Privacy notice
What personal data DMV Decoded collects, why, who processes it, how long we keep it and how to exercise your rights.
Effective date: November 3, 2026.
Who is responsible
The controller of your personal data is MRServices, ul. Ekologiczna 3, 05-816 Reguły, Poland, tax ID (NIP) 5833067752, the operator of DMV Decoded ("we"). Because we are based in the European Union, we handle all visitors' data under the EU General Data Protection Regulation (GDPR), wherever you live.
Privacy questions and requests: privacy@dmvdecoded.com, or the contact form (choose "Privacy or data request").
What we collect and why
Browsing the site. You can use the whole directory without an account. To deliver pages and protect the site from attacks, our hosting and network providers (Render and Cloudflare, see below) process your IP address, browser details and the pages you request. We do not use these to build a profile of you. Legal basis: our legitimate interest in running a secure website (GDPR Art. 6(1)(f)).
Maps. Office maps load map images from OpenStreetMap's tile server and from OpenFreeMap, so your browser sends them your IP address and the area shown. The "Route in Google Maps" button opens Google Maps only when you click it.
Search. If you search for a place name, we may send that text (not your IP address) to OpenStreetMap's Nominatim service to find its location, and we store the result to answer the same search faster next time. To limit abuse, your IP address is held in a rate-limit counter for up to two days.
Plan pages (REAL ID, licence renewal, vehicle registration). We count anonymous clicks on the links in a plan and store the answer to "Did you get it done on your first visit?" with its optional reason. Neither is linked to you: no IP address, cookie, account or other identifier is saved with them. Your IP address is held in a rate-limit counter for up to two days.
Account. Your e-mail address, the public name you choose, your password (stored only as a secure hash), whether you confirmed your e-mail address, and the date you joined. If you sign in with Google, Google tells us your Google account ID, your e-mail address and your first name (used only as a suggested public name); we never receive your Google password. We use this to run your account, let you post and tell you about moderation decisions. Legal basis: providing the service you asked for (Art. 6(1)(b)).
Reviews, questions, answers, photos and correction requests. What you post, your public name, the date, the moderation result and, if a moderator rejects it, the reason shown to you. Everything is checked by a moderator before it appears; published posts are public with your public name. We also store the IP address you posted from to fight spam and abuse (Art. 6(1)(f)). Photos are re-encoded when you upload them, which removes location and camera data.
Contact form. Your name, e-mail address, the topic, your message, the page you came from, your IP address (for spam prevention) and our replies. Used to answer you (Art. 6(1)(b) or (f)).
Newsletter. Your e-mail address, the page where you signed up, your IP address, when we sent the confirmation e-mail, when you confirmed (double opt-in) and the wording you agreed to, and when and how you unsubscribed. With your agreement, given when you confirm your subscription, Resend records whether you open each newsletter (through a small image in the e-mail) and which links you click, linked to your address; we use this to see which topics are useful. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time with the unsubscribe link in every newsletter; withdrawing does not affect what was sent before.
Messages from us. Account confirmation, password reset, moderation notices, contact replies and newsletters are sent by e-mail through Resend.
Visit statistics. We use Cloudflare Web Analytics to count page views and see which pages are used, which pages and countries visitors come from, and how fast pages load. Cloudflare adds a small script to our pages that reports this from your browser. It sets no cookies and uses no local storage, and Cloudflare does not fingerprint visitors by IP address, browser details or other data for these statistics. We see totals, not individual visitors. Legal basis: our legitimate interest in knowing which pages are useful and fast (Art. 6(1)(f)).
We do not sell your personal data, we do not share it for advertising, and we do not use it for automated decisions about you. You do not have to give us any data to use the directory; without an e-mail address you cannot create an account, contact us by form or subscribe.
Cookies
We set only cookies the site needs to work:
- csrftoken: protects forms against cross-site request forgery; set when you open a page with a form.
- sessionid: keeps you signed in; set when you sign in and ends after 8 hours.
Cloudflare may set its own security cookies to tell people from bots. We do not use advertising or social-media cookies, and our visit statistics (above) set no cookies. Necessary cookies do not need your consent; you can block them in your browser, but forms and signing in will then not work.
Who processes your data for us
- Render (Render Services, Inc., USA): hosts the site and its database in the United States.
- Cloudflare (Cloudflare, Inc., USA): network, security and DNS for all traffic; stores uploaded photos and images (R2) and our daily database backups; visit statistics (Web Analytics).
- Resend (USA): sends our e-mails and holds the newsletter mailing list of confirmed subscribers.
- Google (Google LLC, USA): only if you choose "Continue with Google", to confirm who you are.
- OpenStreetMap Foundation and OpenFreeMap: map images and place search, as described above.
Several of these providers are in the United States, outside the European Economic Area. Transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses in the provider's data processing terms.
We may also disclose data when the law requires it, for example to a court or authority.
How long we keep data
- Account and posts: until you delete your account, or we remove them; to have a single post deleted, ask us. Deleting your account deletes it and everything you posted from our database.
- Photo files: deleting a photo or your account removes it from the site, but the image file stays in our file storage. Its address is not listed or linked anywhere on the site. Ask us at privacy@dmvdecoded.com if you want a file erased.
- IP addresses on posts, contact messages and newsletter sign-ups: removed automatically after 90 days.
- Rate-limit counters: two days.
- Contact messages: deleted two years after the conversation is closed.
- Newsletter: sign-ups never confirmed are deleted after 30 days. After you unsubscribe we keep your address and the record of your consent and unsubscription so that we never e-mail you again and can show what you agreed to.
- Backups: a copy of the database is made daily and each copy is deleted after 35 days, so deleted data disappears from backups within 35 days.
- Server and network logs are kept by Render and Cloudflare for a limited time under their own policies.
Your rights
Under the GDPR you have the right to access your data and get a copy, to correct it, to have it erased, to restrict its processing, to data portability, and to object to processing based on our legitimate interests. Where we rely on consent, you can withdraw it at any time.
On your account page you can see all your posts and their moderation status, edit your reviews, change your public name and password, and delete your account. For anything else, including deleting a single post, write to privacy@dmvdecoded.com. We answer within one month and may ask you to confirm your identity first.
You can also complain to the Polish data protection authority: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or to the authority where you live or work.
US residents: you can use the same rights above, whatever state you live in. We do not sell or share personal information as those terms are defined in California and other state privacy laws.
Children
The site is not directed at children. Accounts are for people aged 16 and over, and we do not knowingly collect data from children under 16. If you believe a child has given us data, write to us and we will delete it.
Changes
We will post any change to this notice on this page with a new effective date. If we start using advertising tools or analytics that use cookies, we will update this notice before they go live and ask for your consent where the law requires it.