OpenApp Pay Privacy Policy
valid from 16/09/2026
1. Introduction
OpenApp Pay Sp. z o.o., with its registered office in Warsaw at ul. Grzybowska 62, 00-844 Warsaw (hereinafter referred to as OpenApp), takes special care in protecting the personal data of its Users.
This Privacy Policy supplements the OpenApp Application Terms and Conditions and describes the principles of personal data processing in connection with using the Application, including purchasing, payment, recommendation, and social media functions.
If you have any questions, you can contact us by email: rodo@open-app.com or send a letter to our correspondence address: OpenApp Pay Sp. z o.o., ul. Grzybowska 62, 00-844 Warsaw.
The OpenApp Privacy Policy does not regulate the privacy policies of our Partners (e.g. online stores), which are separate data controllers. We encourage you to read each Partner's privacy policy before entering into a purchase agreement with them. It is available on its website and visible when using the "Order and pay" service in the OpenApp Application.
OpenApp provides Partners only with the data necessary to complete the order, in accordance with the Application Regulations.
If you do not agree to this Privacy Policy, do not install the Application.
2. Data administrator
The administrator of your personal data is: OpenApp Pay sp. z o.o. Grzybowska Street 62 00-844 Warsaw
3. Use of personal data by OpenApp.
We use personal data to verify your identity, provide the Services, communicate with you, ensure security, prevent fraud and comply with the law, present products, make recommendations, and enable you to use the social features available in the Application.
Below is a complete summary of the data we collect, the purpose of its processing, the legal basis, and the retention period. Providing personal data is mandatory to the extent necessary to conclude and implement the Agreement and to comply with legal obligations.
In the remaining scope, providing data is voluntary, but you may need to use selected Application functionalities (e.g., social functions, recommendations, or access to contacts).
| Purpose of processing, scope of data processing | Legal basis | Processing time |
|---|---|---|
| Registering an account in the Application username, age, phone number, email address and information about your mobile device (e.g. device manufacturer, phone model, operating system version) | Article 6, paragraph 1, letter b of the GDPR – Application Regulations Article 6 section 1 letter c of the GDPR in connection with, among others, Article 75 of the Payment Services Act and, among others, Article 33 et seq., Article 49 of the Act on Counteracting Money Laundering and Terrorist Financing Article 6 paragraph 1 letter f of the GDPR – the legitimate interest of the controller, which we consider to be the processing of data for the purpose of establishing a defence and pursuing claims | If you do not complete the Registration, we will process your data for 3 days. If you complete Registration, we process this data for the entire duration of the Agreement until the termination or expiration of the Agreement, and then until the expiry of the limitation period for any claims arising from the Agreement - currently for a period of 6 years from the termination or expiration of the Agreement- for the provision of a payment service, with the deadline always falling on the last day of the year. |
| Image A photo that can't be added at any time while using the Application | Article 6(1)(a) of the GDPR – consent to data processing | We process data for the duration of the consent validity period, i.e. until it is withdrawn, which we consider to be, among other things:deleting the photo from your account in the Application. |
| User identification and identity verification First name, last name, PESEL number or date of birth, citizenship, ID card number and series, ID card expiry date, PEP status, ID card photo, and selfie. If we verify using the mObywatel method, we may also process the data provided through this method: maiden name, father's name, mother's name, mother's maiden name, country of birth, gender, registered address, registered date, and the authority issuing the ID card. | Article 6 paragraph 1 letter c of the GDPR in connection with, among others, Article 33 et seq., Article 49 of the Act on Counteracting Money Laundering and Terrorist Financing, among others, Article 75 of the Act on Payment Services, Article 6(1)(f) of the GDPR - the legitimate interest of the controller, which we consider to be the processing of data for the purpose of establishing, defending and pursuing claims | We process the data throughout the duration of the Agreement from the date of verification until the termination or expiration of the Agreement, and then until the expiry of the limitation period for any claims arising from the Agreement - currently for a period of 6 years from the termination or expiration of the Agreement for the provision of a payment service, with the deadline always falling on the last day of the year. |
