This Privacy Policy is drafted under Regulation (EU) 2016/679 (GDPR, in Polish: RODO) and the Polish Personal Data Protection Act of 10 May 2018.
Data controller
The controller of your personal data is Westend Consulting Ltd („Kreditano"), with registered office at THE CORE, Triq il-Wied ta' l-Imsida, Msida, MSD 9021, Malta. For data matters, write to contact [at] kreditano [dot] com.
What data we collect — and what we don't
The single most important point first: Kreditano does not run an application form. Clicking „Apply" redirects you to the bank's or lender's own page, where you fill in the application under their privacy policy. We don't collect your name, PESEL, income, bank account number or any other data used for credit assessment. You hand those to the financial institution, not to us.
What we do collect: technical and navigation data (IP address, device and browser type, cookie identifiers) for operational and statistical purposes — detail in the cookie section below. If you write to us at contact [at] kreditano [dot] com, we process your email address and the body of your message strictly to reply.
Sensitive data
Kreditano does not collect or process special category data (GDPR art. 9). Please don't send this kind of information through the site.
Purposes and legal basis
Primary purpose: running the comparison site — meaning we serve RRSO tables, calculators and articles, and redirect you to the bank or lender's page when you click „Apply". Legal basis: GDPR art. 6(1)(f) — controller's legitimate interest in running an informational site. We don't sign a brokerage contract with you because we don't perform brokerage.
Secondary purposes (basis: GDPR art. 6(1)(f)): statistical analysis and site improvement. You can object by writing to contact [at] kreditano [dot] com, without it affecting access to the site — analytics simply stops counting you.
Marketing communication (basis: GDPR art. 6(1)(a) — consent): if we ever launch a newsletter, it goes out only after your explicit, voluntary opt-in via a separate checkbox. Today we send no newsletter. When we start, this section gets updated with the date.
Recipients of data
We don't sell your data to third parties. We don't share application data with financial institutions, because we don't collect any. The only recipients are infrastructure providers we entrust with processing technical data on our behalf: hosting (Hetzner, DE), CDN and bot protection (Cloudflare, IE/EU), product analytics (PostHog, EU servers), advertising (Google Ads, if you've consented). Each works for us as a processor under GDPR art. 28.
Cookies and tracking technologies
We split cookies into three categories. The first one runs always, because without it the site can't remember your comparison preferences. You turn the other two on or off in the consent banner. Your choice, not ours.
Functional (always active). kr_vid: anonymous session identifier, valid 365 days, first party (kreditano.pl). Keeps your filter preferences (amount, term, loan type) across visits so you don't set them up from scratch. kr_consent: your decision from the banner, also 365 days. Without these two the comparison still works, just from zero each time.
Analytics (you enable in the banner). PostHog (eu.i.posthog.com): product analytics, identifiers ph_*, up to 12 months. We check where people get stuck in the comparison. First party, data lands on EU servers.
Marketing (separate consent). Google Ads (_gcl_*, gclid): campaign attribution and conversion measurement, up to 90 days. Loaded only if you tick „marketing" in the banner. If you leave it off, no pixel is loaded.
Ahrefs Web Analytics is cookieless, so it runs even if you decline analytics consent. It counts unique visitors without identifying them.
You can change your mind at any time. Clear kr_consent in your browser (DevTools → Application → Cookies), or write to contact [at] kreditano [dot] com, and the banner will appear again.
Your rights (GDPR)
Under GDPR you have the right to: access your data (art. 15), correct it (art. 16), erase it (art. 17), restrict processing (art. 18), data portability (art. 20), object (art. 21) and withdraw consent (art. 7(3)). To exercise these rights, write to contact [at] kreditano [dot] com — give us your first and last name and the right you want to use.
You also have the right to lodge a complaint with the supervisory authority — in Poland that is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa.
Retention and security
We retain data only for the period needed to fulfil the purposes described and any legal obligations. We use reasonable technical and organisational measures to protect it from unauthorised access, loss and disclosure.
Changes to the Privacy Policy
We may update this Policy. The binding version is available at kreditano.pl/polityka-prywatnosci with the date of the latest update.
Last updated: June 2026.