Polski   Back to the home page

Privacy Policy

Effective from 10 October 2026. Updated 7 October 2026: Google Analytics statistics only with your consent, cookie settings with a choice of categories, and a renewed request for consent after 12 months (sections 2, 3 and 6). Updated 9 October 2026: partner links (Travelpayouts) – script only with your consent (sections 2, 3, 5 and 6). Updated 10 October 2026: reviews of Plans via a form on the download page, counting purchases in statistics, and a newsletter with a free checklist (sections 2, 3 and 6). Further update of 10 October 2026: the contact and review forms are sent from our own server instead of via the Formspree service, and after sending the contact form you receive an automatic e-mail confirmation (sections 2, 3 and 5). Updated 13 October 2026: contact via WhatsApp (sections 2, 3 and 5), the time4china app – purchased Plans saved in your phone's storage (section 6) and the account: signing in with an e-mail code and assigning purchases to the e-mail address used at checkout (sections 2, 3 and 6). Updated 14 October 2026: anonymous, aggregate app usage counts (section 6) and saving the trip date, ticked-off items (programme and pre-departure checklist) and day notes with your account (sections 3 and 6). Second update of 14 October 2026: personal plan key – the download page and the Plan in the app are opened with the key from the purchase e-mail, with device and download limits (sections 2 and 6). Updated 15 October 2026: the Plan’s PDF files are marked at the bottom of each page with the buyer’s name, a shortened e-mail address and the order number (section 2).

In short

  • We only collect data you give us yourself: your name, e-mail (or phone number, if you message us on WhatsApp) and message, and when you buy, the data needed for payment and accounting.
  • Payments are handled by Stripe. We do not see or store your full card details.
  • We only turn on visitor statistics (Google Analytics) if you agree. We do not use advertising tools.
  • The website loads the map, photos, exchange rates and libraries from external servers, which learn your IP address in the process. We describe this in section 4.
  • You can ask to see or delete your data at any time.
LanguageThis is a translation of the Polish Polityka prywatności. It has the same content and is provided so that you can easily understand how we process your data.

1. Data controller

The controller of your personal data is time4china, selling as an unregistered business activity (“we”). Our correspondence address, including for anything relating to personal data: contact@time4china.com or kontakt@time4china.pl. We have not appointed a data protection officer, as we are not required to.

