Privacy policy
Version and last update: 22 September 2026
1. Controller and roles
DMTcorp Mateusz Gawlik, Polish tax ID 6793062044, contact@operator-egzamin.pl controls account, contact and billing data. A school controls candidate data it submits; DMTcorp processes that data on the school's instructions.
2. Data and purposes
We process school and user details, candidate name and date of birth, answers and results, payment and invoice identifiers, and limited technical data to provide the contract, mock exams, reports, billing, support and security.
3. Legal bases
We rely on contract performance, legal duties, legitimate interests in security and claims, and consent for analytics or marketing. Consent may be withdrawn without affecting earlier processing.
4. Registration security
Passwords are ultimately stored as secure hashes. During paid signup the form data, including the password, is briefly encrypted with a dedicated key until payment confirmation; the account then receives a password hash and pending data is deleted under the retention policy. Access tokens are hashed or held in HttpOnly cookies.
5. Recipients
Providers include Neon, Vercel, Stripe, PayU, iFirma/KSeF, OVH, optional Google/GitHub OAuth, and Google Analytics only after consent. Each receives only the data required for its service.
6. Retention
Completed exam results and answers have no automatic deletion deadline, so exam history and pass rates remain available. Schools may request deletion of their data. Abandoned sessions are deleted after 24 hours; defaults for PDF reports and incomplete signups are 30 days and 7 days respectively. Accounting records are kept as required by law. Technical periods may be configured by the operator.
7. Your rights
You may request access, a copy, correction, erasure, restriction, portability or object, and complain to the Polish data protection authority. For candidate records, also contact the school that controls them.
8. Cookies and transfers
Necessary cookies maintain sessions, locale, active school and privacy choices. Analytics starts only after consent and can be changed through cookie settings. Transfers outside the EEA use safeguards required by GDPR and provider terms.
9. Contact and changes
Send requests to contact@operator-egzamin.pl. Material updates will be announced in the service or by email, and renewed consent will be requested where required.