This document sets out the rules for processing the personal data of users of the pokemony.com website and the rules for the use of cookies and the browser's local storage. It has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) and with the Polish Act of 16 July 2004 – Telecommunications Law (Prawo telekomunikacyjne).
1. Data controller and contact
The controller of personal data within the meaning of Art. 4(7) GDPR is the natural person who runs the pokemony.com website (the “Controller”). In all matters relating to the processing of personal data and the exercise of the rights described in section 8, please contact kontakt@pokemony.com.
The Controller has not appointed a data protection officer, as none of the conditions set out in Art. 37(1) GDPR is met.
The website is a non-commercial fan project and is not affiliated with Nintendo Co., Ltd., Game Freak Inc., Creatures Inc. or The Pokémon Company.
2. Scope of processing — general information
Using the website does not require providing any personal data. The website does not offer user registration or authentication, does not provide contact forms, subscriptions or any other mechanisms for collecting identifying data, and does not perform visitor analytics.
The data processed in connection with the operation of the website is limited to:
- technical operational data recorded in the server logs (section 3);
- data processed by the provider of the advertising system in connection with displaying ads (sections 5 and 7);
- data that the user provides to YouTube if the user personally starts a video embedded in an archived post (section 6).
Independently of the above, the website stores in the user's browser local storage the information described in section 4.2. This information is not transmitted to the Controller or to any other entity.
3. Server logs
The server on which the website is hosted records standard access logs comprising: the IP address of the terminal device, the date and time of the request, the address of the requested resource, the response code, the address of the referring page and information about the browser and operating system transmitted in the User-Agent header.
Purpose of processing: ensuring the proper operation of the website, diagnosing failures and ensuring the security of IT systems, including preventing abuse.
Legal basis: Art. 6(1)(f) GDPR — the legitimate interest of the Controller in maintaining an efficient and secure website.
Retention period: the logs are subject to automatic daily rotation performed by the hosting provider; the five most recent daily archives are kept on the server, after which they are permanently deleted.
Log data is not combined with other datasets and is not used for profiling or for automated decision-making within the meaning of Art. 22 GDPR.
4. Cookies and browser local storage
4.1. First-party cookies
The Controller does not use its own cookies. The website does not create user sessions and does not send any cookies originating from the pokemony.com domain in server responses.
4.2. Local storage (localStorage)
The website stores data of two features in the user's browser local storage. Data is stored only as a result of a deliberate action by the user and covers exactly the following scope:
-
pokemony.zlapane— Pokédex Tracker. A list of the Pokédex numbers of species marked by the user as caught. Data is saved after the marker is clicked. -
pokemony.zgadnij— the “Who's That Pokémon?” minigame. The number of correct guesses in a row, the best result so far, the number of rounds played and guessed correctly, and the number of the most recently settled round. Data is saved after a round is resolved.
This data is not sent to the Controller or to third parties; it remains solely on the user's device. It does not constitute personal data within the meaning of Art. 4(1) GDPR, as it consists solely of numerical values and does not allow a natural person to be identified.
The user may delete this data at any time by using the “Clear list” function on the Tracker page and “Reset stats” in the minigame, or by deleting site data in the browser settings.
4.3. Third-party cookies
Cookies stored on the user's device come exclusively from the provider of the advertising system indicated in section 5. The website does not use analytics or statistics tools — in particular, Google Analytics, Google Tag Manager, Matomo or solutions with a similar function are not used.
Typefaces and graphic materials are served from the Controller's server, so opening a page does not send a request to external font providers or content delivery networks (CDN).
The user may specify the conditions for storing cookies or block them in the browser settings. Restricting the use of cookies does not affect the availability or functionality of the website — all subpages, calculators and the search work without them in an unchanged manner.
5. Advertising — Google AdSense
The website displays ads through the Google AdSense system, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) together with its affiliates. It is the only external entity whose code runs on the website without a separate action by the user. Embedded content, loaded only at the user's explicit request, is described in section 6.
