The purpose of this Privacy Policy is to inform Customers and Users about the principles of personal data processing by the Takzyli.pl portal, operated by Progrise Szymon Konieczny, with its registered office at ul. Marcina Radockiego 156/1, 40-645 Katowice, Poland, VAT ID: PL6342611135.
The controller of personal data is Progrise Szymon Konieczny, ul. Marcina Radockiego 156/1, 40-645 Katowice, Tax ID (NIP): 6342611135, REGON: 243479052. In matters concerning personal data, you can contact us at the e-mail address biuro@takzyli.pl or by post at our registered office address. We have not appointed a data protection officer.
Progrise Szymon Konieczny, as the portal administrator, places great importance on the security of personal data of Customers and Users of the Takzyli.pl platform. Despite using advanced data protection methods, their complete security on the Internet cannot be guaranteed. We require personal data only when it is necessary to provide our services, for example, during account registration, where we process an e-mail address.
We process personal data for the following purposes and on the following legal bases set out in Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR):
- Account and provision of services. E-mail address, first name and surname, password (stored only in the form of an encrypted hash) and the content added to Profiles — in order to create the Account, maintain Profiles and provide the services described in the Terms of Service (Article 6(1)(b) GDPR).
- Orders, payments and billing. First name and surname, e-mail address, billing address and Medallion delivery address, telephone number for the courier, tax identification number (NIP, if an invoice to a company is ordered) and order data — in order to fulfil the order (Article 6(1)(b) GDPR) and to comply with tax and accounting obligations (Article 6(1)(c) GDPR). An Account for the person who placed the order may be created automatically on the basis of the order data.
- Service-related messages. Order confirmations, links for setting a password, notifications of new memories and access requests — in order to provide the services (Article 6(1)(b) GDPR).
- Memories added by Guests. A first name or signature, optionally information about the relationship with the deceased person, and the content of the memory — published on the Profile in accordance with its owner's settings and sent to the owner by e-mail. The legal basis is our legitimate interest in operating the memories feature used by the Guest (Article 6(1)(f) GDPR).
- Requests for access to private content. The first name and surname, e-mail address and message of the person requesting access — passed on to the Profile owner and, once the owner agrees, used to send an access link (Article 6(1)(f) GDPR).
- Anniversary reminders. The e-mail address of the Profile owner and the addresses of persons designated by the owner — in order to send reminders of the chosen anniversaries. The legal basis is the legitimate interest of the Profile owner and our own, consisting in reminding loved ones of anniversaries (Article 6(1)(f) GDPR). Every person added by the Profile owner is informed of this and can opt out of the reminders with a single click. On a public Profile a visitor may also sign up their own address — the legal basis is then their consent (Article 6(1)(a) GDPR), confirmed by clicking a link in an e-mail. Until it is confirmed we send nothing but that e-mail; once confirmed, the address is visible to the Profile owner. Consent can be withdrawn at any time with a single click in every message.
- Contact. Data provided in the contact form or in an e-mail (first name, e-mail address, content, attachments) — in order to respond (Article 6(1)(f) GDPR). Messages from the form go to our e-mail inbox and are not stored in the Service's database.
- Grave location. If a person scanning the Medallion at the grave agrees in their browser to share their location, we record the coordinates, the accuracy and the time of the measurement — without any data identifying that person. We store the 5 most recent measurements, which help the Profile owner indicate the place of burial (Article 6(1)(f) GDPR).
- Security and abuse prevention. Protection of forms using Google reCAPTCHA, limiting the number of attempts (the IP address is processed only in the server's memory), a log of administrative actions and server logs — in order to ensure the security of the Service (Article 6(1)(f) GDPR).
- Partner referrals. If a User reaches the Service via a partner's link (e.g. a funeral home's), we attribute to that partner an order placed during the same visit and, once the User has consented in the cookie banner, also an order placed within 30 days; the partner's identifier is then stored in the tz_ref cookie (Article 6(1)(f) GDPR).
- Visitor statistics. Google Analytics — only after consent has been given in the cookie banner (Article 6(1)(a) GDPR).
- Marketing. On the terms described in the “Marketing Consents” section (Article 6(1)(a) GDPR).
- The “Life story” feature. On the terms described in the section devoted to this feature.
- Claims. Establishing, pursuing or defending claims (Article 6(1)(f) GDPR).
