Privacy Policy of the MyPropFirm.pl Website

Version: 1.2

Effective date: 17.05.2026

Last updated: 21.07.2026

Summary of key information

1. Personal data controller

The controller of your personal data within the meaning of Article 4(7) GDPR is:

MYPROPFIRM SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ

with its registered office at: Podhalańska 23, Kluszkowce 34-440

NIP: 7352939866 | REGON: 544343026 | KRS: 0001230981

E-mail: kontakt@mypropfirm.pl

(Hereinafter: the “Controller” or “we”)

The Controller has not appointed a Data Protection Officer, as it is not required to do so under Article 37 GDPR.

2. What data do we collect and for what purposes?

2.1. Data you provide voluntarily

a) Account registration

If you decide to create an account, we process:

• email address,
• username (nickname),
• password (stored only in encrypted form),
• country of residence (optional).

Purpose: creating an account, enabling the use of features requiring login, communication regarding the account.

Legal basis: Article 6(1)(b) GDPR – performance of a contract for the provision of electronic services.

Retention period: for the duration of the active account, and after its deletion for up to 3 years for the establishment, exercise or defence of claims.

b) Login through social media accounts (Google SSO)

If you log in through a Google account or another external account, we receive a limited set of profile data from the provider of those services – usually your email address and name/username. Passwords to external accounts are not provided to us and are not stored by us.

Important: Logging in through Google SSO does not automatically subscribe you to the newsletter. If you want to receive the newsletter, you must give separate, voluntary consent through a dedicated subscription form. Combining newsletter consent with login or registration is not permitted (prohibition of bundled consent) under Article 4(11) and Article 7(2) GDPR and Article 398 PKE.

Purpose: simplified registration and login.

Legal basis: Article 6(1)(b) GDPR.

c) Email contact / contact form

We process:

• your email address,
• first name or surname (if provided),
• message content,
• any data you provide yourself in correspondence.

Purpose: responding to your question or handling your request.

Legal basis: Article 6(1)(f) GDPR – the Controller’s legitimate interest (communication with Users).

Retention period: until the matter is resolved, and then for up to 3 years due to possible claims.

d) User Contributions (reviews, comments, ratings)

If you post reviews, comments or ratings, we process:

• the content of your Contribution,
• username/nickname (publicly visible),
• date and time of posting,
• IP address (only for verification and security purposes, not made public).

Purpose: operation of the review section and ensuring the reliability and integrity of opinions in accordance with the DSA and the Omnibus Directive.

Legal basis: Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(f) GDPR (the Controller’s legitimate interest).

Retention period: for the duration of account activity and up to 3 years after account deletion, or until an effective erasure request is made.

2.2. Data collected automatically

a) Technical data and server logs

During each visit, we automatically record:

• IP address of the device (anonymised after 90 days),
• type and version of the web browser,
• operating system,
• URLs of visited subpages and the referring page (referrer),
• date, time and duration of the visit.

Purpose: security and proper operation of the Website, error diagnosis.

Legal basis: Article 6(1)(f) GDPR – the Controller’s legitimate interest.

Retention period: 90 days in identifiable form, after which the data is anonymised.

b) Cookies and tracking technologies

The Website uses cookies and similar technologies described in detail in the Cookie Policy available at mypropfirm.pl/polityka-cookies.

Legal basis for strictly necessary cookies: Article 6(1)(f) GDPR (legitimate interest) in conjunction with Article 399(3) of the Act of 12 July 2024 – Electronic Communications Law (PKE) – exemption from the consent requirement for cookies necessary to provide the service.

Legal basis for analytical, marketing and affiliate cookies: Article 6(1)(a) GDPR – consent given through the cookie banner, together with Article 399(1) PKE (requirement to obtain consent for access to terminal equipment).

Consent to non-essential cookies is voluntary and may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal (Article 7(3) GDPR, Article 362 PKE).

Tools we use that may process data through cookies:

Google Analytics 4 with Consent Mode v2:

If no consent is given, GA4 sends only anonymised, cookieless signals. If consent is given, GA4 sets cookies to analyse sessions. Data transfers to Google LLC are based on the EU-U.S. Data Privacy Framework.

c) Affiliate links and conversion tracking

Clicking an affiliate link may cause a prop firm or affiliate network to store a cookie in order to calculate a commission. The controller of the data processed through these cookies is the relevant prop firm or affiliate network, not the Website Controller. We encourage you to review the privacy policies of the respective prop firms.

2.3. Newsletter

If you have given separate, voluntary consent to receive the newsletter (through a dedicated subscription form), we process your email address in order to send information about Website updates and partner offers.

