# Privacy policy **Originally effective: 10 Oct 2022. Last updated: 28 Oct 2026.** ## 1. Who is responsible LILIKOI, ul. Witelona 21, 51-617 Wrocław, Poland, is the controller of personal data processed for DMV One Way. Polish tax identification number (NIP): 8981960458. REGON: 021527521. Use the [contact form](/contact) and choose the privacy topic, or use the [reveal email control](/contact#email), to contact us about your data. You may also write to the postal address above. A privacy request does not require a paid account or agreement to marketing. This notice covers the DMV One Way website, learner accounts, web purchases, support and guarantee requests. It describes processing connected with our establishment in Poland, including when learners are in the United States. A native mobile application or materially different feature will need information appropriate to its actual operation. ## 2. Information we process | Context | Information | | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Account and sign-in | Email address, account identifier, linked sign-in-provider identifiers, authentication and session records, language and selected state or territory. A social provider may supply basic profile information according to its permissions and your choices. | | Study | Questions attempted, submitted answers, scores, practice activity, learning progress and saved preferences as you use the available learning features. | | Purchases | Plan, state, amount, currency, payment-provider identifiers, transaction status, access dates and billing information necessary for payment, tax or accounting. Payment providers collect payment-instrument details through their own secure components. | | Support and complaints | Reply address, selected topic, message, optional order reference, correspondence and any relevant evidence you later provide. | | Guarantee claims | Relevant learning results, official-test date and the minimum evidence needed to assess the failed-test claim. Redact unrelated identifiers and other sensitive details. | | Security and delivery | IP address, request time, browser/device and network information, technical logs and security-challenge results. | | Analytics | Permitted public-page visits, page title, limited referrer information and technical browser/device information processed by Matomo. Tracking URLs exclude query strings and fragments. | You provide information directly, through your use of the service, or through a sign-in or payment provider. Do not submit passwords, one-time codes, full card details, government identification numbers or medical information in a support message. For optional passkeys, the authenticator keeps the private key and any biometric unlock information. We receive the public credential and authentication information needed to verify sign-in, not your fingerprint or face scan. ## 3. Purposes and legal bases | Purpose | Legal basis under the GDPR | | --------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Create and operate an account, provide purchased access, maintain requested learning progress and handle service-related requests | Performance of the agreement or steps requested before entering it. Where a guardian is the contracting party and we process a learner's data separately, our legitimate interest in providing the requested educational service, subject to the learner's rights and safeguards. | | Payment, accounting, tax and legally required records | Performance of the purchase agreement and compliance with the legal obligations applicable to the relevant record. | | Detect abuse, secure authentication, verify support submissions and investigate technical problems | Our legitimate interests in protecting the service, accounts and communications against fraud and misuse. | | Handle complaints, guarantee claims and legal disputes | Performance of our commitments, applicable legal obligations, and our legitimate interest in establishing, exercising or defending legal claims, according to the particular activity. | | Understand permitted public-page use and improve the website through limited Matomo measurement | Our legitimate interest in proportionate service measurement, subject to applicable consent requirements and your right to object. Where consent is legally required, measurement must wait for it. | | Optional processing that expressly asks for consent | Your consent for the stated purpose. Withdrawing it does not affect earlier lawful processing. | We assess legitimate interests against users' rights, with particular attention to minors. A statement that we have a legitimate interest does not override a legal requirement for consent. Creating an account or reading this notice is not blanket consent to advertising or marketing. Providing an email address and necessary authentication information is required for an account. Payment and billing information is required where necessary to complete a purchase or meet legal requirements. A reply address and description are needed to handle a contact-form submission. Optional details can be omitted. Without required information, we may be unable to provide that specific feature. ## 4. Providers and other recipients We use service providers for hosting, delivery, authentication, storage, email, payments and security. They receive information needed for their role, subject to the applicable agreements and legal responsibilities. - **Cloudflare:** website and asset delivery, security and Turnstile verification on the contact form. Turnstile processes technical device and network signals to help distinguish legitimate submissions from abuse. See [Cloudflare's Turnstile privacy information](https://www.cloudflare.com/turnstile-privacy-policy/). - **Supabase:** account authentication, database and access-related records. The project is hosted in the United States. - **Resend:** authentication email and delivery of contact-form messages to our support inbox. - **Stripe and PayPal:** payment processing, payment security, transaction information and related tax/billing functions where offered. They also process information for their own regulated payment, fraud-prevention and legal purposes. See [Stripe's privacy policy](https://stripe.com/privacy) and [PayPal's privacy statement](https://www.paypal.com/us/legalhub/paypal/privacy-full). - **Social sign-in providers you choose:** the provider receives information about the authentication request and returns information under its permissions. Its own privacy information also applies to its service. - **Our hosting, email and technical operators:** access necessary to operate, secure and support the service, including our Matomo installation at `stats.yolomate.eu`. Authorised staff and professional advisers may access information when needed for their duties. We may disclose information to competent authorities where legally required or to establish or defend a claim. We do not make support messages or learner records public. ## 5. International processing Data can be processed in Poland, elsewhere in the European Economic Area, the United States and countries used by our