OREMUS PRIVACY POLICY
This is an English translation provided for your convenience. The Polish version of this Privacy Policy, available at https://oremus.fm/pl/polityka-prywatnosci, is the binding one and prevails in case of any discrepancy.
This Privacy Policy (hereinafter: the 鈥濸olicy") contains information on the processing of your personal data in connection with your use of the Oremus service, comprising:
- the website https://oremus.fm together with the recording player,
- the mobile application Oremus, available in the Google Play and App Store stores (hereinafter: the 鈥濵obile Application"),
together hereinafter: the 鈥濻ervice".
Capitalised terms not defined otherwise in the Policy have the meaning given to them in the Terms of Service available at: https://oremus.fm/terms.
Controller of personal data
The controller of your personal data is Damian Kami艅ski, conducting business under the name CC CODE Damian Kami艅ski with its seat in Krak贸w (address of the fixed place of business: ul. Lilli Wenedy 15/30, 30-833 Krak贸w, Poland), entered in the Central Register and Information on Economic Activity kept by the minister responsible for economy, holding tax identification number (NIP): 6792950185 and statistical number (REGON): 381006639 (hereinafter: the 鈥濩ontroller").
Contacting the Controller
In all matters relating to the processing of personal data you may contact the Controller via:
- electronic mail, at: [email protected];
- postal mail, at: ul. Lilli Wenedy 15/30, 30-833 Krak贸w, Poland.
Data Protection Officer
The Controller has not appointed a Data Protection Officer. In all matters concerning the processing of personal data you may contact the Controller directly, using the contact details indicated above.
Measures protecting personal data
The Controller applies modern organisational and technical safeguards in order to provide the best possible protection of your personal data, and guarantees that it processes them in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: the 鈥濭DPR"), the Act of 10 May 2018 on the Protection of Personal Data, and other data protection laws.
In particular, the Controller applies encryption of the connection to the Service (SSL/TLS) and limits access to data solely to persons for whom it is necessary in order to provide the Service.
The Service does not store passwords. Signing in takes place by means of a one-time code sent to the electronic mail address provided, so that no collection of passwords that could be stolen exists in the Controller's system.
Information on the personal data processed
Using the Service requires the processing of your personal data. Below you will find detailed information on the purposes and legal bases of processing, as well as on the period of processing and on whether providing the data is obligatory or voluntary.
Playing recordings made available free of charge does not require an Account or the provision of any personal data.
Conclusion and performance of the agreement on maintaining an Account
Personal data processed:
- electronic mail address
- one-time sign-in codes and the dates on which they were used
Legal basis: Article 6(1)(b) GDPR (processing is necessary for the performance of the agreement on maintaining an Account concluded with the data subject, or in order to take steps to conclude it).
Providing the above personal data is a condition of concluding and performing the agreement on maintaining an Account (providing them is voluntary, but the consequence of not providing them will be the inability to create an Account).
The Controller will process the above personal data until the claims arising from the agreement on maintaining an Account become time-barred.
Processing payments and granting access to recordings
Personal data processed:
- electronic mail address
- transaction identifier and information about the access variant purchased
- start and end dates of the Access Period
- in the case of a Subscription purchased in an app store, the identifier assigned by the subscription management service provider
The Controller does not process your payment card data. You provide that data directly to the payment operator, which is a separate controller of it.
Legal basis: Article 6(1)(b) GDPR (processing is necessary for the performance of the Agreement for the supply of digital content).
Providing the above personal data is a condition of concluding and performing the Agreement (providing them is voluntary, but the consequence of not providing them will be the inability to obtain access to the Paid Service).
The Controller will process the above personal data until the claims arising from the Agreement become time-barred.
Downloading recordings
Personal data processed:
- electronic mail address associated with the Account
- information about downloaded recordings and the date of download
Legal basis: Article 6(1)(b) GDPR (processing is necessary for the performance of the Agreement) and Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case protecting recordings against unauthorised distribution).
Providing the above personal data is a condition of downloading a recording (providing them is voluntary, but the consequence of not providing them will be the inability to download a recording; this does not limit the ability to play recordings in the Service).
The Controller will process the above personal data for the duration of the Access Period and thereafter until claims become time-barred.
Sending the newsletter
Personal data processed:
- electronic mail address
- date on which consent was given
Legal basis: Article 6(1)(a) GDPR (consent) in conjunction with Article 10 of the Act on the Provision of Services by Electronic Means.
Providing the above personal data is voluntary but necessary in order to receive the newsletter (the consequence of not providing them will be the inability to receive it).