Legal basis: Article 6(1)(a) GDPR – consent, in conjunction with Article 398(1) PKE (prohibition of sending commercial information without prior consent).

You may unsubscribe from the newsletter at any time by clicking the “unsubscribe” link in each message or by writing to kontakt@mypropfirm.pl. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

2.4. Vault Program (loyalty program)

The Vault Program is a loyalty program in which we award points, redeemable for rewards (challenge-type accounts), for qualifying purchases made at Partners (prop firms) using the BETZ code, and for activity on the Website. Participation is voluntary and is not a condition for using any other features of the Website. Detailed rules are set out in the Vault Program Terms and Conditions. The Program currently covers only futures-type accounts; an extension to crypto-type accounts is planned.

2.4.1. What data we process

2.4.2. What we do NOT process, and how rewards work

• We do not collect or store payment card data (card number, CVV/CVC code, full billing details). Payment for a purchase is made to the Partner, not to us.
• We do not process sensitive data (special categories of data) within the meaning of Article 9 GDPR.
• We are not a party to your purchase transaction. You enter into the purchase directly with the Partner and pay them in full. We merely confirm that a qualifying purchase was placed and paid for.
• We provide rewards (challenge accounts) from our own funds: we purchase them in our own name, financing them from commission revenue received from Partners. A reward is not a refund or a reduction of the price you paid to the Partner.

The only exception concerning identifying data is described in section 2.4.4a and results solely from a tax obligation. A PESEL number is not sensitive data within the meaning of Article 9 GDPR, but a national identification number subject to special protection; we process it solely on the basis of a legal obligation. The same applies to a NIP number, if we collect it from you (section 2.4.4a).

2.4.3. Purchase verification (proof of purchase)

To verify that an order qualifies for a reward, we ask you to submit proof of purchase (e.g. a receipt or order confirmation) within 14 days of the purchase date. We verify the submitted proof and credit the corresponding Points within 48 hours of submission. Rules:

• we process the submitted proof solely for the one-time purpose of verifying that the order was paid for and qualifies for a reward,
• we do not use it for any other purpose, do not share it further, and do not build an archive of proofs,
• we delete the submitted file promptly after verification, no later than within 14 days of submission,
• only order metadata and the verification result and date remain in our database; the document itself is not retained,
• we do not read or store your card data; please redact your card number before sending.

Verification is currently performed manually. The submitted proof is reviewed by an authorised team member solely for verification purposes, maintaining confidentiality and the principle of limited access (section 8). We are working on automating this process; we will update this notice if the manner of processing changes once it is automated.

Legal basis: Article 6(1)(b) GDPR (performance of the participation agreement) and Article 6(1)(f) GDPR (fraud prevention).

2.4.4. Payout confirmation and leaderboard

You may submit a payout confirmation through a dedicated form in the panel (dashboard), optionally attaching proof of it. The submission contains only an account name or full name and the payout amount; it does not contain sensitive data or card data. We use it to verify and keep a record of your payouts under the Program, awarding 250–400 points for a verified payout. Legal basis: Article 6(1)(b) GDPR (a Program feature you use).

If we make a public Payout Leaderboard available, based on verified payouts in a given calendar month, your inclusion in it and the public display of your data (name/handle and amount) will take place only on the basis of your voluntary consent (opt-in, Article 6(1)(a) GDPR), with a choice to be shown under a handle or anonymously, revocable at any time. Withdrawing consent promptly removes you from the leaderboard.

2.4.4a. Tax data (when receiving a reward)

Issuing a reward (challenge account) constitutes income from other sources for you within the meaning of Article 20(1) of the Polish Act of 26 July 1991 on Personal Income Tax ("PIT Act"). We collect identifying data solely because tax law requires it: we are obliged to prepare and submit a PIT-11 information return (Article 42a of the PIT Act) to the tax authority and to you, regardless of your tax residency. Without identifying data we would not be able to fulfil this obligation.

Only for Participants receiving a reward, and only at the moment of receipt, do we process:

• Participant who is a Polish tax resident (Article 3(1) and (1a) of the PIT Act): first name, last name, residential address (country, voivodeship, county, commune, postal code, city, street, house/apartment number), and a declaration of whether the reward is received in connection with a registered business activity. If not, additionally a PESEL number. If so, a NIP number instead of a PESEL number, and we inform you of the reward's value in PLN and of your obligation to independently report that income in your annual return. We collect the voivodeship, county and commune because the structure of the PIT-11 form requires them; they cannot be reliably derived from the postal code alone,
• Participant who is not a Polish tax resident (Article 3(2a) of the PIT Act): full name, country of tax residency, date of birth, the type and number of an identity document (TIN, passport, national ID, or other) together with its issuing country, foreign residential address, and a declaration stating "I do not have a place of residence for tax purposes in the territory of the Republic of Poland within the meaning of Article 3(1a) of the PIT Act"; you may optionally provide a certificate of tax residency. In this case we do not collect a PESEL number. We prepare a PIT-11 information return for you, indicating the tax identification number provided (TIN or equivalent).

