Privacy policy

§ 1. Controller

1. The controller of personal data is L4D spółka z ograniczoną odpowiedzialnością (a Polish limited liability company) with its registered office in Kamionka, ul. Przy Stawie 1, 05-502 Kamionka, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) under number 0000785063 (Sąd Rejonowy dla m.st. Warszawy w Warszawie, XIV Wydział Gospodarczy KRS – District Court for the Capital City of Warsaw in Warsaw, XIV Commercial Division of the National Court Register), tax identification number (NIP) 1231436554, REGON 383301934 (the “Controller”). Contact in matters relating to personal data: administrator@look4dog.com or in writing to the registered office address.

2. The Controller has not appointed a data protection officer.

3. Capitalised terms (e.g. Website, Account, Breeding, Puppy Package) have the meaning given to them in the Terms and Conditions: www.look4dog.com/en_gb/terms-and-conditions.

§ 2. Purposes, legal bases and scope of data

Purpose	Data	Legal basis (GDPR)
Maintaining the Account and the Kennel/Cattery Page, displaying the Kennel/Cattery Page in the catalogue	e-mail, password (in hashed form), first name and surname, telephone, Breeding data and its location, photos, descriptions, animals, litters	Article 6(1)(b) (contract)
Private Messages between Users and their translation (§ 10)	content, sender data, time	Article 6(1)(b); translation – point (f)
Message to a Breeding without first creating an Account (after the e-mail address is confirmed, we create an account to which the Breeding's reply is delivered; a password can be set with the “Forgot your password?” option)	first name, e-mail, telephone (optional), content, language	Article 6(1)(b)
Notifications of new litters (subscription confirmed via a link in an e-mail, also without an Account)	e-mail, selected breed, confirmation and unsubscribe token	Article 6(1)(b)
Paid services: payment, invoice, handling of withdrawal and complaints	first name and surname, e-mail, invoicing data, amount, date, request to begin performance	Article 6(1)(b) and (c) (tax and accounting legislation)
Promotional Offers: granting and delivering the reward (§ 15)	order data; for a free product – first name and surname, delivery address in Poland or Germany, telephone for the carrier	Article 6(1)(b) (Promotion Terms)
The “10 zł na start w KEBZOO” code for new Users with a Visitor Account (§ 15(4), Promotion Terms): sending the code and the “one code per person” rule	Account identifier, hash of the e-mail address, code, dates on which the code was issued and sent, truncated IP address	Article 6(1)(b) (Promotion Terms); prevention of abuse – Article 6(1)(f)
Service Messages, including reminders about unfinished actions in the Account	e-mail, Account data, mailing history	Article 6(1)(b) and (f)
Push notifications, once turned on by the User (§ 18): about new enquiries and messages to the Breeding and reminders to confirm litter availability; for Users with a Visitor Account – about replies from Breedings and new litters in the breeds they follow	subscription address assigned by the browser's notification service, notification encryption keys, Account identifier, language, browser and operating system type, selected notification types, dates of turning on and of the last sending	Article 6(1)(b); reminders also point (f)
Commercial Communications by e-mail (including offers and codes of the KEBZOO by Look4dog online shop). We send them: a) to persons who have given their consent; b) to Users whose Account was created before 10 September 2026, except Accounts linked to Facebook (§ 16(1))	e-mail, first name, language, Account identifier, mailing history	a) Article 6(1)(a) (consent) in conjunction with Article 398 of the Polish Electronic Communications Law; b) Article 6(1)(f) (direct marketing of our own services and products)
Commercial Communications by SMS (offers from L4D, including the KEBZOO by Look4dog online shop). We send them to the telephone number provided in the Account: a) to persons who have consented to contact by telephone or SMS; b) to Users whose Account was created before 10 September 2026 and who, before that date, ticked consent to telephone contact on the Website, except Accounts linked to Facebook (§ 16(1))	telephone number, first name, language, Account identifier, mailing history	a) Article 6(1)(a) (consent) in conjunction with Article 398 of the Polish Electronic Communications Law; b) Article 6(1)(f) (direct marketing of our own services and products)
Consent register – demonstrating that consent was given or withdrawn, and to whom and when we transferred data for sending Commercial Communications (§ 14)	type and version of the clause, decision, date, source, truncated IP address, browser identifier; sending provider (e-mail or SMS) and date of transfer	Article 6(1)(c) in conjunction with Article 7(1) GDPR; transfer log – Article 6(1)(f) (demonstrating lawfulness)
Kennel/Cattery Page statistics for Breedings with a Package (§ 11)	hash (SHA-1) of the truncated IP address and browser identifier; truncated IP address when “Show number” is clicked	Article 6(1)(f) (assessing the effectiveness of the Kennel/Cattery Page)
Social Media Profile Address of the Breeding (§ 13)	Facebook, Instagram or TikTok profile address	Article 6(1)(b)
“Recently viewed” and “Favourites” (§ 12)	identifiers of Breedings, animals and litters, date	Article 6(1)(b) and (f)
Reporting of Content and moderation (Terms and Conditions § 11)	data of the person reporting, content of the report and a copy of the reported Content (including a Private Message), decision and statement of reasons	Article 6(1)(c) (Digital Services Act)
Security of the Website, prevention of abuse, server logs	IP address, time, page address, browser identifier	Article 6(1)(f)
Displaying pages: loading map tiles and scripts from third-party servers (§ 4, points 5, 6, 8)	IP address, technical information about the browser	Article 6(1)(f) (operation of the Website)
Determining the Breeding's coordinates on the map (when the Kennel/Cattery Page is saved)	the Breeding's address given on the Kennel/Cattery Page	Article 6(1)(b)
Visit statistics of the Russian language version (Yandex.Metrica, § 8(5))	IP address, identifiers stored in cookies, pages visited, clicks (click map), link click-throughs, device and browser data	Article 6(1)(f) (analysis of traffic to the Russian-language version)
Google Analytics 4 visit statistics for persons visiting the Website from outside the European Economic Area, the United Kingdom, Switzerland, Russia and Belarus (§ 8(2a))	identifiers stored in cookies, pages visited and events on the Website, approximate location (country, city), device and browser data	Article 6(1)(f) (traffic analysis and improvement of the Website)
Analytics and advertising cookies (§ 8)	cookie identifiers, data on use of the Website	Article 6(1)(a) (consent)
Establishing and defending claims	data necessary to demonstrate the facts	Article 6(1)(f)