2. What data we process and why

PurposeDataLegal basis (GDPR)How long
Replying to a question sent by e-mail, through the form or on WhatsApp name, e-mail address, message content; on WhatsApp: phone number, profile name and photo, and message content Art. 6(1)(f) – our legitimate interest in replying to your message until the correspondence ends, then for up to 12 months, unless it concerns an order
Accepting an order, preparing a quote and delivering the Plan name, e-mail address, chosen variant, the travel information you give us Art. 6(1)(b) – concluding and performing the contract for the duration of the contract, then until the limitation period for claims expires
Accounting, receipts, tax obligations (sales records) full name, e-mail address, address (for a receipt), transaction data Art. 6(1)(c) – a legal obligation under tax and accounting law 5 years from the end of the calendar year in which the tax payment deadline passed
Buying a ready-made Plan through Stripe (“Buy now”): concluding the contract, making the Plan available, confirming the purchase by e-mail and documenting your consent to immediate delivery of the Plan e-mail address and full name entered on the payment page, the chosen Plan, amount, date and status of payment, record of your consent (date and wording) Art. 6(1)(b) – performing the contract; (c) – the obligation to confirm the contract under the Polish Consumer Rights Act; (f) – our interest in being able to show that you gave your consent until the limitation period for claims expires, and accounting data for 5 years from the end of the year in which the tax payment deadline passed
Account: signing in with an e-mail code (no password) in the time4china app and on the website – access to purchased Plans on every device; the account is created automatically when you buy through Stripe or when you first sign in, and Plans bought with another address are added to it with their plan key a hash of the e-mail address entered at checkout – the address cannot be read from it – and the list of Plans in the account (Plan, download page address, plan key, date of purchase or of adding); when signing in: your e-mail address (only to send the code, we do not store it), a one-time code and a session identifier (stored on the server only as hashes) and sign-in dates; once you sign in, also the app data you enter yourself: the date of the first day of your trip, the programme and pre-departure checklist items you tick off and your notes for each day (so they are on all your devices; notes on the “Emergency help” card are not included); a hash of your IP address for the attempt limit (2 days) Art. 6(1)(b) – performing the contract (making the purchased Plan available, also on other devices); attempt limits – Art. 6(1)(f), our interest in keeping the website secure until the account is deleted (the “Delete account” button in the app or a message to us); the code – 15 minutes, the session – until you sign out or 12 months without use
Plan key: making the purchased Plan available to the buyer – the download page, PDF files and the Plan in the app are opened with the personal key from the e-mail sent after purchase; device and download limits protect Plans from being distributed; the Plan’s PDF files carry a mark at the bottom of each page with the buyer’s name and the order number – this discourages sharing the Plan and lets us tell which purchase a copy distributed without permission comes from the key and the Plan it belongs to, the creation date, a hash of the account's e-mail address (when the Plan is assigned to an account); hashes of random identifiers of the browsers and apps in which the Plan was opened with the key (up to 6), with dates; the number of PDF downloads on the current day; for 7 days after purchase – the link between the key and the Stripe payment session identifier (so the page opens right after payment without entering the key); a hash of your IP address when wrong keys are entered (attempt limit, 2 days); for the mark in PDF files: the name given at checkout, a shortened e-mail address (first letter and domain, e.g. j***@gmail.com) and the Stripe order number – for a Plan we assign manually, your name if you give it to us and the shortened e-mail address Art. 6(1)(b) – performing the contract (delivering the Plan and access to it); device, download and attempt limits and the mark in PDF files – Art. 6(1)(f), our interest in protecting Plans from unauthorised distribution and in keeping the website secure the key – for as long as you use the Plan (the licence is unlimited in time) or until deleted at your request; the link to the payment – 7 days; the download count – until the end of the day; the IP hash – 2 days; the name and shortened e-mail for the mark – as long as the key, and when you delete your account we remove them from the key (the mark keeps only the order number)
Handling complaints, withdrawals from the contract and any claims data from the order and correspondence Art. 6(1)(c) and (f) – obligations under the Polish Consumer Rights Act and our interest in defending against claims until the limitation period for claims expires
Security and proper operation of the website IP address, date and time, browser type, address of the page visited (server logs) Art. 6(1)(f) – our legitimate interest in keeping the website secure for as long as the hosting provider (OVH) keeps the logs, no longer than 12 months
A review of a Plan you bought (the “How would you rate the plan?” form on the download page) and publishing it on the Plan's page rating, review text, signature (if you give one), Plan, language, whether you agreed to publication Art. 6(1)(f) – our legitimate interest in learning your opinion and improving our Plans; publishing the review with your signature – Art. 6(1)(a), your consent (a checkbox in the form), which you can withdraw at any time by writing to us a published review – until you withdraw consent or the Plan is removed from our offer; an unpublished one – up to 12 months
Newsletter with the free “China pre-departure checklist” – China travel tips and information about our Plans and offers (sign-up via a form on the website) e-mail address, date, page and IP address at sign-up and when you confirm it (clicking the link in the e-mail), information on e-mail opens and link clicks (MailerLite tracking pixel and links) Art. 6(1)(a) – your consent (the ticked box at sign-up, confirmed by e-mail), including consent to commercial information by electronic means; withdraw it at any time with the “unsubscribe” link in every e-mail or by writing to us until you unsubscribe; after that only a record that you unsubscribed (so we don't write again) and of your earlier consent – until claims become time-barred
Website visitor statistics (Google Analytics 4) – only with your consent a random browser identifier stored in cookies (_ga, _ga_*), pages visited and clicks, a Plan purchase (which Plan and its price – without the details you enter at payment), where you came from (e.g. a search engine), device and browser type, approximate location (country, city) derived from your IP address, which Google Analytics does not store Art. 6(1)(a) – your consent, which you can withdraw at any time (“Cookie settings” in the website footer) cookies – up to 2 years or until you withdraw consent; data linked to the identifier in Google Analytics – 2 months, after which only aggregate statistics remain
Partner links (Travelpayouts) – recognising that a booking on a partner's site (e.g. Trip.com, Booking.com, Airalo) came from our site, and turning links to booking sites into our partner links – only with your consent cookies and similar technologies, pages visited and clicks, device and browser type – without establishing your identity Art. 6(1)(a) – your consent, which you can withdraw at any time (“Cookie settings” in the website footer) until the purpose is achieved or until you withdraw consent