We do not withhold tax on this account; you settle it independently in your annual tax return (PIT-37 or PIT-36). The value of a reward is determined according to market prices in accordance with Article 11(2a) of the PIT Act. We do not collect this data from Participants who only earn points and do not receive a reward.

Legal basis: Article 6(1)(c) GDPR (a legal obligation arising from the PIT Act and the Polish Act of 29 August 1997, the Tax Ordinance).

Providing this data takes place when a reward is received and is voluntary but necessary for it to be issued. Without it we cannot issue the reward or fulfil the tax obligation; your points remain in your account and are subject to the Program's general rules, including expiry (section 7).

2.4.5. Purposes and legal bases (Vault Program)

Consent to the public payout leaderboard is separate and optional. Its absence does not affect participation in the Program or the granting of points, for which consent is not required (prohibition on bundled consent, Article 7(2) and (4) GDPR).

2.4.6. Recipients of data and transfers outside the EEA (Vault Program)

In connection with the Program, your data may be shared, to the necessary extent, with IT and hosting providers (data processing agreements, Article 28 GDPR) and Partners and affiliate networks solely for the purpose of verifying purchases. Verification of social media activity (X, TikTok, YouTube) is carried out by redirecting to those services or by manually checking publicly available information, without logging into our application through those services (no OAuth) and without sharing your account data with them; for this reason they are not treated as data recipients. Some of the recipients listed in this section are based outside the EEA (including in the United States and the United Arab Emirates). Transfers are based on standard contractual clauses (Article 46(2)(c) GDPR), and for entities covered by the EU-U.S. Data Privacy Framework, on the European Commission's adequacy decision. You may obtain a copy of the safeguards used by writing to kontakt@mypropfirm.pl.

2.4.7. Retention periods (Vault Program)

2.4.8. Automated decisions and profiling (Vault Program)

The accrual of points and tiers follows pre-established, deterministic rules described in the Vault Program Terms and Conditions. Purchase verification is performed manually and does not constitute automated decision-making. We do not make decisions about you based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you.

3. Recipients of data

We do not sell your personal data to any third parties for marketing purposes.

4. Transfers of data to third countries

4.1. Data transfers to Google LLC are based on the European Commission’s decision on the EU-U.S. Data Privacy Framework (July 2023).

4.2. For other transfers outside the EEA, the Operator applies standard contractual clauses (SCCs) approved by the European Commission in accordance with Article 46(2)(c) GDPR.

4.3. You may obtain a copy of the safeguards used by writing to kontakt@mypropfirm.pl.

5. Data retention periods

6. Your rights

To exercise the rights listed below, contact us at kontakt@mypropfirm.pl. We will respond to your request within 30 days of receipt (this period may be extended by 60 days in particularly complex cases).

7. Right to lodge a complaint with a supervisory authority

If you believe that we process your data unlawfully, you have the right to lodge a complaint with:

President of the Personal Data Protection Office (UODO)

ul. Stawki 2, 00-193 Warsaw

Phone: 606 950 000

E-mail: kancelaria@uodo.gov.pl

Website: www.uodo.gov.pl

If you live in another EU/EEA country, you may lodge a complaint with the supervisory authority competent for your place of residence.

8. Data security

8.1. We use appropriate technical and organisational measures, including:

• encrypted HTTPS connection (TLS),
• access control based on the principle of least privilege,
• regular data backups.

8.2. Despite the security measures used, the Operator cannot guarantee the absolute security of data transmission over the Internet.

8.3. In the event of a personal data breach likely to result in a high risk to the rights and freedoms of the User, the Operator will inform the User without undue delay (Article 34 GDPR).

9. Data of persons under 18 years of age

The Website is not intended for persons under 18 years of age. If we become aware that we have collected data of a minor, we will delete it without undue delay. If you are aware of such a situation, please contact us at: kontakt@mypropfirm.pl.

10. Changes to this Privacy Policy

We will inform you of material changes by posting a notice on the Website at least 14 days in advance and – in the case of registered Users – by email. The date of the last update is indicated at the beginning of this document.

11. Contact

MYPROPFIRM SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ

Podhalańska 23, Kluszkowce 34-440

NIP: 7352939866 | REGON: 544343026 | KRS: 0001230981

E-mail: kontakt@mypropfirm.pl

We respond within 30 days from the date of receiving the inquiry.