The Controller will process the above personal data until consent is withdrawn. You may withdraw consent at any time using the link included in every message or by writing to the Controller's contact address.
Handling complaint proceedings
Personal data processed:
- first name and surname
- electronic mail address
Legal basis: Article 6(1)(c) GDPR (processing is necessary for compliance with a legal obligation to which the Controller is subject, in this case the obligation to respond to a complaint under Article 7a of the Consumer Rights Act, and to give effect to rights arising from the provisions on the Controller's liability where digital content is not in conformity with the agreement).
Providing the above personal data is a condition of receiving a response to a complaint (providing them is voluntary, but the consequence of not providing them will be the inability to receive a response to the complaint and to give effect to the above rights).
The Controller will process the above personal data for the duration of the complaint proceedings and, where the above rights are exercised, until they become time-barred.
Handling enquiries submitted by Users
Personal data processed:
- first name
- electronic mail address
- other data contained in the message to the Controller
Legal basis: Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case responding to the enquiry received).
Providing the above personal data is voluntary but necessary in order to receive a response to the enquiry (the consequence of not providing them will be the inability to receive a response).
The Controller will process the above personal data until an objection is effectively raised or the purpose of processing is achieved (whichever occurs first).
Account security and prevention of abuse
Personal data processed:
- electronic mail address
- the number and timing of unsuccessful sign-in attempts
- information about unusual use of the Account
Legal basis: Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case ensuring the security of the Service and preventing the use of one Account by more than one person).
The Controller will process the above personal data until an objection is effectively raised or the purpose of processing is achieved.
Fulfilling tax obligations
Personal data processed:
- first name and surname or company name
- address of residence or seat
- tax identification number (if applicable)
Legal basis: Article 6(1)(c) GDPR (processing is necessary for compliance with a legal obligation to which the Controller is subject, in this case obligations arising from tax law).
Providing the above personal data is voluntary but necessary in order for the Controller to fulfil its tax obligations (the consequence of not providing them will be the inability of the Controller to fulfil those obligations).
The Controller will process the above personal data for a period of 5 years from the end of the year in which the deadline for payment of tax for the previous year expired.
Fulfilling obligations relating to the protection of personal data
Personal data processed:
- first name and surname
- the contact details you provide (electronic mail address, correspondence address)
Legal basis: Article 6(1)(c) GDPR (processing is necessary for compliance with a legal obligation to which the Controller is subject, in this case obligations arising from data protection law).
Providing the above personal data is voluntary but necessary for the Controller to properly perform its obligations arising from data protection law, including giving effect to the rights granted to you by the GDPR (the consequence of not providing the above data will be the inability to properly give effect to those rights).
The Controller will process the above personal data until the limitation periods for claims arising from a breach of data protection law expire.
Establishment, pursuit or defence of claims
Personal data processed:
- first name and surname or company name
- electronic mail address
- address of residence or seat
- tax identification number (if applicable)
Legal basis: Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case the establishment, pursuit or defence of claims that may arise in connection with the performance of Agreements concluded with the Controller).
Providing the above personal data is voluntary but necessary for the establishment, pursuit or defence of claims (the consequence of not providing the above data will be the inability of the Controller to take the above actions).
The Controller will process the above personal data until the limitation periods for claims that may arise in connection with the performance of Agreements concluded with the Controller expire.
Analysis of traffic in the Service
Data processed:
- pages visited and the address of the page from which the visit originated
- country code
- device type
- a visit identifier in the form of an irreversible hash
The Controller uses an analytics tool running on the Controller's own infrastructure. That tool does not save cookies on your device and does not store the IP addresses of visitors. The IP address, together with information about the browser, is transformed into an irreversible cryptographic hash with a daily variable, which makes it impossible to identify a person or to track them between successive days.
Legal basis: Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case keeping visit statistics).
The Controller will process the above data until an objection is effectively raised or the purpose of processing is achieved.
Marketing and measuring the effectiveness of advertising
Personal data processed:
- identifiers of cookies and similar technologies
- information about the pages visited and the actions taken, including making a purchase
- marketing campaign parameters (so-called UTM), where the visit originated from an advertisement or campaign link
Legal basis: Article 6(1)(a) GDPR (consent given in the cookie consent panel).
The above processing takes place only after you have given consent to marketing cookies. You may withdraw your consent at any time using the 鈥濩ookie settings" link in the site footer.
The Controller will process the above personal data until consent is withdrawn.