| Service Implementation Depending on the Service and the details of its implementation, the following data are required: name and surname, telephone number, delivery address, location, IP address, mobile device type, and information provided by the Partner or entities participating in the execution of the Payment, necessary to provide the Account, execute the Payment or transfer the Tip. In the case of invoice data, additionally: company name, business address, Tax Identification Number (if you are a sole proprietorship) | Art. 6 sec. 1 letter b GDPR – performance of the User Agreement regarding the use of functions available in the Application Article 6 paragraph 1 letter f of the GDPR – the legitimate interest of the controller consisting in the technical processing of the order in the Application, providing the Partner with the data necessary to fulfil the order, and establishing, defending, and pursuing claims. Article 6 paragraph 1 letter a of the GDPR – the User's consent regarding location data, if the use of a given function requires access to location. | We process the data for the entire duration of the Agreement, and then until the expiry of the limitation period for any claims arising from the Agreement.–currently for a period of 6 years counted from the termination or expiration of the payment service agreement, with the end of the period always falling on the last day of the year. We process location data from the date you consent to the processing of location data until you withdraw your consent.,what we consider to be disabling the sharing of your location with us at the mobile phone level. |
| User Profile Username, age, telephone number, email address, delivery addresses, payment card type and partially masked number, In the case of invoice data, additionally: company name, business address, Tax Identification Number (if you are a sole proprietorship) | Article 6, paragraph 1, letter b of the GDPR – Application Regulations Article 6, paragraph 1, letter c of the GDPR in connection with, among others, Article 75 of the Payment Services Act and, among others, Article 33 et seq., Article 49 of the Act on Counteracting Money Laundering and Terrorist Financing Article 6 paragraph 1 letter f of the GDPR – the legitimate interest of the controller, which we consider to be the processing of data for the purpose of establishing a defence and pursuing claims | We process data for the entire duration of the Agreement, and then until the expiry of the limitation period for any claims arising from the Agreement - currently for a period of 6 years counted from the termination or expiration of the agreement for the provision of payment services, with the end of the period always falling on the last day of the year. |
| Consideration of complaints regarding the use of OpenApp Services Data that you provide to us, e.g. name and surname, e-mail address or telephone number, content of the application, data regarding Payments or operation of the Application. | Article 6 paragraph 1 letter b of the GDPR – performance of the Agreement, Article 6 paragraph 1 letter c of the GDPR – obligations arising from the provisions on payment services and complaint handling by financial market entities, Article 6 paragraph 1 letter f of the GDPR – legitimate interest of the controller consisting in documenting complaints and in the establishment, defence and pursuit of claims. | We process the data throughout the complaint processing period and then for the period required by law or until the expiry of the limitation period for claims. |
| Correct operation of the OpenApp Application Technical data and information necessary to ensure proper operation of the Application, security, error diagnosis and service stability. | Art. 6 ust. 1 lit.f GDPR – legitimate interest of the administrator, which includes, among others: the need to maintain the proper operation of the Application | Data processed throughout the period of use of the Application or until an objection to data processing is filed |
| Usage data by the Application User, including data relating to launching the Application, navigating it, using individual functions and performing activities related to the Account. | Article 6(1)(f) of the GDPR - legitimate interest of OpenApp consisting in analysing how the Application is used, improving its functionality and ensuring the convenience of using the Services. | Data processed throughout the period of use of the Application or until an objection to data processing is filed |
| Product and basket recommendations Data regarding your purchase history, purchase frequency, purchase activity in the Application and purchase preferences, including activity in various stores available in the Application. | Article 6, paragraph 1, letter f of the GDPR – the legitimate interest of the controller in personalising the content presented in the Application, including matching product recommendations and shopping carts to the User's preferences and improving the operation of the Application | Data processed throughout the period of use of the Application or until an objection to data processing is filed |