Providing data is voluntary, but without the data marked as required in the form it is not possible to create an Account, conclude a contract or collect a reward. Consent to Commercial Communications is voluntary and is not a condition for creating an Account (since 6 September 2026).

§ 3. Profiling

The Controller does not make decisions producing legal effects solely by automated means. The order of Breedings on lists is determined automatically in accordance with the rules in § 5 of the Terms and Conditions, without evaluating persons. Advertising partners (Google, Meta) may profile the User for advertising purposes only after the consent referred to in § 8 has been given.

§ 4. Recipients of data

We share data only to the extent necessary for the given purpose:

1. OVH Sp. z o.o., with its registered office in Wrocław – server, backups and domain registration; data stored in a data centre in Warsaw;

1a. Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany – storage of the Website's backups (encrypted database backups, copies of photos and files) and the server from which photos of KEBZOO products are loaded in own advertisements on the Website's pages (§ 9(1)) and in Commercial Communications by e-mail (IP address of the device and information about the browser in the server logs); data stored in data centres in Germany;

2. dhosting.pl Sp. z o.o., with its registered office in Warsaw – e-mail (sending and mailboxes) and DNS;

3. Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland – payment operator;

4. DeepL SE, Maarweg 165, 50825 Köln, Germany – translation of Private Messages; DeepL is a separate controller of the content transferred to it (§ 10);

5. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – consent management (Google Funding Choices), Google Tag Manager, Google Analytics 4, Google AdSense advertising (including auto ads), Google Ads conversion tracking and remarketing, and Google Analytics 4 advertising features (Google signals) – both only after consent to advertising cookies, location suggestions in the search engine (Google Maps Platform, after the location field is clicked) and sign-in with a Google account (the library is loaded only with the sign-in button: on the login and registration pages and in the message window after sign-in is selected), as well as the Gmail e-mail service, through which we send the data for shipping rewards in Promotional Offers to the persons handling shipping (§ 15);

6. Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland – Meta pixel (only after consent to advertising cookies) and sign-in with a Facebook account, where this method is available (the Facebook library is loaded only after sign-in via Facebook is selected);

7. carrier delivering free products in Promotional Offers – named in the Promotion Terms of the given Offer;

8. OpenStreetMap Foundation, United Kingdom – map tiles on Kennel/Cattery Pages (IP address of the device) and determining the coordinates of the Breeding's address when the Kennel/Cattery Page is saved (Nominatim service);

9. Yandex LLC (ООО «Яндекс»), Moscow, Russia – visit statistics (Yandex.Metrica) only on the Russian language version of the Website (§ 8(5));

10. GetResponse S.A., al. Grunwaldzka 413, 80-309 Gdańsk – sending Commercial Communications by e-mail;

11. 2Way Inc., 382 NE 191st St #77112, Miami, FL 33179-3899, USA – sending Commercial Communications by SMS;

11a. operator of the notification service of the browser in which the User has turned on push notifications (§ 18): Google LLC (Firebase Cloud Messaging – including Chrome on computers and on Android), Apple Inc. (any browser on iPhone and iPad, and Safari on Mac computers), Microsoft Corporation (Edge on Windows) or Mozilla Corporation (Firefox on computers and on Android). The operator is chosen by the browser manufacturer, not by the Controller. We encrypt the content of a notification so that the operator cannot read it; the operator receives the subscription address, the time and size of the notification and the period during which it is to attempt delivery;

12. accounting office, law firm – to the extent of the services they provide to the Controller;

13. public authorities – where required by law.

A Breeding sees the data of the person who writes to it (first name, e-mail, telephone – if provided). The Controller does not sell data and does not share it with third parties for marketing purposes. The KEBZOO by Look4dog online shop (kebzoo.com) is run by the same Controller; when a discount code is redeemed in the shop, the kebzoo.com privacy policy applies.

§ 5. Transfers of data outside the EEA

As a rule, we process data in the European Economic Area. In connection with Google, Meta and Stripe tools and with the push notification services of Google and Microsoft (§ 4, point 11a), data may be transferred to the USA – to entities certified under the EU–U.S. Data Privacy Framework (European Commission decision of 10 July 2023) and, in other cases, on the basis of standard contractual clauses. The OpenStreetMap Foundation operates in the United Kingdom, for which the European Commission has found an adequate level of data protection.

Russia (Yandex.Metrica, Russian language version only). Data from the statistics counter are transferred to Yandex LLC in Russia. The European Commission has not found that Russia ensures an adequate level of protection of personal data, and the Controller does not apply standard contractual clauses or any other safeguards under Chapter V GDPR to this transfer. This means there is a risk that the data will be accessible to the authorities of that country without guarantees and legal remedies equivalent to those under European Union law.

USA (2Way Inc., SMS sending). We transfer the telephone number, first name and language of SMS recipients to 2Way Inc., established in the United States. The Controller has not concluded standard contractual clauses with it and does not apply any other safeguards under Chapter V GDPR to this transfer. This means there is a risk that the data will be accessible to the authorities of that country without guarantees and legal remedies equivalent to those under European Union law.

USA (Apple Inc. and Mozilla Corporation – push notifications). When a User turns on push notifications on iPhone or iPad, in the Safari browser on a Mac computer or in the Firefox browser on a computer or an Android phone, the subscription address and data on the sending of notifications (time, size, delivery period) are transferred to Apple Inc. or to Mozilla Corporation in the United States. Neither of these companies is certified under the EU–U.S. Data Privacy Framework, and the Controller has not concluded standard contractual clauses with them and does not apply any other safeguards under Chapter V GDPR to this transfer. This means there is a risk that the data will be accessible to the authorities of that country without guarantees and legal remedies equivalent to those under European Union law. The content of notifications is encrypted and neither Apple nor Mozilla can read it. On iPhone and iPad, push notifications are always delivered by Apple, regardless of the browser. Anyone who does not want this transfer can use e-mail messages only and, on a computer or an Android phone, can also turn on notifications in a different browser.

