Products Features Order For participants
  • EN
  • DE
  • PL
    • Contact

    Privacy Policy

    Last updated: 20 October 2026

    1. General Provisions

    This Privacy Policy sets out the rules for the processing of personal data in connection with the use of the website available at mobi-tour.com, hereinafter referred to as the “Website”, as well as in connection with the use of products and services offered as part of the MobiTour system.

    In particular, this Policy covers:

    • use of the mobi-tour.com website;
    • contacting Mega Mold through contact forms;
    • submitting requests for quotations;
    • placing orders;
    • performance of sales contracts;
    • processing payments and deliveries;
    • handling complaints and returns;
    • use of the MobiTour mobile application;
    • use of MobiTour devices, insofar as this involves the processing of personal data;
    • marketing activities, where carried out in accordance with applicable law.

    The Data Controller exercises due care to ensure the security of the personal data processed and to protect users’ privacy.

    This Policy has been prepared with particular regard to:

    • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”);
    • the Polish Act of 10 May 2018 on the Protection of Personal Data;
    • the Polish Electronic Communications Law of 12 July 2024;
    • the Polish Act of 30 May 2014 on Consumer Rights;
    • other applicable laws relating to personal data protection, privacy and electronic communications.

    2. Personal Data Controller

    The controller of personal data processed in connection with the use of the Website is:

    MEGA MOLD Sp. z o.o.
    Jasionka 252E
    36-002 Jasionka
    NIP (Tax Identification Number): 517-024-04-09
    REGON: 180289370
    KRS: 0000297136

    hereinafter referred to as the “Data Controller”.

    For matters relating to the processing of personal data, the Data Controller may be contacted at:

    Email: info@mobi-tour.com

    or in writing at the Data Controller’s registered office address.

    If the Data Controller appoints a Data Protection Officer, their contact details will be made available on the Website.

    3. Categories of Personal Data

    Depending on how the Website is used, the Data Controller may process, in particular:

    • first and last name;
    • company name;
    • business address;
    • delivery address;
    • billing address;
    • email address;
    • telephone number;
    • order details;
    • details of a concluded contract;
    • data necessary to issue accounting documents;
    • information relating to complaints and returns;
    • information provided in a message or request for a quotation;
    • IP address;
    • device and browser information;
    • technical information relating to the use of the Website;
    • information about the use of the MobiTour application or devices, where such information constitutes personal data.

    The Data Controller applies the principle of data minimisation and processes only personal data that is adequate, relevant and limited to what is necessary for the specified purposes.

    4. Contact Form

    The Website enables users to contact the Data Controller through a contact form.

    The form may require the following information:

    • first name;
    • last name;
    • email address;
    • telephone number;
    • message content.

    Data provided through the form is processed for the purposes of:

    • providing a response;
    • handling an enquiry;
    • preparing a quotation;
    • conducting further correspondence;
    • taking steps prior to entering into a contract, where justified by the nature of the enquiry.

    Providing information marked as required is voluntary, but it may be necessary in order to receive a response or a quotation.

    5. Orders and Conclusion of Contracts

    The Website enables customers to place orders and conclude sales contracts for MobiTour products.

    In connection with order fulfilment, the Data Controller may process:

    • first and last name;
    • company details;
    • delivery address;
    • billing address;
    • email address;
    • telephone number;
    • information about the products ordered;
    • payment information;
    • delivery information;
    • data necessary to issue an invoice or another accounting document;
    • information concerning complaints, returns and withdrawal from a contract.

    The current MobiTour Terms and Conditions provide for placing orders and submitting requests for quotations, issuing pro forma invoices and making payments by bank transfer.

    Providing data necessary to fulfil an order is voluntary, but failure to provide such data may make it impossible to conclude or perform the contract.

    6. Purposes and Legal Bases of Data Processing

    The Data Controller processes personal data on the basis of the relevant legal grounds provided for in the GDPR.

    6.1. Performance of a Contract

    Under Article 6(1)(b) of the GDPR, personal data may be processed for the purposes of:

    • accepting and fulfilling an order;
    • concluding and performing a sales contract;
    • preparing a quotation at the customer’s request;
    • arranging delivery;
    • handling complaints and returns;
    • providing support for a purchased product.

    6.2. Legal Obligation

    Under Article 6(1)(c) of the GDPR, personal data may be processed to comply with legal obligations, particularly tax and accounting obligations.