providers. Our Supabase project is hosted in the United States; using an EU-based operator does not mean all data stays in the EU. Where a transfer from the EEA requires a safeguard, we must use an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses and any necessary supplementary measures. Reliance on the EU–US Data Privacy Framework requires the actual recipient to have an active certification covering the relevant data. Contact us for information about the safeguards applicable to your data and how to obtain a copy, subject to appropriate redaction. ## 6. Cookies, device storage and analytics Authentication uses cookies needed for sign-in and session continuity. The site also stores a selected-state preference, a short-lived checkout-return destination when needed, and your chosen colour mode. You can clear storage or change browser settings; blocking necessary storage may prevent sign-in or other requested features from working. The reviewed website integration uses Matomo with analytics cookies disabled. It does not send a learner account identifier, excludes account/API/authentication routes, and removes query strings and fragments from tracked URLs. Referrers are limited to a recognised public path on our site or an external origin. Automatic session recording, heatmaps and form tracking are not enabled in this integration. Matomo does not load when the browser sends a recognised Do Not Track preference or enables Global Privacy Control. Cookieless measurement can still involve personal data, including technical information and an IP address; it is not a claim that every visit is anonymous. You can also object to measurement by contacting us. Stripe, PayPal, social sign-in and Turnstile may process technical information or use storage for their own payment, authentication or security functions when those features are used. These functions are distinct from Matomo measurement. We do not rely on continued browsing as consent to non-essential storage. If we introduce advertising or other consent-dependent tools, the appropriate notice and choice must be provided before they operate. ## 7. Retention We retain data only for the purposes described here and applicable legal requirements. Retention depends on the record and the following criteria: - **Account and learning records:** for the account's operation and continuity of the learning service, then for any period needed to complete deletion, resolve an outstanding request or preserve a legally justified record. Paid access expiry alone is not an instruction to delete your learning history. - **Payment and accounting records:** for the mandatory tax/accounting retention period applicable to the transaction and any relevant legal-claims period. Deleting an account does not erase records we are legally required to keep. - **Support and guarantee correspondence:** while the request is handled and afterwards only as necessary to document its outcome, meet legal obligations or address a related claim. Evidence must be limited to what the request needs; unrelated identification details should be removed before submission. - **Security logs and verification results:** for investigation, abuse prevention and the technical retention configured for the relevant system, with longer preservation only for an identified incident or legal need. - **Analytics:** according to the documented Matomo retention settings, limited to what proportionate measurement requires. Aggregate reports that no longer identify a person may be retained separately. - **Backups:** until overwritten under the applicable backup cycle, with restored data subject to the same deletion requirements. Restricted records retained for a legal obligation are not reused for unrelated purposes. Contact us for the retention period applicable to a particular record. We must maintain operational deletion schedules consistent with these criteria; this notice does not create an indefinite right to keep data. ## 8. Your rights and choices Subject to the applicable conditions, you may request access and a copy, correction, deletion, restriction, portability of data provided under consent or contract and processed automatically, and objection to processing based on legitimate interests. You may withdraw consent where consent is the legal basis. Objection to direct marketing must be honoured. Use the contact form's privacy topic or our revealed email address. We may request proportionate information to verify identity or a representative's authority; we will not routinely require a full identity document. We respond within the period required by law, normally one month under the GDPR, and explain any permitted extension or refusal. You may complain to the Polish supervisory authority, the [President of the Personal Data Protection Office (UODO)](https://uodo.gov.pl/en), or another competent authority. Contacting us first is optional. Additional US state rights may apply depending on your residence, the law's scope and our processing. Where applicable, these can include access, correction, deletion, portability, certain opt-outs, an authorised agent and an appeal of a decision. Submit a request through the same contact channels and tell us if you are appealing an earlier response. We will not unlawfully discriminate against you for exercising a privacy right. We do not describe every state law as automatically applicable merely because the site serves US users. ## 9. Minors and automated processing The service is intended for driving-exam preparation and knowledge refresh, not children under 13. Do not create an account or submit information if you are under 13. A parent or guardian can contact us about a child's data; where we learn of information collected from a child under 13 without the required lawful basis and safeguards, we will restrict further collection and address deletion or other action required by law. For older minors, applicable guardian, contract and privacy rules still apply. A minor's ability to use study materials is different from the ability to enter into a binding purchase agreement. We do not use acceptance of these terms as a waiver of those protections. Practice scores, access dates and payment-event checks are calculated automatically to operate the requested service. A practice score does not decide a government examination result. A person can review a complaint, guarantee claim or disputed access decision through our support process. We do not describe routine practice scoring as an official decision about a learner's right to drive. ## 10. Security and updates We use access controls, encrypted connections and other technical and organisational measures appropriate to the processing. No internet service can promise absolute security. Protect your email, sign-in codes and devices, and report suspected unauthorised access through the contact form. We will update this notice when practices change and identify the new version and effective date. We will provide additional notice or obtain consent when the law requires it. A revised notice does not retrospectively authorise an incompatible use of information.