Administration of the Service
Personal data processed:
- IP address
- information about the browser and operating system
- the date and time of the request and the content of the error message
Legal basis: Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case ensuring the security of the Service and detecting and fixing errors).
The Controller will process the above personal data for the period necessary to ensure the security of the Service, and no longer than 30 days, unless that data is necessary for the establishment, pursuit or defence of claims.
Profiling
The Controller does not take decisions in relation to you based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you.
The Controller does not analyse the content of your prayers or which recordings you listen to for the purpose of directing advertising to you. Once you have given consent to marketing cookies, providers of advertising tools may tailor the advertisements displayed to you to your activity in the Service. This does not produce legal effects in relation to you and you may withdraw consent at any time.
Use of artificial intelligence
The recordings made available in the Service were produced using speech synthesis tools. That process takes place solely on the Controller's side, before a recording is published, and does not involve the processing of Users' personal data.
The Service does not offer artificial intelligence features that would process data entered by you.
Recipients of personal data
The recipients of personal data will be the following external entities cooperating with the Controller:
- server infrastructure (hosting) provider: Hetzner Online GmbH (Germany);
- file storage provider and provider of network services, protection against attacks and content delivery acceleration: Cloudflare, Inc. (United States);
- online payment system provider: Stripe Payments Europe, Ltd. (Ireland);
- electronic mail delivery provider: Amazon Web Services EMEA SARL (Luxembourg);
- provider of subscription management services in mobile applications: RevenueCat, Inc. (United States);
- operators of mobile application stores: Google Ireland Limited (Ireland) and Apple Distribution International Ltd. (Ireland), solely in respect of purchases made in the Mobile Application;
- error monitoring tool provider: Rollbar, Inc. (United States);
- advertising tools provider: Meta Platforms Ireland Limited (Ireland), solely after consent to marketing cookies has been given;
- the entity providing accounting services.
For a purchase on the website in a currency other than the Polish zloty, the seller is Stripe Payments Europe, Ltd. (Ireland), which processes the data given at payment, including name, billing address and e-mail address, as a separate controller, in order to conclude and perform the contract of sale and to settle tax, under its own privacy policy.
Personal data may also be disclosed to public or private entities where such an obligation arises from generally applicable law, a final court judgment or a final administrative decision.
Transfers of personal data to a third country
In connection with the Controller's use of services provided by Cloudflare, Inc., RevenueCat, Inc. and Rollbar, Inc., and, once you have given consent to marketing cookies, also by Meta Platforms, Inc., your personal data may be transferred to the United States.
The basis for transfers to the United States is the standard contractual clauses ensuring an adequate level of protection, in accordance with the standard contractual clauses set out in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.
You may obtain from the Controller a copy of the data transferred to a third country.
Your rights
In connection with the processing of personal data you have the following rights:
- the right to information about what personal data concerning you is processed by the Controller and to receive a copy of that data (the right of access). The first copy of the data is free of charge; the Controller may charge a fee for further copies;
- if the data processed becomes out of date or incomplete (or otherwise incorrect), you have the right to request its rectification;
- in certain situations you may ask the Controller to erase your personal data, for example where:
- the data is no longer needed by the Controller for the purposes of which it informed you;
- you have effectively withdrawn consent to the processing of the data, provided that the Controller is not entitled to process the data on another legal basis;
- the processing is unlawful;
- the need to erase the data arises from a legal obligation to which the Controller is subject;
- where personal data is processed by the Controller on the basis of consent given or for the purpose of performing an Agreement concluded with it, you have the right to transfer your data to another controller;
- where personal data is processed by the Controller on the basis of consent given by you, you have the right to withdraw that consent at any time (withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal);
- if you consider that the personal data processed is incorrect, that its processing is unlawful or that the Controller no longer needs certain data, you may request that, for a specified necessary period (for example to verify the accuracy of the data or to pursue claims), the Controller carries out no operations on the data and merely stores it;
- you have the right to object to the processing of personal data where the basis of processing is the legitimate interest of the Controller. Where an objection is effectively raised, the Controller will cease to process the personal data for that purpose;
- you have the right to lodge a complaint with the President of the Personal Data Protection Office where you consider that the processing of personal data infringes the GDPR.
Cookies
Detailed information about the cookies used in the Service, including a list of individual files and their durations, is set out in the Cookie Policy available at: https://oremus.fm/cookies.
You may change your decision about cookies at any time using the 鈥濩ookie settings" link in the site footer.
Final provisions
In matters not governed by the Policy, generally applicable data protection law applies.
The Policy is in force from 26 September 2026.