    6.3. Legitimate Interests of the Data Controller

    Under Article 6(1)(f) of the GDPR, personal data may be processed for the purposes of the Data Controller’s legitimate interests, in particular:

    • ensuring the security of the Website;
    • preventing misuse and abuse;
    • ensuring the proper operation of the Website;
    • communicating with customers;
    • handling enquiries;
    • establishing, pursuing or defending against claims;
    • maintaining records relating to concluded contracts;
    • protecting IT infrastructure.

    6.4. Consent

    Where particular processing activities require consent, the Data Controller will process personal data on the basis of Article 6(1)(a) of the GDPR.

    Consent may be withdrawn at any time.

    Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

    7. Order Delivery

    For the purpose of fulfilling deliveries, the Data Controller may provide the delivery service provider with the information necessary to deliver a shipment.

    Under the MobiTour Terms and Conditions, deliveries are carried out by DHL Parcel.

    The information shared may include, in particular:

    • first and last name;
    • delivery address;
    • telephone number;
    • email address;
    • shipment number or other information necessary for delivery.

    Data is shared only to the extent necessary to perform the delivery service.

    8. Payments

    For payments made by bank transfer, the Data Controller processes payment-related information to the extent necessary to confirm receipt of payment and properly settle the order.

    The Data Controller does not collect payment card details when payment is made directly by bank transfer.

    If the Website is expanded in the future to include an external payment service provider, information about that provider and the scope of the data it processes will be updated accordingly.

    9. Complaints, Returns and Withdrawal from Contracts

    Personal data may be processed in connection with:

    • handling complaints;
    • exercising rights arising from goods not conforming to the contract;
    • fulfilling warranty obligations;
    • handling returns;
    • exercising the right to withdraw from a contract;
    • conducting correspondence regarding a complaint or return.

    The legal basis for such processing may be Article 6(1)(b) or (c) of the GDPR and, with regard to protection against claims, Article 6(1)(f) of the GDPR.

    10. MobiTour Application and MobiTour Devices

    MobiTour includes devices intended for tour participants and a mobile application intended for the tour guide or tour leader.

    According to the information provided on the Website, tour participants do not need to install the MobiTour application. The application is intended for the guide, while participants use MobiTour devices.

    MobiTour devices may communicate with the application using wireless communication technologies, including Bluetooth Low Energy (BLE), and a device may be assigned to a participant using NFC.

    11. Tour Participants’ Data

    The MobiTour application may allow the guide to assign a specific MobiTour device to a specific tour participant.

    In particular, the application may allow the following information to be associated with a device:

    • first name;
    • last name;
    • participant identifier or device identifier;
    • information about whether the participant is within the device’s range;
    • information about a specific button being pressed;
    • information about a vote or notification sent using the device.

    This information may constitute personal data if it makes it possible to identify an individual.

    The Website describes a feature that allows a specific participant, including their first and last name, to be assigned to a key fob, as well as a feature allowing the tour leader to monitor participants’ presence.

    12. Local Processing of Participants’ Data

    MobiTour has been designed as an offline solution.

    If participants’ data is processed exclusively locally on the guide’s device and is not transmitted to Mega Mold’s servers, Mega Mold does not have access to that data and does not process it as a controller as part of the application’s local functionality.

    In such a case, the controller of participants’ data remains the entity that determines how the data is used in organising the tour, such as a travel agency, tour organiser or another entity responsible for organising the event.

    Mega Mold may act as the controller of data processed in connection with product sales, enquiries, customer service, technical support and its other own purposes, but it is not necessarily the controller of participants’ data processed locally by a customer.

    The above principles apply only to the extent that participants’ data is not actually transmitted to Mega Mold’s infrastructure.

    13. Mega Mold’s Role Regarding Participants’ Data

    If MobiTour functionality is expanded in the future to include the transmission of participants’ data to servers, cloud services or other systems owned or used by Mega Mold, the data processing rules will be amended accordingly.

    Depending on how such functionality operates, Mega Mold may act as:

    • a data controller – where it independently determines the purposes and means of processing;
    • a data processor – where it processes data solely on behalf of the tour organiser and in accordance with the organiser’s documented instructions.

    If Mega Mold acts as a data processor, processing will be governed by an appropriate data processing agreement.

    The GDPR requires processing on behalf of a controller to be governed by an appropriate legal act or contract specifying, among other things, the subject matter and duration of processing, its nature and purpose, and the types of personal data and categories of data subjects.

    14. No Need for Participants to Install the Application

    Tour participants do not need to install the MobiTour application on their own phones in order to use a MobiTour device.

    According to the information provided on the Website, the application is intended for the guide, while participants use the MobiTour devices provided to them.

    If the use of a particular feature requires participants to install an application, the applicable data processing rules will be appropriately described before the feature is used.