Profiles concern deceased persons. Data of deceased persons is not personal data within the meaning of the GDPR; however, we treat it with due respect for their memory and for the personal rights of their loved ones. Profiles may also contain data of living persons — family members and acquaintances (e.g. first names, relationships, photos, memories). The source of this data is the Profile owner, who, in accordance with the Terms of Service, should have consent to publish it. We process it in order to present the Profile in accordance with its privacy settings (Article 6(1)(f) GDPR). A person whose data appears in a Profile may exercise the rights described below, in particular request its deletion or object to its processing, by writing to biuro@takzyli.pl.
When registering an account, the User may give separate, voluntary marketing consents:
- consent to receive commercial information about Takzyli.pl (news, offers and promotions) at the e-mail address provided,
- consent to be contacted by telephone and SMS for marketing purposes, at the telephone number saved in the User's account.
Each consent is independent of the others and is not a condition of creating an account or using the services. No consent box is ticked by default. Marketing processing is based on the User's consent (Article 6(1)(a) GDPR) and, for commercial messages and telephone contact, additionally on Article 398 of the Polish Electronic Communications Law of 12 July 2024.
Each consent is recorded together with the date it was given and the version of the wording it referred to. We keep this record in order to demonstrate compliance, for as long as the consent is in force and for the limitation period for any related claims after it is withdrawn.
Consent may be withdrawn at any time and without giving a reason - directly in the user panel, under Account settings → “Marketing consents”, or by writing to the contact e-mail address available on our website. Withdrawal does not affect the lawfulness of processing carried out before it. The User's contact details are not shared with third parties for those parties' own marketing.
To ensure high-quality services, certain information about Users may be collected while using the Takzyli.pl platform. The platform uses services from external technology providers who may collect data that allows for User identification. External companies are committed to maintaining data confidentiality and using it solely for the purpose of providing services to Takzyli.pl.
The Service uses cookies and the browser's local storage. Those that are necessary to provide a service requested by the User are used without consent; all others — only after consent has been given in the banner (Article 399 of the Electronic Communications Law).
Necessary cookies and data stored in the browser:
- authjs.session-token, authjs.csrf-token, authjs.callback-url — login and session security; the session expires after 30 minutes of inactivity,
- NEXT_LOCALE — the selected language of the Service; up to 1 year,
- tz_access_[profile number] — access to a code-protected Profile after the correct code has been entered; 7 days,
- tz_share_[profile number] — access to a Profile via a sharing link; up to 7 days,
- in the browser's local storage: the choice made in the cookie banner, information about a lit candle, information that the tutorial has been viewed, and preview settings for persons editing a Profile.
Cookies requiring consent: Google Analytics (including _ga, _ga_*) — visitor statistics; up to 2 years, and tz_ref — the identifier of the partner whose link brought the User to the Service; 30 days. Google reCAPTCHA, which protects forms against abuse, loads only on pages with a protected form (e.g. contact, registration or password reset) and, on a Profile page, only once the visitor opens or starts filling in such a form (e.g. an access request, a memory or a reminder sign-up). It may then store its own cookies and analyse information about the device on the terms set by Google; it does not load on the other pages of the Service.
Consent can be changed or withdrawn at any time by clicking “Cookie settings” in the page footer — the banner will then appear again, and the Google Analytics and tz_ref cookies will be deleted. The browser also allows cookies to be blocked; blocking the necessary cookies will make it impossible to use some functions of the Service, e.g. logging in.
We do not sell personal data. It may be disclosed only to companies that provide services to us, and only to the extent necessary to provide those services. These are:
- OVH Sp. z o.o. — the server on which the service and its database run,
- Railway — auxiliary infrastructure (backup and test environment),
- Cloudflare — storage of photos and files added to profiles and of database backups,
- AfterMarket.pl — sending and receiving e-mails,
- Stripe Payments Europe, Limited — handling of payments and of the payment form,
- EasyCart — handling of orders placed through the external EasyCart cart,
- the carrier (postal operator or courier company) — delivery of the Medallion; it receives the recipient's first name and surname, the delivery address and the telephone number,
- Google — protection of forms against abuse (reCAPTCHA) and, once you consent to cookies, visitor statistics (Google Analytics),
- Anthropic Ireland, Limited — only when the “Life story” feature is used (see below).
Some page elements are loaded from other providers' servers only when the User clicks to display them: Google (the partner map on the home page, YouTube videos added by Profile owners — in YouTube's privacy-enhanced mode, youtube-nocookie.com) and Vimeo (videos added by Profile owners). After the click, the browser connects directly to that provider's servers, which receive the IP address and information about the browser and process them under their own rules. Fonts are served from our own server. Maps of places of birth and burial are images the Service's server prepares from OpenStreetMap data (© OpenStreetMap contributors): the visitor's browser does not connect to OpenStreetMap, and the Service's server passes on no data about the visitor. Clicking a map or the directions button opens Google Maps in a new tab, which processes data under its own rules.
