What we do with your information

Polonia Citizenship is a service of Five to Europe s.c. The controller of your personal data is:

Barbara Cebula Dorota Dwojacka Marta Daszkiewicz-Daniszewska FIVE TO EUROPE spółka cywilna
ul. Wojska Polskiego 74/8, 91-809 Łódź, Poland
NIP 7262700937 · REGON 526517730

For anything about your data, write to contact@fivetoeurope.com or simply reply to any Polonia Citizenship message you have received at hello@poloniacitizenship.com. Both reach the same team.

When you submit the eligibility form we ask for, and keep, exactly these fields:

• First name, to address you in the reply.
• Email address, so we can send the assessment back.
• Phone number (optional), only if you choose to give it, so we can follow up on your case by text as well as email.
• Your family story, including information about your ancestors and relatives: names, approximate dates, places in Poland, departure years, and any documents you mention.
• Where you live (country or state), if you tell us, because it affects how your case is handled.

If your case moves forward and you fill in the case questionnaire, we also collect the details that questionnaire asks for: dates and places of birth, marriages, citizenship history of your ancestors, and copies of documents you choose to upload.

Alongside the submission, we also store technical context to detect spam and understand which channels bring real people:

• Marketing attribution: UTM parameters and Google Ads click IDs (gclid, gbraid, wbraid), if present and permitted by your consent.
• Referrer: the page that linked you here, if your browser sends it.
• Browser user-agent: the standard string browsers report (no fingerprinting beyond that).
• Hashed IP: a one-way SHA-256 hash truncated to 16 characters; we cannot recover the original address. Used only to flag suspicious patterns.

We do not ask for, and do not store, payment information at the eligibility stage.

Under the GDPR, we process your data for these purposes:

• To give you a preliminary assessment of your Polish citizenship case and answer your questions. Legal basis: Article 6(1)(b) GDPR, steps taken at your request before entering into a contract.
• To deliver the service if you decide to work with us. Legal basis: Article 6(1)(b) GDPR, performance of a contract.
• To stay in contact with you about the inquiry you started. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in responding to and following up on inquiries.
• To meet legal obligations such as accounting and tax rules. Legal basis: Article 6(1)(c) GDPR.
• To establish, exercise, or defend legal claims if that ever becomes necessary. Legal basis: Article 6(1)(f) GDPR.
• To measure which pages and ads work and to detect spam. Legal basis: Article 6(1)(f) GDPR, and your consent where cookies or advertising identifiers are involved.

Providing your data is voluntary. Without your contact details and family story we simply cannot assess your case, but nothing here is ever a condition for anything beyond that.

Submissions are stored in a Postgres database hosted by Supabase in the European Union (Frankfurt region). Connections are encrypted in transit (TLS) and the database is encrypted at rest by the provider. Direct read or write access from the public internet is blocked at the row level; only our server can insert new rows, using a private service-role key that is never exposed to your browser.

We use a small number of third-party services to operate Polonia Citizenship. Each only sees the data it needs:

• Render: hosts the website; sees server logs (IP, user-agent) for security and operations.
• Supabase: stores submissions (as above).
• Resend: sends and receives our email (sees addresses and message content) only in connection with your inquiry.
• Google Analytics 4 and Google Ads: measure traffic and ad performance (see "Cookies and analytics" below). With your advertising consent, this includes Enhanced Conversions, where your email (and phone, if given) is normalized and turned into a one-way SHA-256 hash on our server and sent to Google to match a conversion to an ad click. We never send Google your family story, ancestry, nationality, religion, documents, or any case details.
• Legal advisors: where your case requires legal review, under confidentiality.
• Accounting: our accounting provider, for invoicing and tax records if you become a client.

None of these providers have permission to use your data for their own marketing.

The above excludes text messaging originator opt-in data and consent; this information will not be shared with any third parties, excluding aggregators and providers of the text message services.

Some of the providers above (for example Render, Resend, and Google) process data in the United States. Where data leaves the European Economic Area, the transfer is covered by the European Commission's adequacy decision for the EU-US Data Privacy Framework or by Standard Contractual Clauses, together with the technical safeguards described on this page.

If you leave your phone number on the eligibility form and tick the text-message box, you agree we may text you about the inquiry you started. We send a one-time welcome message confirming we have your details, plus the occasional case-related follow-up. This is low-volume and transactional, not marketing.

Message and data rates may apply. You can reply STOP at any time to opt out, or HELP for help.

Your phone number and your consent to be texted are never shared or sold. Your mobile opt-in information is not shared with, or sold to, any third party or affiliate for marketing or promotional purposes. It is used only by Polonia Citizenship, to follow up on the inquiry you started. The hashed ad measurement described elsewhere on this page is separate, based on your consent, and never involves your text-message opt-in or any marketing to you. Full detail is in our text message terms.

We tailor consent to where you are. In the EU, EEA, UK, and Switzerland we show a cookie banner and load nothing for analytics or advertising until you accept. In the United States we do not interrupt you with a banner; instead the Privacy choices link in the footer lets you turn ad measurement, personalization, and analytics on or off at any time.

We use Google Consent Mode v2 and honor the Global Privacy Control browser signal: when it is on, we treat it as an opt-out of advertising data sharing and do not send click IDs or hashed email or phone to Google Ads. You can withdraw consent at any time from Privacy choices, which turns these signals off and clears the related tracking storage in your browser.

We use Google Analytics 4 and Google Ads tagging to understand which marketing channels bring real visitors. These services set first-party cookies (typical names like _ga, _gid, _gcl_au) and collect:

• Page views and scroll behavior
• Approximate geographic region (country/city level, from IP)
• Device type and browser
• How you arrived (referrer, ad click)

You can opt out via your browser's privacy controls, a tracking blocker, or the official Google Analytics opt-out add-on.

We keep your data for as long as it is needed for the purposes above: while we assess and handle your inquiry, and, if you become a client, for the duration of the service. After that, we keep what the law requires us to keep (for example accounting records) and what is needed until potential claims are time-barred under the applicable statute of limitations. If you never move forward with us, you can ask us to delete your submission at any time. Backups age out within 30 days.

The GDPR gives you the right to:

• Access the data we hold about you.
• Correct anything that is wrong.
• Have it deleted.
• Receive a copy in a portable format.
• Restrict or object to certain processing.
• Withdraw consent at any time, without affecting processing done before the withdrawal.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland), or with your local data-protection authority.

Residents of California (CCPA/CPRA) and similar US-state regimes have parallel rights: to know, delete, correct, and opt out of any "sale" or "sharing". As noted, we do neither.

To exercise any of these rights, email us (see below) or simply reply to any Polonia Citizenship message you have received. We respond within 30 days and will not ask for anything beyond what is needed to verify your request.

For privacy questions, deletion requests, or anything else about your data:
contact@fivetoeurope.com
hello@poloniacitizenship.com

Polonia Citizenship is a service of Five to Europe s.c., ul. Wojska Polskiego 74/8, 91-809 Łódź, Poland. This policy will be updated as the service grows; the "as of" date at the top reflects the current version.