    15. Children’s and Minors’ Data

    MobiTour may be used during school trips, youth camps and other events attended by minors.

    Mega Mold does not require tour participants to provide special categories of personal data or children’s data directly to the Website where MobiTour functionality operates exclusively locally on the guide’s device.

    If a tour organiser associates a child’s first and last name with a MobiTour device, the organiser is responsible for ensuring an appropriate legal basis for such processing and for fulfilling the information obligations owed to data subjects in accordance with applicable law.

    Mega Mold does not use participants’ data processed locally by the organiser for its own marketing or advertising purposes.

    16. Location Data and Distance Information

    MobiTour may allow a guide to obtain information relating to the range of, or distance between, a device and the guide’s phone.

    If this functionality relies on wireless communication parameters between devices and does not use GPS or another technology to determine a participant’s geographical location, Mega Mold does not treat this information as geolocation data transmitted to a server.

    If MobiTour is expanded in the future to include functionality that determines participants’ actual locations or sends location data to a server, this functionality will require a separate legal assessment and appropriate notification to users.

    17. Technical Device Data

    Depending on how the application operates, technical information relating to MobiTour devices may be processed, including:

    • device identifier;
    • device status information;
    • BLE communication information;
    • battery information;
    • connection information;
    • technical data necessary for the device to operate properly.

    Technical data that does not allow an individual to be identified does not constitute personal data.

    However, if technical data is linked to a specific individual, it may constitute personal data.

    18. Recipients of Personal Data

    Personal data may be disclosed to entities supporting the Data Controller in its business activities, operation of the Website and customer service, in particular:

    • hosting and server service providers;
    • IT service providers;
    • email service providers;
    • Website maintenance providers;
    • technical support providers;
    • courier and postal companies;
    • accounting service providers;
    • legal or advisory service providers;
    • entities authorised to receive data under applicable law.

    Where an external entity processes personal data on behalf of the Data Controller, the Data Controller concludes an appropriate data processing agreement where required by the GDPR.

    The Data Controller does not sell personal data.

    19. Transfers of Data Outside the European Economic Area

    The Data Controller seeks to ensure that personal data is processed within the European Economic Area (EEA).

    If the use of a particular service involves the transfer of personal data outside the EEA, the Data Controller will ensure that such transfers comply with Chapter V of the GDPR.

    In particular, an appropriate mechanism provided for under the GDPR will be applied where required.

    20. Data Retention Period

    Personal data is retained for no longer than is necessary to achieve the purpose for which it was collected.

    In particular:

    • contact enquiry data – for the period necessary to handle the enquiry and related correspondence;
    • quotation data – for the period necessary to prepare and handle the quotation and, where applicable, perform the contract;
    • order data – for the period necessary to perform the contract and for the period required by law;
    • accounting document data – for the period required by tax and accounting laws;
    • complaint and warranty data – for the period necessary to resolve them and protect against claims;
    • claim-related data – for the period corresponding to the applicable limitation periods;
    • data processed on the basis of consent – until consent is withdrawn, taking into account any periods necessary to demonstrate the lawfulness of processing;
    • technical data and logs – for the period necessary to ensure the security and proper operation of the Website.

    After the applicable retention periods expire, data is deleted or anonymised unless further retention is required by law.

    21. Rights of Data Subjects

    Every person whose personal data is processed by the Data Controller has, subject to the conditions set out in the GDPR, in particular:

    • the right to access their data;
    • the right to obtain a copy of their data;
    • the right to rectify inaccurate data;
    • the right to complete incomplete data;
    • the right to erasure of data in the cases provided for in the GDPR;
    • the right to restriction of processing;
    • the right to data portability in the cases provided for in the GDPR;
    • the right to object, on grounds relating to their particular situation, to processing based on Article 6(1)(e) or (f) of the GDPR;
    • the right to object to the processing of data for direct marketing purposes;
    • the right to withdraw consent where processing is based on consent.

    The scope of these rights may be restricted in cases provided for by law.

    22. Exercising Data Protection Rights

    To exercise rights relating to personal data protection, please contact the Data Controller:

    MEGA MOLD Sp. z o.o.
    Jasionka 252E
    36-002 Jasionka
    Email: info@mobi-tour.com

    The Data Controller takes appropriate steps to respond to requests without undue delay and no later than one month after receiving them.

    If a request is complex or a large number of requests has been received, this period may be extended by a further two months in accordance with the GDPR.

    23. Right to Lodge a Complaint

    If a data subject believes that the processing of their personal data infringes the GDPR, they have the right to lodge a complaint with the competent supervisory authority.