Google and its advertising partners may store and read cookies in order to select advertising content, limit how often ads are displayed and measure the effectiveness of campaigns. Depending on the user's settings, ads may be personalized, i.e. selected on the basis of previous activity on this and other websites.
With regard to the data processed for advertising purposes, Google acts as a separate data controller. Detailed information is provided in Google's information on how it uses data on partner sites. The user can change ad personalization settings in Google's My Ad Center.
5.1. Consent to the processing of data for advertising purposes
Before ads are displayed, users from the European Economic Area and the United Kingdom are shown a consent dialog operated by Google's certified platform (Funding Choices). The dialog allows the user to give or refuse consent to the processing of data for the purposes listed in it, including ad personalization and storing information on the user's device, as well as to manage the scope of consent for individual vendors.
Consent may be withdrawn at any time — this is done using the Ad consent link in the footer of every page of the website, which reopens the same dialog. Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out before its withdrawal. The link appears only where the consent dialog is displayed at all; outside that area there is no consent that could be withdrawn.
Refusing consent does not restrict access to the website's content. Ads may then be displayed in a non-personalized form, i.e. selected without using the user's previous activity.
6. Embedded content in the archive — YouTube videos
The archived posts in the Polish-language Nostalgia section date from 2005–2020, and some of them contain references to videos published on YouTube, which is provided by Google Ireland Limited. In place of the video, only a description of the reference prepared by the Controller is displayed — without a thumbnail, without a player and without any resource downloaded from Google's servers.
Until such a reference is clicked, the user's browser does not send any request to Google. Opening an archived post therefore does not establish a connection with YouTube or transmit the user's IP address to it.
Clicking the reference is a separate decision of the user, and only that click
starts the player. From that moment, Google may process data
under the terms described in its own
privacy
policy, acting as a separate data controller.
The player is embedded from the youtube-nocookie.com domain,
in a mode with limited use of cookies.
This solution also works with JavaScript disabled — the reference then behaves like an ordinary link that opens the video directly on YouTube.
7. Transfers of data outside the European Economic Area
In connection with the use of the advertising system, data may be transferred to third countries, including the United States. Such transfers take place on the terms set by Google, on the basis of the implementing decision of the European Commission on the adequate level of protection of personal data under the EU-U.S. Data Privacy Framework and the standard contractual clauses referred to in Art. 46(2) GDPR.
The Controller does not itself transfer personal data outside the European Economic Area.
8. Recipients of data
The only recipients of data are: the hosting provider, to the extent necessary to maintain the server, and Google — to the extent described in sections 5 and 6. Data is not sold or disclosed to other entities for marketing purposes.
9. Rights of data subjects
The user has the right of access to the data (Art. 15 GDPR), to its rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interest (Art. 21).
With regard to processing based on consent (section 5.1), the user has the right to withdraw it at any time (Art. 7(3) GDPR). This is done using the Ad consent link in the footer of every page of the website.
The user also has the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
The Controller points out that, given the scope of processing, the exercise of some of these rights may be limited: the Controller does not maintain any dataset that would allow users to be identified, and the data contained in the server logs is not linked to the identity of individuals, so Art. 11(2) GDPR may apply. Requests concerning data processed for advertising purposes should be addressed directly to Google, using the links indicated in section 5.
10. Voluntary provision of data
Providing any personal data is not required to use the website. The processing of the operational data described in section 3 is an inherent part of using the internet and results from the technical principles of the HTTP protocol.
11. Verifiability of the provisions
The statements in this document concerning the scope of data collected result from the website's configuration and remain verifiable in its source code. The consistency of the policy with the actual state of affairs is covered by an automated test run with every change to the website.
12. Changes to the privacy policy
Introducing on the website a solution that changes the scope of data processing results in a simultaneous update of this document and a change of the date shown in its header. The change history of the website is public and kept in the project's public changelog.