| Creating a Personal Store Data on products purchased, products saved, liked, added to the cart, recommended and other interactions of the User with products in the Application | Article 6, paragraph 1, letter f of the GDPR – the legitimate interest of the controller in presenting the User with products related to his/her activity in the Application, including the creation of a Personal Store, and improvement of the Application | Data processed throughout the period of use of the Application or until an objection to data processing is filed |
| Social features Data about User activity and interactions, including information about invitations, shared carts, scope of permissions in shared carts, following Personal Stores, and information visible to other Users in accordance with privacy settings. | Art. 6 ust. 1 lit.b GDPR – processing necessary to provide services within the Application, in particular enabling the use of social functions. | We process the data for the period you use the social functions available in the Application, and then for the limitation period for any claims. |
| Invitations and use of contacts Telephone number and other contact details of the selected person from the User's contacts. | Article 6, paragraph 1, letter a of the GDPR – the User's consent to access contacts stored on the device and to use selected contact data for the purpose of sending invitations to use the Application or its functionalities. | Data are processed until the invitation is sent or the User withdraws consent. |
| Managing a minor's account and a child's wallet Data of the Legal Guardian, data of the minor, information on the granting of consent, the relationship between the Legal Guardian and the minor, and the connection of the Account and the Wallet. | Article 6, paragraph 1, letter b of the GDPR – performance of the Agreement concluded with the Legal Guardian or provision of Services to a minor User in accordance with the Application Regulations. Article 6, paragraph 1, letter f of the GDPR – the legitimate interest of the controller consisting in confirming the consent of the Legal Guardian, correctly linking the Account of the minor User with the Account of the Legal Guardian, and establishing, pursuing and defending claims. | Data processed throughout the period of use of the Application or until an objection to data processing is filed |
| Data provided in connection with the recording of calls made by the Customer Service Office | Article 6 paragraph 1 letter f of the GDPR – the legitimate interest of the controller, which we consider to be the need to record telephone conversations in the event of proving facts and evidence | We process the data for a period of 3 months from the date of the conversation |
4. Who do we share or transfer data to?
We want to assure you that we do not share your data with other entities without a valid legal basis.
Below, we indicate situations in which we may share data with controllers other than us that receive personal data. These include:
- Partners –to the extent necessary to complete the order and in accordance with the Application Regulations.
- state bodies and institutions: entities or persons authorised under the provisions of law to process personal data for the purposes of proceedings conducted by them or for the purpose ofimplementationOpenApp's obligations arising from legal provisions, e.g. the Polish Financial Supervision Authority, the Chief Inspector of Financial Information;
- banks, credit institutions, payment institutions, settlement agents inside OpenApp, entities operating a payment system or payment scheme, electronic money institutions, financial institutions providing funds transfer services, telecommunications operators for the purpose of resolving potential Complaints with them;
- law firms;
- other users of the Application to the extent necessary to use the social features available in the Application, in particular shared baskets, invitations, and the Personal Store. The scope of information visible to other users within the social features, including the Personal Store, depends on the privacy settings available in the Application and on actions undertaken by the User.
We may entrust personal data to external entities under a data processing agreement, in particular to OpenApp sp. z o.o., a company belonging to the same capital group. In such cases, the data is processed only in accordance with our instructions by OpenApp service providers providing us with services in the field of customer service, accounting services, remote identity verification, IT services providers, technical and technological solutions, e-mail and IT system providers, companies providing consultancy services in the field of personal data protection, auditing companies, providers of solutions related to the lease of space in which the OpenApp office is located
We do not sell your personal data or share it with third parties for marketing purposes.
5. How do we obtain personal data?
We obtain personal data directly from Users, from their activity in the Application, from Partners in connection with the execution of orders, making the Receipt available, handling the Payment or indicating the Waiter entitled to receive the Tip, and also from banks and, if such a verification method is chosen, via the mObywatel application, as part of the identity verification process required by law to ensure financial security.