    In Poland, the supervisory authority is:

    The President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

    The right to lodge a complaint does not limit any other rights available to the individual under the GDPR or other applicable laws.

    24. Cookies

    The Website uses cookies and similar technologies.

    Cookies may be used, in particular, to:

    • ensure the proper operation of the Website;
    • maintain user sessions;
    • ensure security;
    • remember settings;
    • ensure the proper operation of forms;
    • analyse Website usage, where appropriate analytics tools are used.

    Cookies that are necessary for the proper operation of the Website may be used to the extent permitted by applicable law.

    Where the use of cookies or other technologies requires the user’s consent, consent will be obtained before they are used.

    Users may also manage cookies through their web browser settings.

    Before publishing this Policy, the Data Controller should verify the Website’s current cookie configuration and update the information about specific analytics, advertising or other tracking technologies, where used.

    25. Server Logs

    Use of the Website may result in technical information being automatically recorded in server logs.

    Logs may contain, in particular:

    • IP address;
    • date and time of connection;
    • browser information;
    • device information;
    • error information;
    • information about technical and security events.

    Logs are used, in particular, to:

    • ensure the proper operation of the Website;
    • ensure security;
    • detect attempted unauthorised access;
    • diagnose technical problems;
    • protect IT infrastructure;
    • establish, pursue or defend against claims.

    The legal basis for such processing may be Article 6(1)(f) of the GDPR – the Data Controller’s legitimate interest in ensuring the security and proper operation of the Website.

    26. Data Security

    The Data Controller implements appropriate technical and organisational measures to protect personal data against:

    • unauthorised access;
    • unauthorised disclosure;
    • loss;
    • destruction;
    • alteration;
    • accidental or unlawful processing.

    The Website uses SSL certificates to encrypt data transmission. This is also stated in the current MobiTour Terms and Conditions.

    Access to personal data is restricted to persons and entities that need such access to perform their duties.

    The security measures used are adapted to the nature, scope and purposes of processing, as well as the risk to the rights and freedoms of individuals.

    27. Automated Decision-Making and Profiling

    Personal data collected through the Website is not used to make decisions about users that produce legal effects concerning them or similarly significantly affect them based solely on automated processing.

    The Data Controller does not profile users for the purpose of making such decisions.

    If the Data Controller introduces tools involving profiling or automated decision-making in the future, users will be informed accordingly, as required by the GDPR.

    28. Marketing

    The Data Controller may use customers’ contact details for communications relating to order fulfilment, product support and services provided.

    Sending commercial information or carrying out direct marketing by electronic means of communication is subject to applicable law.

    Where consent is required for a particular means of communication, the Data Controller will obtain it before starting such communications.

    Users may object at any time to the processing of their data for direct marketing purposes and, where marketing is based on consent, may withdraw that consent.

    29. Data of Persons Representing Businesses

    MobiTour is also offered to businesses, including travel agencies and tour organisers.

    Data relating to business contact persons, employees, authorised representatives and persons representing businesses may constitute personal data within the meaning of the GDPR.

    The Data Controller may process such data for the purposes of:

    • business communications;
    • preparing quotations;
    • concluding and performing contracts;
    • order handling;
    • customer service;
    • providing technical support;
    • protecting against claims.

    The fact that a person acts on behalf of a business does not automatically mean that their data ceases to be personal data. The Polish Personal Data Protection Office (UODO) indicates that data relating to persons representing legal entities and employees acting as contact persons may also be protected under the GDPR.

    30. Links to Other Websites

    The Website may contain links to websites operated by other entities.

    The Data Controller is not responsible for the personal data processing practices or cookie policies of external websites.

    When visiting an external website, users should review the privacy policy applicable to that website.

    31. Changes to the Privacy Policy

    The Data Controller may amend this Privacy Policy, in particular, in the event of:

    • changes in applicable law;
    • changes to the Website’s functionality;
    • introduction of new products or services;
    • changes in the way data is processed;
    • changes in service providers;
    • introduction of new features in the MobiTour application;
    • changes to the way MobiTour devices operate;
    • introduction of new technologies.

    The current version of the Privacy Policy is published on the Website.

    Changes to the Privacy Policy do not affect the lawfulness of processing carried out before those changes.

    32. Contact

    For matters concerning this Privacy Policy and the processing of personal data, please contact the Data Controller:

    MEGA MOLD Sp. z o.o.
    Jasionka 252E
    36-002 Jasionka
    Poland

    Email: info@mobi-tour.com

    Phone: +48 530 297 939