Privacy policy — Bazadom Group

Last updated: 25 May 2026

Bazadom Group operates a shared identity portal at id.bazadom.pl, used by the group's services (bazadom.pl, zlecbudowe.pl).

1. Data controller

Bazadom sp. z o.o. Contact: [email protected].

2. Scope of data processed by the IdP

• Email, full name, password (Argon2id hash) or passkey.
• Google account identifier if Google sign-in was chosen.
• Sign-in history (date, IP, client).
• Public key of each passkey.

Domain-specific data (company profiles, listings, jobs, invoices) stays in each individual service and is not sent to the IdP.

3. Purpose and legal basis

• Performance of the sign-in service contract (Art. 6(1)(b) GDPR).
• Security and abuse prevention — legitimate interest (Art. 6(1)(f) GDPR).

4. Retention periods

• IdP sessions: 7 days from last activity.
• Identities: until the account is deleted.
• Audit log (idp_audit): 18 months.

5. Recipients

• Hetzner Online (EU-based hosting).
• Resend (transactional email).
• Google (optional Google sign-in).
• Group services receiving the sub claim, email, name and picture after sign-in.

6. Your rights

• Access — via the Bazadom Group panel or directly in a group service (JSON export: POST /api/account/export).
• Rectification — in account settings.
• Erasure — the "Delete account" button in any group service. Also erases the Bazadom Group identity.
• Portability — the export described above.
• Complaint — President of the Polish DPA (UODO).

7. Server location

All Bazadom Group data is processed in the EU (Hetzner, Germany).

The privacy policy of each individual service (bazadom.pl, zlecbudowe.pl) describes the data that service stores against its own domain account.