Effective from: 9 October 2026
The data controller is UNIEXPO Sp. z o.o., registered in Koźmin Wielkopolski, ul. Towarowa 3, 63-720 Koźmin Wielkopolski, Poland, NIP: 6211843170, REGON: 522455222, KRS 0000980105. The controller has not appointed a data protection officer. Data protection contact: kontakt@maxanimals.pl.
We collect the following data: first and last name, e-mail address, phone number, delivery and billing address, tax ID (optional), order and payment data, account and authentication data (including sign-in with Google or Facebook and two-factor authentication), pet information (name, species, breed, age, weight, body condition score, playdate profile; voluntary), pet health data (vaccinations, medications, vet visits, consultations with specialists; see section 5), activity data (walks, routes, precise GPS and approximate location, collected also in the background while a walk is being recorded; with consent, see section 6), photos of your pet (breed recognition, body condition scoring; voluntary, for AI analysis), social data: private messages, comments, friend list, lost-pet broadcasts, NFC/QR tags and their scans, heat-in-car alert sessions, pet-sitter share links, playdate interactions, dog-friendly place reviews, short-lived presence pings at POIs and in your area (TTL 30 min, blurred to a ~500 m grid, k-anonymity >= 2-3), show entries and pedigree data, Breeder Club data, product scan history, product Q&A, product collections, loyalty programme data (points, cashback, referrals), affiliate programme data (affiliate links, the number of times they were opened, the code and opening time of the affiliate link remembered on the device and on the Account of the person who opened it, orders attributed to links and commissions transferred to the cashback wallet), the content of messages sent through the contact form, the e-mail address from a newsletter sign-up together with the date consent was given, data of veterinary practices in the public directory and data from the form for requesting a change to or removal of a practice listing (see section 7), device tokens for push notifications, technical data (IP address, device type, browser).
We process data for: fulfilling orders and delivering Products, managing your Account and providing Service features, keeping pet health records and handling online consultations with specialists, operating the loyalty programme, cashback, referrals and the affiliate programme (counting affiliate link openings, attributing an order to an affiliate link, calculating the commission and transferring it to the cashback wallet), personalising product and nutrition recommendations (AI), tracking pet activity (walks, health), recording walk routes and providing device location-based features, including background location collection while a walk is being recorded, and finding places and services nearby (see section 6), providing social features (messages, friends, lost-pet broadcasts, playdate), sending push notifications about Service events, handling contact-form enquiries, running the public directory of veterinary practices and handling requests from practices (see section 7), marketing communications and the newsletter (with consent), ensuring security and preventing abuse (including bot protection and establishing, on the basis of push notification tokens, whether several Accounts are used on the same device: such Accounts do not pass rewards to each other, in particular for referrals, or commissions from the affiliate programme, and our team may check the use of their cashback funds), fulfilling legal obligations (accounting, taxation).
Processing is based on: Art. 6(1)(b) GDPR (performance of a contract: orders, account, Service features, including AI features you start yourself, such as the AI Advisor and photo analysis), Art. 6(1)(a) GDPR (consent: marketing and newsletter, precise and approximate location, including collection in the background while a walk is being recorded, and its sharing, analytics and marketing cookies, push notifications), Art. 6(1)(c) GDPR (legal obligation: accounting, taxation), Art. 6(1)(f) GDPR (legitimate interest of the controller: Service security, abuse prevention, analytics, pursuing claims, attributing an order to the affiliate link opened by the buyer, counting affiliate link openings, detecting Accounts used on the same device, running the directory of veterinary practices and handling requests from practices, see section 7). You may withdraw consent at any time. This does not affect the lawfulness of processing carried out before the withdrawal.
The Service lets you keep pet health records (vaccinations, medications, visits, weight, body condition score) and use online consultations with specialists: a trainer, a behaviorist and a pet dietitian. These specialists are not veterinarians. For a consultation we process the problem description, attached photos and files, and the message history with the specialist. We also process prescriptions issued by your own veterinarian that you upload to the Service yourself. This data concerns your pet but is linked to your account. The specialist is granted access only to the data necessary to handle that specific consultation. Health records are visible only to you and to recipients you designate (e.g. a pet sitter). Consultation content is never used for marketing. These features are supportive only. They do not replace an in-person veterinary visit and do not constitute a diagnosis.