Providing data is voluntary, but without an e-mail address we cannot reply to your message or deliver the Plan. Accounting data is required by law.

Please do not send us health data, your passport number or payment card details. We can prepare the Plan without them.

The form on the website sends the data you enter (name, e-mail, chosen variant, message) to our server (OVH hosting), from which we e-mail it to our mailbox. We also send an automatic confirmation to the address you provide, so you know your message has reached us. We do not store the content of submissions on the server. To protect the forms from spam, we keep a hash of your IP address and e-mail address on the server for 2 days, from which these addresses cannot be read directly (legal basis: our legitimate interest in keeping the website secure, Article 6(1)(f) GDPR). The newsletter sign-up form sends your e-mail address directly to MailerLite only when you click the sign-up button – before that, the page does not connect to MailerLite. The review form on the Plan download page works the same way as the contact form (rating, text, signature, consent to publication) – it does not ask for your e-mail address and sends no confirmation.

3. Who receives your data

Your data may only be received by entities that help us run the website and act on our behalf (processors), or on their own account where the law requires it:

We do not sell data and do not pass it on to airlines, hotels or insurers.

4. External resources loaded by the website

To display the map, photos and current exchange rates, your browser connects directly to the servers of the companies below. With each such connection, the company technically receives your IP address, browser information and the address of our website. We do this on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in displaying the website correctly and attractively.

ServiceWhat it is forProvider
jsDelivrmap libraries (Leaflet, TopoJSON) and country bordersProspect One sp. z o.o. (Poland), CDN including Cloudflare and Fastly – privacy policy
Esri ArcGISmap base layers (tiles)Esri Inc. (USA) – privacy policy
National Bank of Poland APIcurrent average exchange rates for indicative price conversionNarodowy Bank Polski (Poland) – privacy policy
Wikimedia Commonsphotos of places for which we have no photos of our ownWikimedia Foundation Inc. (USA) – privacy policy

We serve the fonts (Manrope, Noto Serif SC) from our own server – displaying them does not pass your data to anyone else. We have no influence on how the companies listed above process data as part of their own services. You can limit these connections, e.g. with browser extensions that block external resources, but the map and parts of the website’s appearance may then not work.

5. Transfers outside the European Economic Area

Some of the providers listed (ImprovMX, Google, Esri, Wikimedia Foundation, Stripe – within the Stripe group, WhatsApp – within the Meta group – and CDN providers) are based in or have servers in the USA. Data is transferred on the basis of the European Commission’s adequacy decision for companies certified under the EU-U.S. Data Privacy Framework or on the basis of standard contractual clauses approved by the European Commission. You can obtain a copy of these safeguards by writing to us.

Travelpayouts (Go Travel Un Limited) is based in Hong Kong, for which the European Commission has not issued an adequacy decision. Data related to partner links is transferred there only on the basis of your explicit consent (Article 49(1)(a) GDPR), and data protection there may be lower than in the EU. According to the provider, data is stored on servers in the EU or in the AWS cloud.