§ 6. Retention period

Data	Period
Account, Kennel/Cattery Page, Content	until the Account is deleted
Private Messages	until the Account is deleted. A conversation deleted by one User disappears from their Account, and from the server – when both participants have deleted it (deleting the Account counts as deleting the conversation); until then, the other participant keeps the full conversation
Payments and invoices	5 years from the end of the calendar year in which the tax payment deadline expired (tax and accounting legislation)
Data for sending a reward	until the reward is delivered and the complaint period expires, no longer than 12 months
Commercial Communications	until consent is withdrawn or an objection is raised
List of campaign recipients held by the sending provider (GetResponse, 2Way Inc.)	no later than 30 days after the campaign; the provider's backup copies – in accordance with the provider's rules
The “10 zł na start w KEBZOO” code (§ 15(4))	data on issuing the code – until the end of the Promotion and 3 months thereafter; hash of the e-mail address – until the end of the Promotion, also after the Account is deleted; truncated IP address – 30 days
Consent register	until the limitation period for claims related to processing based on consent expires
Hash for view statistics	2 days
Truncated IP address for “Show number”	2 days (after that, only the number of clicks remains)
“Recently viewed” (in the Account)	the last 12 items, until the Account is deleted
Litter notifications	unconfirmed – 7 days; confirmed – until unsubscribed (the unsubscribe link is valid for 365 days)
Push notification subscription (§ 18)	until notifications are turned off on the given device, the User logs out on it or logs in on it to a different Account, the password is changed, the Account type is changed, the Account is deleted or the notification service reports that the subscription has expired; we also delete it when notifications stop arriving (repeated errors for 7 days or 180 days without successful delivery and without renewal of the subscription), and at the latest after 12 months without logging in to the Account
Push notification queue (type of event and identifier of the conversation, litter or subscription it concerns; without content)	until sent, no longer than 7 days
Push notification held by the notification service operator	until delivered, no longer than 24 hours
Logs of the KEBZOO product photo server (IP address, time, file address, information about the browser)	up to 15 days
Record of the execution of an Account deletion request (date, masked e-mail address and its hash, scope of deletion)	until the limitation period for claims expires
Log of automated mailings (recipient, type of message, date)	until the Account is deleted; after that, without the recipient – until the limitation period for claims expires
Web addresses of deleted Kennel/Cattery Pages (“page deleted” information for search engines)	12 months from deletion
Web server logs (IP address, time, request address, response code)	up to 15 days (8 days on the server and up to 7 days in backups)
Application logs (technical events: registration, activation, payments, messages, push notifications — without card data)	up to 90 days
Reports of Content and decisions	6 months from the decision or until complaint or court proceedings are concluded
Data for defending against claims	until the limitation period expires
Google Analytics 4 statistics (§ 8(1), (2a) and (2b))	event data linked to identifiers from cookies – 2 months from collection; data assigned to a user identifier (e.g. country, device, conversions) – 14 months from collection; aggregated reports without identifiers – no time limit (data retention settings in Google Analytics)
Yandex.Metrica statistics (Russian language version)	in accordance with the data retention rules of Yandex LLC for the Yandex.Metrica counter

We delete or overwrite backups of the database and server at OVH after 8 days at the latest, except for encrypted database backups prepared for transfer outside OVH – we delete these after 4 weeks at the latest. Backups outside OVH – encrypted database backups and copies of the Website's photos and files with Hetzner Online GmbH (Germany) and on a storage medium of the Controller – are kept for no longer than 12 weeks. The copies of the Website's photos and files with Hetzner Online GmbH currently also include files from deleted Accounts; by 30 November 2026 at the latest, we will limit their retention to 12 weeks. Backups made before 30 November 2026 may still contain data deleted during the clean-up of old backups and tables up to 2 November 2026; we delete these data together with those backups, within the periods stated above. Other data deleted from the Website disappear from all backups after 12 weeks at the latest. We use backups solely to restore the Website or lost data after a failure or error and to check whether data have been lost.