The MaxAnimals Go mobile app and the website use your device's location data. We collect it only after you grant permission in your operating system settings (Android, iOS) or in your browser. Without that permission the location-based features stay unavailable, while the rest of the Service works normally. Types of data: precise location (GPS: latitude and longitude, plus altitude, speed, measurement accuracy and timestamp) and approximate location (derived from the mobile network, Wi-Fi or IP address). If you connect your account to Health Connect, Strava or intervals.icu, the imported workouts may contain a recorded route, which is also location data. Background collection: while a walk is being recorded, the mobile app keeps saving route points also when the screen is off or the app runs in the background. This is handled by a foreground service with a persistent notification informing you that recording is in progress. Background collection starts only after you begin recording a walk and ends the moment you finish or discard it. Outside a recorded walk we do not track your location in the background. You may decline the background permission; the route is then recorded only while the app is open on screen. Purposes: recording the route, distance, pace and map of a walk together with activity statistics; geographic challenges, leaderboards and badges (including Local Legend); nearby search (veterinary practices, dog-friendly places, points of interest, stores and parcel pickup points at checkout); the heatmap of popular routes; local weather forecast and the heat-in-car alert; lost-pet broadcasts together with the place the pet went missing; neighbourhood-based social features (playdate, co-walks, short-lived presence pings). Presence pings: for the "nearby" features we do not store your exact position. The point is blurred to a grid of roughly 500 m, kept for a maximum of 30 minutes and shown only in aggregate, once the k-anonymity condition (at least 2-3 people) is met. Recipients: we pass coordinates only to the providers required to deliver a given feature: MapTiler AG (maps and map tiles), OpenStreetMap Foundation (Nominatim service: translating coordinates into a place name and back), Open-Meteo (weather forecast for a given point), and carriers (InPost, DPD, DHL, Poczta Polska) when you choose a pickup point. We do not use location data for advertising, we do not combine it with an advertising identifier (the app does not collect one) and we do not sell it. Retention: walk routes and activity data are kept for 24 months from the last activity, or until you delete the walk or your account; presence pings for 30 minutes; the location saved in your profile (town, search radius) until you change it or delete your account. Control: you can withdraw consent at any time in your device settings (Android: Settings > Apps > MaxAnimals Go > Permissions > Location; iOS: Settings > Privacy & Security > Location Services) or in your browser settings; withdrawing only the background permission does not block the remaining features. You can delete saved routes one by one in your walk history, and all data by deleting your account.
The Service provides a public directory of veterinary practices, available also without signing in. This section contains the information required by Articles 13 and 14 GDPR for persons whose data appear in the directory (in particular veterinarians whose name forms part of the name of a practice, and other persons who can be identified from the data in a listing), and for persons who send the form "Do you run this practice? Request a change or removal". The controller of these data is UNIEXPO Sp. z o.o. (section 1). Data in the directory: the practice's name (it often contains the first name, surname and title of a veterinarian), address, postcode, town, telephone number, e-mail address (from OpenStreetMap only), website, geographic coordinates, opening hours, whether the practice is open 24 hours, the animal species it accepts (determined automatically from the practice's name and description in the source, or by our team after a correction is reported) and the type of veterinary establishment (only according to the chamber's register). We do not publish photos, ratings or reviews. From the chamber's register we do not take the data of the practice's manager, the data of the entity operating the practice, e-mail addresses or staff lists. Sources of the data: OpenStreetMap (a publicly accessible database under the Open Database License, retrieved through the Overpass interface), the publicly accessible register of veterinary establishments kept by the regional council of the Wielkopolska Veterinary Chamber (Wielkopolska Izba Lekarsko-Weterynaryjna; the chamber's register; a file published by the chamber at wilwet.pl, the register being public under Article 16(3) and (4) of the Polish Act of 18 December 2003 on animal treatment establishments) and Users of the Service who add a practice in their pet's profile or report corrections (we publish these only after checking them). Each listing shows its source. We convert addresses from the register into coordinates using the Nominatim service of the OpenStreetMap Foundation, to which we send only the address of the practice. Purpose and legal basis: we process the directory data so that pet owners can find a veterinary practice nearby, check which animals it accepts and whether it is open 24 hours, and contact it, including in an emergency. The legal basis is our legitimate interest and that of the Users of the Service in access to this information (Art. 6(1)(f) GDPR). We process only data describing the practice as a place where services are provided, coming from publicly accessible sources or from Users. Recipients: the directory is public, so the data in a listing can be seen by anyone using the Service, also without signing in. Hosting and IT maintenance providers process the data on our behalf, and for