6. What device resources does the OpenApp application have access to?
After the User's consent, the Application has access to:
- Phone name information;
- Information about the location of your mobile device when using the Services
- Selected contacts when using selected functionalities of the Application;
- Camera when you scan a QR code and take a photo of your ID or selfie as part of your chosen identity verification method; we do not have access to photos or videos stored on your device.
7. How do I block access to device resources for OpenApp applications?
You may revoke application permissions at any time by changing the system settings on your mobile device or by uninstalling the Application.
8. What notifications and messages do we send in the app?
We may send App Users notifications in the form of push notifications or messages if the User consents (Article 6, Section 1, Letter a of the GDPR). By default, notifications are disabled; however, we recommend enabling them for your convenience and increased security. You may withdraw consent at any time in your mobile device's system settings. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal. We process data to improve the use of the application for the duration of the consent's validity until its withdrawal.
We may also send messages displayed directly in the Application, which cannot be disabled (e.g. regarding changes to the Regulations, technical information, order fulfilment status) – we process data in connection with these messages on the basis of the legitimate interest of the controller under Article 6, paragraph 1 of the GDPR.1) (f of the GDPR in order to inform the User about necessary changes, provide important information for the period of the legitimate interest of the controller or until an objection to data processing is filed.
We do not send any e-mail or SMS messages to Users requesting any personal data – in particular login details or any information concerning the User.
9. What rights do you have regarding personal data protection in OpenApp?
You have the right to access, rectify, erase, transfer, and restrict the processing of your data, as well as the right to withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal. We inform the data subject of this before consent is given.
You have the right to object to the processing of your personal data at any time when we process your data based on the controller's legitimate interests.
To exercise your rights, please write to us at the correspondence address or e-mail address provided in point 1 above.
You also have the right to lodge a complaint with a supervisory authority. In Poland, this is the President of the Personal Data Protection Office: correspondence address: Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, kancelaria@uodo.gov.pl, Hotline: 606-950-000.
10. Is your personal data transferred across borders?
Personal data will generally not be transferred outside the European Economic Area (hereinafter referred to as the "EEA"). Because our subcontractors provide ICT services and IT infrastructure, we may outsource certain IT activities or tasks to recognised subcontractors operating outside the EEA, which may result in the transfer of your data outside the EEA.
We may transfer personal data to countries for which the European Commission has not issued an adequacy decision. In such situations, we use the tools specified in Article 46(2)(c) of the GDPR (so-called standard contractual clauses) or transfer data based on other legal bases for data transfer specified in Article 49 of the GDPR. In these cases, the method of securing your data complies with the principles set out in Chapter V of the GDPR. You can request further information about the safeguards applied in this regard at any time, obtain a copy of these safeguards, and learn where they are made available.
11. Cookies and other tracking technologies.
We do not use cookies in the Application within the meaning of technologies used on websites.
OpenApp may analyse information about the use of the Application, in particular its launch, navigation within it, performance of individual activities, occurrence of errors, and operational stability.
We carry out this analysis using our own OpenApp solutions to ensure the Application operates correctly, diagnose errors, and improve it.
OpenApp does not use cookies or other technologies that save information on the User's device for analytical or marketing purposes.
12. The principle of creating anonymous email addresses
In the Application, when communicating with Partners, we always use an anonymous email address generated uniquely for each User and each Partner. For Partners that are part of a single capital group, the anonymous email address also includes a unique identifier identifying the online store.
13. Do we process personal data for the purposes of automated decision-making, including profiling?
Profiling means the automatic use of personal data to evaluate certain factors relating to an individual, such as their preferences, interests or behaviour.
In the Application, we may use profiling by analysing User activity, particularly purchase history, purchase frequency, and products saved, liked, or added to the cart, to present product and cart recommendations, create a Personal Store, and personalise the content presented in the Application. We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects for you or significantly affect you in a similar manner.
14. Privacy Policy Changes
The Policy takes effect on the date the App launches and may be updated. We will notify you of each update at least 14 days in advance through an in-app notification about upcoming changes, along with a new version of the Policy.