photos and user content
Users may publish posts containing photos, including multiple photos in a single post. The Service enables cropping of thumbnails and photos, rotating images, and changing their aspect ratio.
Posts may include tags, character credits from the character library, and co-creator credits. This information may be displayed together with the published content.
Photos, descriptions, comments, and other content made publicly available may be visible to other Users and visitors to the Service, in accordance with visibility settings.
Publicly shared content may be copied or redistributed by third parties. Deleting content from the Service does not automatically remove copies of it that remain outside the Controller’s control.
§ 7. private messages and group chats
The Service enables the exchange of private messages and participation in group chats. The Controller processes data necessary to deliver messages, identify conversation participants, and support communication.
Private messages and group conversations are not published as publicly available content. Access to them is provided in accordance with the functionality of the Service and applicable law.
Message-related data may be processed to handle reports, ensure security, and comply with legal obligations, to the extent necessary for those purposes.
§ 8. forums, events, and group accounts
Within forums, Users may create threads and post replies. Forum content and author information are made available in accordance with the nature and settings of the relevant feature.
The Service enables users to create events and register for events. Information about an event, its organizer, and a User’s participation may be visible to others in accordance with the Service’s settings.
Users may create and manage group accounts, publish content on behalf of a group, and use communication within the group. The Controller processes data regarding membership, roles, and activity necessary to operate these features.
§ 9. notifications and profile personalization
The Controller processes information about activity and events within the Service to deliver notifications related to accounts, interactions, messages, groups, and events.
The Service enables profile personalization. The Controller processes settings and profile materials selected by the User in order to display the profile in the form specified by that User.
§ 10. children and minimum age
The minimum age for registration in the Service is 13 years. Persons under the age of 13 may not create accounts.
The standard registration process uses an email address and password and does not include a separate step for obtaining parental or guardian consent. The validity of legal actions performed by minors is governed by applicable law.
To the extent that the processing of a child’s data is based on consent and is subject to Article 8 of the GDPR, the Controller applies the requirements concerning consent or authorization by the holder of parental responsibility. In Poland, the threshold set out in that provision is 16 years.
The Controller takes into account the special protection of children’s data, particularly in relation to publishing photos, messaging, events, profile visibility, and interactions within groups. Matters concerning children’s data may be addressed to contact@cos.place.
§ 11. data recipients and data transfers
Personal data may be disclosed to entities providing hosting, data storage, technical support, communication, and advisory services to the Controller, to the extent necessary to provide those services and in accordance with applicable law.
Content published by Users is made available to others in accordance with the nature of the relevant feature and visibility settings. Data may also be disclosed to competent authorities where required by law.
Users’ personal data is not transferred outside the European Economic Area (EEA).
§ 12. data retention period
Account-related data is retained for the period during which the Service is used and, after use ends, for the period justified by legal obligations or the need to establish, pursue, or defend legal claims.
Publications, comments, messages, and information about groups and events are retained for the period necessary to provide the relevant features and to handle the deletion of content and accounts.
Technical data, security logs, and correspondence relating to reports are retained for the period necessary to achieve the purposes for which they were collected.
Where data is processed based on consent, withdrawal of consent ends processing on that basis, unless further retention is permitted on another legal basis.
§ 13. cookies and similar technologies
The Service uses cookies or similar technologies related to session management, login, security, and the proper operation of basic features.
The Service does not currently use Google Analytics or advertising-tracking tools.
Where technologies requiring consent are used, the Controller obtains consent in accordance with applicable law.
§ 14. security and automated processing
The Controller applies technical and organizational measures appropriate to the risk associated with the processing of personal data, including children’s data.
The Controller processes information about activity within the Service to display content feeds, including “For You” and “Popular,” as well as statistics. The automatic ordering of displayed content does not in itself constitute decision-making that produces legal effects or similarly significantly affects the User.
The Controller does not make decisions about Users based solely on automated processing that would produce legal effects or similarly significantly affect them. Profiling for the purpose of adapting content and personalizing offers is carried out based on the User’s consent, where consent is the legal basis for such processing.
§ 15. users’ rights
Data subjects have the right, under the conditions set out in the GDPR, to access their data, rectify it, erase it, restrict its processing, transfer it, and object to its processing.
Where processing is based on consent, the User may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Requests regarding the exercise of rights may be sent to contact@cos.place. The Controller responds without undue delay, in principle within one month, taking into account the possibility of extending this period provided for in the GDPR.
Data subjects have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).
§ 16. final provisions
The Controller may update this Privacy Policy in connection with changes to the Service’s functionality, data-processing methods, or applicable law.
Information about changes to the Privacy Policy is made available within the Service. Additional notifications or consents are provided where required by law.
In matters not regulated by this Privacy Policy, the provisions of the GDPR and applicable Polish law shall apply.