data from the form also the e-mail delivery provider (Resend) and, in the web Service, the bot-protection provider (Cloudflare, the Turnstile service). Information on transfers of data outside the European Economic Area is given in section 10. The request form: it is available next to every listing and does not require signing in. In it we collect the first name and surname, e-mail address, type of request (change of data or removal of the listing) and the message. The request goes to a queue handled by our team, and we send a copy by e-mail to our contact mailbox; we reply to the e-mail address provided. We change or hide a listing only after the request has been considered. Providing the name and e-mail address is voluntary, but without them we cannot accept the request or reply to it. To protect the form against abuse, we keep the device's IP address for one hour in server memory (at most 5 requests per hour can be sent from one address), and in the web Service we also pass it to the Cloudflare Turnstile service; if the check fails or the limit is exceeded, the IP address is recorded in the technical logs. The legal basis is our legitimate interest in considering the request, keeping the directory data accurate and protecting the form against abuse (Art. 6(1)(f) GDPR) and, where the request serves to exercise the rights of the data subject (rectification, erasure, objection), also our legal obligation (Art. 6(1)(c) in conjunction with Art. 12 GDPR). Retention: we keep the data in a listing for as long as the practice appears in the source; a listing from OpenStreetMap that has been missing from the source for 7 days, and a listing from the chamber's register that has been missing from it for 60 days, are deleted at the next data import. A listing hidden at the practice's request or as closed is not published; we keep it for as long as we run the directory, solely so that it is not published again at the next import. A listing added by a User is kept until it is hidden as closed or deleted. Requests sent through the form, together with their e-mail copy: 12 months after the request has been considered. Technical logs: 12 months. Your rights: a person whose data appear in the directory has the rights described in section 12. In particular, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your data in the directory (Art. 21(1) GDPR); we will hide the listing unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms. You can submit an objection or a request to rectify or erase a listing using the form next to the listing or by writing to kontakt@maxanimals.pl. We respond without undue delay and in any event within one month of receiving the request. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). Informing persons whose data appear in the directory: we also provide the information in this section to these persons directly, to the e-mail address given in the listing or, where there is none, by post to the address of the practice. Where providing the information directly proves impossible, for example when an e-mail or letter cannot be delivered, we make it publicly available in this section (Art. 14(5)(b) GDPR), and each listing shows the source of the data and the form for requesting a change or removal.
We use algorithms and artificial-intelligence models for: product recommendations and food matching, conversations with the AI Advisor, photo analysis (breed recognition, body condition scoring) and content personalisation. Prompts, photos and animal health data sent for AI analysis are processed by our model provider (Anthropic, USA) under standard contractual clauses and are not used to train models. We label AI-generated content in the Service. It may contain errors. Results are informational and supportive. We do not take decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you within the meaning of Art. 22 GDPR. You may choose not to use AI-based features and, in case of doubt, request human review of a result.
Order data: 5 years from the end of the tax year (accounting obligation). Account data: until account deletion. Pet health records and consultations with specialists: until you delete the entry or your account, subject to periods arising from record-keeping and limitation-of-claims rules. Marketing data and newsletter: until consent is withdrawn. Contact-form messages: 12 months after the matter is closed. Private messages and comments: until account deletion. Push notification tokens: until sign-out or app uninstall. Activity data (walks, GPS routes): 24 months from last activity or until you delete the walk. Presence pings and location data of the "nearby" features: 30 minutes. Lost-pet broadcasts: until the report is resolved or the account is deleted. NFC/QR tags and scan history: until the owner deactivates the tag or deletes the account. Heat-in-car alert sessions: until the session ends + 24h diagnostic log. Pet-sitter share links: until the token expires or is revoked. Playdate profiles and interaction history: until opt-out or account deletion. Dog-friendly place reviews: until account deletion or manual review removal. Presence pings (POI presence, Nearby Now): TTL 30 minutes, removed automatically every 5 minutes. Show entries and settlement data: 5 years (accounting obligation). Product Q&A and product collections: until account deletion. Affiliate links, orders attributed to links and commissions: 5 years (accounting obligation). Affiliate link remembered on the device: 30 days from opening. Affiliate link remembered on the Account: until an order earns a commission from it, another link is opened or the Account is deleted, but it is used to attribute orders only for 30 days from opening. IP address of the person opening a link: up to 24 hours in server memory, solely to count openings and limit the number of requests. Directory of veterinary practices and requests from practices: the periods stated in section 7. Technical logs: 12 months.