§ 7. Rights of data subjects

Everyone has the right of access to their data, to rectification, erasure, restriction of processing and data portability, the right to object to processing based on legitimate interest (including statistics and reminders), and the right to withdraw consent at any time – without affecting the lawfulness of earlier processing. Requests: administrator@look4dog.com. We reply within one month. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), Poland (ul. Stawki 2, 00-193 Warszawa).

§ 8. Cookies and consent

1. Strictly necessary cookies (login, session, language selection, remembering the decision on consent or on turning off statistics, and the closing of a Website notice) always work. Analytics cookies (Google Analytics 4) and advertising cookies (Google AdSense, Meta pixel) are disabled until consent is given — except for the Yandex.Metrica counter on the Russian language version (para. 5) and analytics cookies for persons visiting the Website from outside the European Economic Area, the United Kingdom, Switzerland, Russia and Belarus (para. 2a).

2. In the European Economic Area, the United Kingdom and Switzerland, consent is requested on the first visit by the Google Funding Choices consent management platform (IAB TCF standard), with a reject button. Until a decision is made, Google tools work in Consent Mode v2 with consent denied for analytics and advertising. We also store the decision in the l4d_consent cookie for 12 months so that only the tools the User has consented to are launched.

2a. Outside the European Economic Area, the United Kingdom, Switzerland, Russia and Belarus, we enable analytics cookies (Google Analytics 4) when a page is opened, without asking for consent, on the basis of the Controller's legitimate interest – traffic analysis and improvement of the Website. We also count the Channel Islands, the Isle of Man, Gibraltar, Andorra, Monaco, San Marino, Vatican City, the Faroes, and Svalbard and Jan Mayen as part of this area. Outside this area, too, advertising cookies require consent. We determine the area on the basis of the approximate location of the IP address (determined by Google) and the time zone set in the browser. Nor do we enable statistics when the browser sends a Global Privacy Control signal. We do not store the enabling of statistics on the device – we determine the area anew on each visit. Statistics can be turned off at any time with the “Turn off statistics” button under the “Cookie settings” link in the footer; we remember this choice in the l4d_consent cookie for 12 months. The button can also be used if the location has been determined incorrectly, e.g. when using a VPN.

2b. Google advertising features. In the European Economic Area, the United Kingdom and Switzerland, after consent to advertising cookies, we use: a) Google signals in Google Analytics 4 – Google links visit data with the Google account of people signed in to Google who have turned on ad personalisation in their account settings; we receive only aggregated reports from this (age, gender, interests, use of several devices); b) Google Ads conversion tracking and remarketing lists – our ads on the Google network may then be shown to people who have visited the Website. In doing so, Google links the Google Analytics cookie with its own advertising cookies. Without consent, Google tags send only signals without advertising cookies and without identifiers (para. 2), which Google uses for estimated, aggregated statistics. Outside this area, Google signals and ad personalisation in Google Analytics are disabled. Consent can be withdrawn via the “Cookie settings” link in the footer, and Google ad personalisation can also be turned off at adssettings.google.com.

3. Consent can be changed or withdrawn at any time via the “Cookie settings” link in the footer of every page. We ask for a decision again after 12 months and after a significant change of purposes.

4. Maps and location. The map on the Kennel/Cattery Page uses OpenStreetMap (the Leaflet library); map tiles are downloaded from servers of the OpenStreetMap Foundation, which then receives the IP address of the device. Location suggestions in the search engine (Google Maps Platform) are loaded only after the location field is clicked; Google then receives the IP address of the device and the text being typed. We determine the Breeding's coordinates once, when the Kennel/Cattery Page is saved, by sending the Breeding's address to the Nominatim service (OpenStreetMap Foundation); the address is not transmitted when pages are displayed.