6. Cookies and browser storage

  1. We only set Google Analytics cookies (_ga, _ga_*) if you give your consent on the banner: with the “Accept all” button or by switching on “Analytics” under “Customise”. The analytics switch is off by default, and refusing (“Reject all”) is as easy as accepting. Without consent, Google Analytics does not run at all and your browser does not connect to its servers. We do not use advertising or marketing cookies. When analytics is on, just before you go to payment we store the chosen Plan and its price in this browser tab's memory (sessionStorage) – after you return from payment it is used only to count the purchase in Google Analytics and is deleted straight away (it also disappears when you close the tab).
  2. We only load the Travelpayouts affiliate network script (cookies and similar technologies) if you switch on “Partner links” in the cookie settings or click “Accept all”. Once you withdraw consent, it is no longer loaded. On the website and in the plans you may also find links marked “partner link”: clicking one takes you to the partner's site (e.g. Trip.com, Booking.com, Airalo), which may set its own cookies under its privacy policy. If you book something through such a link, we earn a commission – your price stays the same.
  3. You can change or withdraw your consent at any time with the “Cookie settings” button in the footer of every page. When you withdraw consent, we delete the Google Analytics cookies from your browser. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
  4. We remember your decision (consent or refusal) in your browser together with its date and the version of the cookie settings. After 12 months we will ask you again, and sooner only if we change the tools we use. You can see the date of your last choice in “Cookie settings”.
  5. The website stores settings that you choose yourself in your browser’s storage (localStorage): the language version (PL/EN), the currency for displaying prices, the theme (light/dark), the text size and colour-blind mode, and your decision on consent to statistics (with its date and settings version). They are necessary to remember your choice, are not sent to us and are not used for tracking. Such storage does not require consent because it is strictly necessary to provide the service you request (Article 399(3) of the Polish Electronic Communications Law of 12 July 2024).
  6. On the download page (time4china.com/pobierz/), after you enter a plan key or open the link from the e-mail, we store a strictly necessary cookie “t4c_klucze” (valid for 400 days, not accessible to scripts on the page): a random identifier of this browser and the keys of the Plans you open in it – so you do not have to enter the key for every download and so that we can count the key's devices (section 2). It is not used for tracking or statistics, is not shared with anyone and does not require consent for the same reasons as in the point above. You can delete it by clearing your browser's cookies.
  7. The time4china app (the page time4china.com/aplikacja/, which you can add to your phone's home screen) saves in your device's storage (localStorage and the browser cache – Cache Storage) the Plans you add to it, their keys and download page address, a random app identifier (created by the app itself – it does not come from your phone), the most recently downloaded exchange rates, the place where you stopped reading a Plan, the date of the first day of your trip, the programme and pre-departure checklist items you tick off, your notes for each day and on the “Emergency help” card (if you enter them), the most recently downloaded list of our Plans and the content of the pre-departure checklist while signing in, for 15 minutes, the e-mail address the code was sent to (so that after switching to your mailbox you return straight to entering the code) and, once you sign in, the session identifier and the account's e-mail address (to show which account you are signed in to) – so that Plans work without internet. This data stays on your phone and is not sent to us – except the trip date, ticked-off items (programme and pre-departure checklist) and day notes, which we also save with your account once you sign in (section 3), and the key and app identifier, which the app sends when opening a Plan with its key (section 2). The app downloads exchange rates directly from the NBP API (section 5) and from time to time checks on our server whether a newer version of an added Plan is available, and downloads the current list of our Plans (without any data about you). While doing so, our server counts – only as daily totals – how many times the app downloaded this list and how many Plans were added to it; we do not store IP addresses, device identifiers or anything from your phone. This storage does not require consent for the same reasons as in the point above. You can delete the app's data with the “Remove plans from this phone” button in the “About” tab, by uninstalling the app or by clearing the site data.
  8. You can delete them at any time in your browser settings (“Clear site data”).
  9. If we add other analytics or marketing tools in the future, we will ask for your consent first and update this policy.

7. Your rights

You have the right to:

To exercise your rights, write to contact@time4china.com or kontakt@time4china.pl. We will reply within one month.

8. Other information

  1. We do not make automated decisions and do not profile you.
  2. We use technical and organisational measures to protect data, including an encrypted HTTPS connection.
  3. The website contains links to other services (e.g. gov.pl, Wikimedia). Once you click them, the privacy rules of those services apply.
  4. This policy may change, e.g. when we add new services or change providers. The current version, with its effective date, is always on this page.
  5. The rules for concluding contracts are set out in the Terms and Conditions.