We share data with our sub-contractors (processors) only to the extent necessary to provide the services: payment operators PayU S.A., Krajowy Integrator Płatności S.A. (Tpay) and PayPro S.A. (Przelewy24), courier companies (InPost, DPD, DHL, Poczta Polska), the commerce platform (Shopify), the e-mail delivery provider (Resend), the artificial-intelligence model provider (Anthropic), the web analytics and advertising provider (Google, the Google Analytics, Google Ads and Google Merchant Center services), map and geodata providers (MapTiler AG, OpenStreetMap Foundation with the Nominatim service), the weather forecast provider (Open-Meteo), the bot-protection provider (Cloudflare, the Turnstile service), push notification providers (Expo, Google Firebase), the specialists handling consultations (trainers, behaviorists, pet dietitians), hosting and IT maintenance providers, and public authorities where required by law. Some of these entities are established outside the European Economic Area (including the USA). In such cases the transfer takes place under standard contractual clauses approved by the European Commission. We do not sell personal data.
The Service uses cookies and similar technologies in three categories: necessary (session, cart, authentication, security and remembering your consent choices; no consent required), analytics (visit statistics, e.g. Google Analytics; only with your consent) and marketing (tailoring content and ads and measuring ad performance, e.g. Google Ads; only with your consent). On your first visit we display a banner where you can accept all categories, reject non-essential ones, or choose individual categories. No analytics or marketing script runs before consent is obtained. You can change or withdraw your choice at any time via the "Cookie settings" panel available on this page. You can also change cookie settings in your browser; disabling necessary cookies may make the Service unusable. Device storage: in addition to cookies, the Service stores data in the browser's storage (localStorage) or in the mobile app's storage. When you open an affiliate link, and only with your consent, we store under the key pm:aff the link code, the Product identifier and the time the link was opened, and after you sign in also the identifier of the Account the link was passed to. This is used to attribute an order to the link and to calculate the Partner's commission (Annex no. 5 to the Terms). On the website, consent means consent to marketing cookies given in the cookie banner; a link opened before you choose in the banner is stored only if you give that consent during the same visit. In the mobile app, consent means confirming with the "Remember" button in the window shown when an affiliate link is opened. Without consent no entry is created, and the price and the possibility of buying stay the same. The entry is valid for 30 days from opening the link; after that time, and also after an order containing the Product covered by the link, it is deleted. You can withdraw your consent at any time: on the website by switching off marketing cookies in the "Cookie settings" panel, and in the mobile app with the "Remove" button next to "Affiliate links" at the end of the Privacy Policy screen. Withdrawing consent deletes the pm:aff entry. When you open an invitation link from a friend, we store under the key pm:ref the referral code so that the referral rewards can be granted after you register. The entry is valid for 30 days and is deleted after that time or once the code has been used. You can delete these entries at any time by clearing the site data in your browser or the app's data.
You have the right to: access your data, rectify your data, erase your data (right to be forgotten), restrict processing, data portability, object to processing, withdraw consent at any time, lodge a complaint with the supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland). Where we process your data on the basis of legitimate interest (Art. 6(1)(f) GDPR), you may object to the processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). You can exercise these rights by writing to kontakt@maxanimals.pl. We respond without undue delay and in any event within one month of receiving the request.
The Service is not intended for persons under 16 years of age. We do not knowingly collect personal data from children. If a parent or guardian learns that a child has provided us with personal data, please contact us. The data will be promptly deleted.
We apply appropriate technical and organisational measures to protect personal data: encrypted connections (TLS/SSL), multi-factor authentication (Keycloak), regular security audits, role-based access control, encryption of sensitive data at rest.
We reserve the right to update this Privacy Policy. We will notify you of material changes via the Service or by e-mail at least 14 days before they take effect.
For data protection matters please contact: E-mail: kontakt@maxanimals.pl UNIEXPO Sp. z o.o. ul. Towarowa 3, 63-720 Koźmin Wielkopolski, Poland
Cookie settings