5. Exception — Russian language version. On pages in Russian, the Yandex.Metrica statistics counter (Yandex LLC, Russia) is active, with a click map and tracking of link click-throughs; session recording is disabled. The counter loads when the page is opened, without separate consent — the consent mechanism in para. 2 does not cover it — and stores cookies with Yandex identifiers on the device. The transfer of data to Russia is described in § 5. Yandex cookies can be blocked or deleted in the browser settings. An objection to this processing (Article 21 GDPR) can be sent to administrator@look4dog.com.

6. Cookies can also be blocked in the browser settings; some functions of the Website may then not work.

7. Kennel/Cattery Page form draft. We continuously save the data entered in the Kennel/Cattery Page form (excluding the name of the Breeding, photos and files) only in the memory of the User's browser (localStorage), so that it is not lost if an error occurs or the page is closed; this data is not sent to the Controller and does not depend on the consent referred to in para. 2. We delete the draft after the form is saved, after logging out or after “Start again” is selected; a draft older than 7 days is not restored and is deleted during the next visit to the Website.

8. Push notifications. When a logged-in User clicks “Yes, turn on notifications” after reading the information displayed above that button, we install in the browser a script that handles notifications (service worker) and save a notification subscription in the browser (§ 18). The script only receives and displays notifications; it does not store the Website's pages, Account content or messages. Without that click, we do not install the script. We ask for consent to the installation in accordance with Article 399(4) of the Polish Electronic Communications Law, and we record the decision in the consent register (§ 14(3)). You can remove the script and the subscription by turning off notifications in the Account dashboard, on the “Notifications” tab, by logging out or by deleting the look4dog.com site data in the browser settings; on iPhone and iPad, also by removing the Look4dog icon from the Home Screen. The consent mechanism in para. 2 does not apply to this.

§ 9. Advertising on the Website

1. Own advertisements present products of the KEBZOO by Look4dog online shop (kebzoo.com), run by the Controller. They are selected randomly on the server side, without cookies or profiling; links contain only parameters that make it possible to count visits from the Website. We load the product photos from the Controller's server with Hetzner Online GmbH (§ 4, point 1a); the server records the IP address of the device and information about the browser in its logs (§ 6).

2. Google AdSense advertisements are displayed only after consent to advertising cookies (§ 8).

§ 10. Private Messages and their translation

1. We store the content of a message, the sender's data and the time of sending on the Controller's servers and make them available to the recipient. The recipient receives an e-mail about a new message with its content and the sender's contact details. If the recipient has turned on push notifications (§ 18), they also receive a short notification without the content of the message and without the sender's data.

2. The Website operates in six languages, so we automatically translate a message written in a language other than the language of the recipient's Account into the recipient's language: we attach the translation to the e-mail about the new message, and in the Account the recipient can display it with the “Translate” button. We detect the language of the message on our server; if this fails, the message is sent to DeepL, which detects the language itself. We mark the translation with the name DeepL; the original prevails. Translation is performed by DeepL SE (Maarweg 165, 50825 Köln, Germany) under the free version of its service. We have not concluded a data processing agreement with DeepL: DeepL is a separate controller of the content transferred to it and processes it under its own privacy policy (www.deepl.com/privacy). According to DeepL's terms and policy, content transferred under the free version may be stored without time limit and used to train and improve DeepL's models, and the place where it is processed is determined by DeepL. Before sending to DeepL, we replace e-mail addresses and telephone numbers with placeholders; the remaining content, including first names and other data entered by the author, is sent to DeepL unchanged. The translation is saved together with the message.

3. The basis for translation is the legitimate interest of the Controller and of Users (communication between people speaking different languages). You can object by writing to administrator@look4dog.com.

§ 11. Kennel/Cattery Page statistics

1. The Controller counts views of Kennel/Cattery Pages and of animal and litter pages, clicks on “Show number” and the number of Private Messages received by a Breeding, and shows Breedings with an active Puppy Package only aggregate figures. A Breeding does not receive any information about the persons visiting.

2. A view is reported by the browser only after the page has been visible for 2 seconds; it is not counted for automated browsers or for the owner of the Breeding.