Some of these companies or their subcontractors process data outside the European Economic Area, in particular in the United States. In such cases the transfer is based on standard contractual clauses approved by the European Commission or on a Commission decision finding an adequate level of data protection.
Personal data is disclosed to other parties only when required by law. The Takzyli.pl platform may contain links to external sites that have their own Privacy Policies. Progrise Szymon Konieczny is not responsible for the privacy policies of these sites.
At the express request of a profile's owner, we prepare a draft story of the deceased person's life using the Claude artificial intelligence model provided by Anthropic Ireland, Limited.
- What we send. The profile content after automatic pseudonymisation on our server: first names and surnames, contact details, addresses, identification numbers and exact dates are replaced with placeholders, and only the year is kept from dates. Place names and years remain, as they are needed to describe the historical background. The mechanism is automatic and may not recognise every mention, e.g. a rare first name or a nickname.
- What we do not send. Photos or recordings (only their captions, also pseudonymised), sections marked as private, memories added by guests, the grave location or account data.
- Purpose and legal basis. Preparing the draft story at the User's request (Article 6(1)(b) GDPR). Data of other people mentioned in the profile is processed for this purpose on the basis of our legitimate interest in performing the service ordered by the User (Article 6(1)(f) GDPR).
- Provider. Anthropic processes the data as a processor under a data processing agreement. The data may also be processed in the United States; the transfer is based on standard contractual clauses approved by the European Commission. Anthropic does not use the submitted content to train models and deletes it within 30 days, unless longer retention is necessary to enforce its usage policies or is required by law.
- Storage on our side. Real names are put back into the text only on our server. We keep the draft and the published story together with the profile and delete them with it, as well as the technical record of each generation (text with placeholders, without names). We keep only data on the number and cost of operations, for billing and abuse prevention.
- Publication. Nothing is published automatically. The story appears on the profile only after the User approves it and is labelled as prepared with the help of artificial intelligence.
- Account and Profiles — for the duration of the Agreement. After the Account is deleted, we delete the data within 30 days, except for data that we must retain under the law or in order to defend against claims.
- Orders and accounting documents — for 5 years, counting from the end of the calendar year in which the tax payment deadline expired.
- Memories, access requests and addresses for reminders — until they are deleted by the Profile owner or the Profile is deleted. Opting out of reminders immediately stops them from being sent, and the address is deleted 30 days after the opt-out. A visitor's unconfirmed sign-up is deleted after 7 days.
- Correspondence — for the time needed to deal with the matter, and then until the limitation period for any claims expires.
- Data processed on the basis of consent — until the consent is withdrawn; the record of consent in accordance with the “Marketing Consents” section.
- Server logs, including IP addresses — up to 14 days; the log of administrative actions — until the limitation period for claims expires.
- Database backups — up to 90 days; after this time they are automatically deleted.
Every person whose data we process has the right to:
- access their data and obtain a copy of it (Article 15 GDPR),
- rectify or complete their data (Article 16 GDPR),
- request the deletion of their data (Article 17 GDPR),
- request restriction of processing (Article 18 GDPR),
- transfer the data they have provided to us, in a structured format (Article 20 GDPR),
- object to processing based on legitimate interest, and in the case of marketing — at any time (Article 21 GDPR),
- withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal,
- lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).
To exercise your rights, please contact us at biuro@takzyli.pl. We respond without undue delay and no later than within one month; in particularly complex cases this period may be extended by a further two months, of which we will inform you. Profiles can be deleted at any time in the user panel, and the Account — yourself under Account settings or upon a request sent to the above address.
Providing data is voluntary, but necessary to create an Account, place an order or use a given feature; invoice data is required by tax regulations. Without it we cannot provide the given service. We do not make decisions concerning anyone that are based solely on automated processing, including profiling, and that would produce legal effects concerning or similarly significantly affect the person concerned. Automated safeguards (e.g. reCAPTCHA or the filters of the “Life story” feature) may reject an individual request or temporarily restrict a feature — in such a case you can contact us and the matter will be reviewed by a human.
If you have any questions or suggestions regarding the Privacy Policy, please contact us by e-mail. This Privacy Policy may be updated, so we encourage you to regularly review this page.
Last updated: 1 November 2026.