3. To count the same device once a day, the Controller creates a hash (SHA-1 function) of the IP address truncated to its first three parts (IPv6: to /48), the browser identifier, the page and the date. The full IP address is not stored. The hash is deleted after 2 days.

4. When “Show number” is clicked, the Controller stores the truncated IP address in the same way, solely to count one click per day; after 2 days the truncated address is deleted and only the number remains.

5. Statistics do not store information on the User's device, do not use cookies and are not used for profiling or advertising, and therefore do not depend on the consent referred to in § 8.

6. The basis is the legitimate interest of the Controller and of the Breeding: assessing the effectiveness of the Kennel/Cattery Page. You can object (§ 7).

§ 12. “Recently viewed” and “Favourites”

1. The Website shows a “Recently viewed” block with Kennel/Cattery Pages and animal and litter pages that the User has opened. For a User who is not logged in, the list is stored only in the memory of their browser and is not sent to the Controller; after logging in, it is transferred to the Account once (identifier and date, at most 12 items, without the IP address). The list can be cleared in the browser and, in the Account, on request.

2. “Favourites”: Breedings, animals and litters that the User marks with a heart are stored in the browser memory for a User who is not logged in and in the Account for a logged-in User. They are stored only at the User's request (a click), and this is necessary for the function to work.

3. The list is not shared with Breedings or other Users and is not used to select advertisements. The basis is the performance of the contract and the legitimate interest of the Controller (convenience of using the Website).

§ 13. Social Media Profile Address of the Breeding

A Breeder may enter on the Kennel/Cattery Page the address of the Breeding's profile on Facebook, Instagram or TikTok. The Controller stores and displays it as part of the Kennel/Cattery Page. We do not embed plug-ins of these services on the Website's pages – a visitor's data reach their operator only after the link is clicked, under that operator's privacy policy.

§ 14. Service Messages, Commercial Communications and consent register

1. We send Service Messages (concerning the Account, messages, payments, changes to the Terms and Conditions, reminders about unfinished actions) without consent, on the basis of the contract and legitimate interest. You can turn off reminders to confirm litter availability via the link in the message or in the Account dashboard, on the “Notifications” tab; turning them off also covers push notifications (§ 18(5)). You can object to other reminders by writing to administrator@look4dog.com.

2. We send Commercial Communications – including Promotional Offers and offers and discount codes of the KEBZOO by Look4dog online shop – by e-mail and SMS to the persons indicated in § 2. Consent may be withdrawn, and an objection to direct marketing may be raised, at any time: in the Account settings (“My consents”), via the link in the message (in an SMS it works without logging in) or by writing to administrator@look4dog.com.

3. We record every consent decision (giving, refusing, withdrawing) in the consent register: the type and version of the clause, the date, the source, the IP address truncated to its first three parts (IPv6: /48) and the browser identifier, so that we can demonstrate that consent was given or withdrawn.

§ 15. Promotional Offers

1. We process the data of a participant in a Promotional Offer in order to grant and deliver the reward under the Promotion Terms.

2. We send the discount code for the kebzoo.com shop by e-mail. The Website does not receive information on whether and for what the code was used.

3. For a free product, we collect in the reward collection form the first name and surname, the delivery address (only in Poland or Germany) and a telephone number for the carrier. We send the data by e-mail to the persons handling shipping, including to a mailbox in the Gmail service (Google Ireland Limited), and to the carrier named in the Promotion Terms. The data are used solely for shipping and are deleted in accordance with § 6.

4. To new Users with a Visitor Account who have consented to Commercial Communications by e-mail, we send the “10 zł na start w KEBZOO” code by e-mail under the Promotion Terms. To ensure that each person receives only one code, we store a hash of their e-mail address (a one-way record, without the address itself) until the end of the Promotion, also after the Account is deleted. The Website does not receive information on whether and for what the code was used.

§ 16. Signing in with a Google or Facebook account

1. An Account can be created and accessed by signing in with a Google or Facebook account (if the method is available on the Website). The provider then transmits to the Controller: the account identifier in its service, the first name and surname, the e-mail address (if the provider makes it available) and information on account verification, and Facebook also the address of the profile picture. These data are used to create the Account and to sign in. The e-mail address becomes the Account address to which we send Service Messages (§ 14(1)); if the provider does not transmit it, the User enters the address themselves and confirms it with a code. We display the first name in the Account and as the sender of messages that the User sends to a Breeding. To Accounts linked to Facebook – also after that link has been removed – we send Commercial Communications only with separate consent given on the Website (§ 14(2)), and we do not pass the first name of such an Account to the sending providers (§ 4, points 10–11).

2. The basis is consent expressed by using this function (Article 6(1)(a)). Consent can be withdrawn by writing to administrator@look4dog.com; signing in will then be possible after setting a password.

3. The provider of the social media service learns that the User has created an Account on the Website, under its own privacy policy.

4. After the Look4dog.com app has been removed in the Facebook settings and a data deletion request has been sent, we delete the Facebook identifier and the first name, surname, e-mail address and picture address stored with it. The Account remains; its deletion can be requested by writing to administrator@look4dog.com (§ 7).

§ 17. Security and final provisions

1. The Controller applies technical and organisational measures appropriate to the risk, in particular an encrypted connection (HTTPS), restricting access to data to authorised persons, and backups.

2. The Website contains links to other websites; this Policy does not apply to them.

3. The Policy is marked with a version number and date. We inform Users with an Account about significant changes by e-mail or by a notice on the Website. The Policy is available in six languages; in the event of discrepancies, the Polish version prevails.

§ 18. Push notifications

1. A User with a Breeder Account can turn on push notifications in the browser about: a) new enquiries and messages to the Breeding; b) reminders to confirm whether the animals from a litter are still available. These are Service Messages (§ 14(1)); we do not send Commercial Communications through them. Notifications do not replace the e-mails provided for in the Terms and Conditions (e.g. about a change to the Terms and Conditions).

2. A notification contains the type of event or the number of new messages and, for a reminder, also the name of the litter. It does not contain the content or subject of a message or the data of the person writing. Tapping it opens a page of the Website; the message can be read after logging in.

3. We process: the subscription address assigned by the browser's notification service, encryption keys, Account identifier, language, browser and operating system type, selected notification types and dates. The basis is the contract (Article 6(1)(b) GDPR) and, for reminders, also the legitimate interest of the Controller and of the Breeding – keeping information about litters up to date (Article 6(1)(f)). We send a reminder concerning a single litter no more than once every 7 days, between 8:00 and 21:00 Polish time, and only together with an e-mail reminder.

4. Notifications are delivered by the operator of the browser's notification service (§ 4, point 11a, § 5). We encrypt the content so that the operator cannot read it. The operator stores an undelivered notification for no longer than 24 hours.

5. You can turn off notifications in the Account dashboard, on the “Notifications” tab: entirely on the given device or – on all devices at once – separately for notifications about enquiries and for reminders. You can also turn them off in the browser or operating system settings. Logging out deletes the subscription on the given device, and changing the password and deleting the Account – on all devices. Turning off e-mail reminders via the link in the message or on the “Notifications” tab also turns them off in push notifications. Turning off reminders is an objection under Article 21 GDPR and does not require a justification.

6. A User with a Visitor Account can turn on push notifications in the browser about: a) a Breeding's reply to their message; b) new litters in the breeds they follow (notifications of new litters, § 2). A notification about a reply does not contain the content or subject of the message or the Breeding's data; a notification about a new litter contains the name of the breed and the name of the Breeding from its Kennel/Cattery Page. Notifications of new litters cover all new litters in the followed breed that are visible in the catalogue, in the order in which they were added, regardless of whether the Breeding uses paid services. We send push notifications about new litters between 8:00 and 21:00 Polish time, at most one a day per breed (several litters are combined into one notification) and at most three a day; the e-mail about new litters arrives regardless of these limits. The basis is the contract (Article 6(1)(b) GDPR). Unsubscribing from notifications of new litters via the link in the e-mail also turns them off in push notifications. Paragraphs 2–5 apply accordingly. We do not send push notifications to persons without an Account.