Privacy Policy
Last updated: 18 October 2026
This privacy policy explains how SurvivalZone.EU (“we”, “us”) collects and uses personal data when you visit survivalzone.eu, use the SurvivalZone AI assistant, download the 72h Survival Starter Pack or shop with us. We process personal data in line with the EU General Data Protection Regulation (GDPR).
1. Who is responsible for your data
The data controller is:
Ecommersy Dawid Marcinkowski
Poland
Email: hello@survivalzone.eu
For any privacy question or to exercise your rights, write to hello@survivalzone.eu.
2. What data we collect and why
2.1 Newsletter and the free 72h Survival Starter Pack
When you sign up, we collect your email address and a record of your consent (date and time, and the form you used). We use it to send you the Starter Pack and our newsletter with preparedness tips and news about SurvivalZone.EU.
Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by clicking the unsubscribe link in any of our emails, by replying “unsubscribe” to any of our emails or by writing to hello@survivalzone.eu. Withdrawal does not affect processing carried out before it.
How long: until you unsubscribe. We keep a record of your consent for as long as we may need to prove it (Art. 6(1)(c) and (f) GDPR).
Measuring our emails: we count in total how many of our emails were opened and how many links in them were clicked, using a small image and link redirects. We do not link these figures to any person.
2.2 SurvivalZone AI assistant
When you use the chat, the messages you type (and the previous messages of the same conversation) are sent to our AI provider to generate an answer. We do not ask for your name or email in the chat and we do not store chat conversations on our website. The conversation is kept only in your browser tab and is lost when you close or reload the page.
Please do not enter sensitive personal data (for example health details, exact home address or names of other people) into the chat.
Provider: Anthropic, PBC (USA) processes the messages on our behalf to provide the answers, under its commercial terms. More information: https://www.anthropic.com/legal/privacy
Legal basis: providing the service you request (Art. 6(1)(b) GDPR) and our legitimate interest in offering a helpful, secure tool (Art. 6(1)(f) GDPR).
The AI assistant gives general preparedness information. It is not an emergency service. In an emergency, call 112.
2.3 Security and abuse prevention
To protect the chat and sign-up form from abuse, we use your IP address to count requests. It is stored only in a one-way scrambled (hashed) form and deleted automatically after one hour.
Legal basis: our legitimate interest in keeping the service secure and affordable (Art. 6(1)(f) GDPR).
2.4 Visiting the website
Our hosting provider automatically processes technical data such as your IP address, browser type, date and time of access and the pages requested, in server log files. This is necessary to deliver the website and keep it secure.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR). How long: for a limited period set by our hosting provider, unless needed to investigate a security incident.
2.5 Fonts
The fonts on our homepage are stored on our own server. No data is sent to Google or other font providers when you visit it.
2.6 Videos
If we show a YouTube video, it only loads after you click it, using YouTube’s privacy-enhanced mode (youtube-nocookie.com). When you start the video, Google receives data such as your IP address. Legal basis: your action and consent (Art. 6(1)(a) GDPR).
2.7 Online shop and orders
If you buy from our shop, we process the data needed to fulfil your order: name, billing and shipping address, email, phone number, order details and payment status. We share it only with the providers needed to complete the order, such as the payment provider and the shipping company you choose at checkout.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legal obligations, for example tax and accounting (Art. 6(1)(c) GDPR). How long: for as long as required by tax and accounting law, usually 5 years from the end of the tax year.
2.8 Cookies, analytics and marketing tools
With your consent, we use Google Analytics 4 (Google Ireland Ltd.) and Microsoft Clarity (Microsoft Ireland Operations Ltd.) to understand how visitors use the website (for example which pages are visited, for how long and from which channel), and Clarity also shows which parts of a page they view, where they click and scroll, and where they get stuck, so that we can improve it. Clarity can record anonymised page interactions; text typed into forms is masked and not recorded. These tools set cookies and are loaded only after you click “Accept” in our cookie banner (Art. 6(1)(a) GDPR). If you choose “Necessary only”, they are not loaded at all. You can change your choice at any time with the “Cookie settings” link in the footer. Google and Microsoft may process data in the USA under the EU-US Data Privacy Framework. We do not use advertising pixels. Strictly necessary storage, such as remembering your chosen language and your cookie choice, is used without consent because the website cannot work without it.
2.9 Investor and partner enquiries
If you contact us through our investor page, we process your name, email address, organisation, the type of investor or partner you are, and your message. We use them to answer your request, send you investor materials you asked for and manage our investor relations.
Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in managing investor and partner relations (Art. 6(1)(b) and (f) GDPR). How long: up to 24 months after our last contact, or longer if an agreement is signed and the law requires it.
2.10 Anonymous visit statistics
We count visits to our pages without cookies and without storing anything on your device. For each visit we record only the page, the date and the website you came from (for example TikTok or Google). To count unique visitors per day, your IP address and browser details are combined with a secret that changes every day and turned into a short one-way code; this code is deleted after two days and your IP address itself is never stored. Visits by our administrators and by search engine robots are not counted. When you sign up for the newsletter, we also save the source of your visit (for example “tiktok”). Legal basis: our legitimate interest in understanding how the website is used and which channels work (Art. 6(1)(f) GDPR). The statistics are processed on our own server and are not shared with third parties.
2.11 The SurvivalZone app (survivalzone.eu/app)
The app runs in your browser and needs no account. Most of your data (72-hour plan, contacts, medicines, paramedic card, saved places, settings) is stored only on your device. Only the data described below reaches our server.
- Approximate position. If you allow location access, the app sends your position rounded to about 1 km to fetch help points, warnings, traffic disruptions and queue reports near you (to check whether an official warning area covers your place: about 100 m). We do not store it or link it to you. The server only keeps the results for an area (for example the list of help points) for a few days, so the next people get them faster. Your device’s location is only accessed after you allow it in the browser. Legal basis: our legitimate interest in providing the features you use (Art. 6(1)(f) GDPR).
- Where is my family. If you create or join a family group, we store the group code and the name you enter and, only if you turn sharing on yourself, your last exact position, when it was sent, its accuracy and your battery level. Only people with your group’s code can see it. Turning sharing off deletes your position from the server, leaving the group deletes your data, and a group unused for 30 days is deleted completely. We do not collect phone numbers or email addresses. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by turning sharing off.
- Queue reports. When you report a queue at a place, we store the OpenStreetMap ID of the place, its position, the queue length and the time. Reports are anonymous and deleted after 3 hours. To prevent abuse we keep a one-way hash of your IP address for at most one hour. Legal basis: Art. 6(1)(f) GDPR.
- Warning notifications. If you turn them on, we store the notification address created by your browser (through the Google, Apple or Mozilla push service), an approximate position (about 1 km), your region and language, and the list of warnings we have already notified you about. The notifications themselves carry no content: your phone fetches the text from our server. We delete this data when you turn notifications off or when the browser reports the address as inactive. Legal basis: your consent (Art. 6(1)(a) GDPR).
- Assistant and photo analysis. Questions to the assistant and any photo you choose to have analysed are sent to our AI provider (Anthropic, PBC) only to produce an answer and are not stored by us (see 2.2).
External data sources. To show the map, routes and warnings, the app or our server connects to: OpenStreetMap (map tiles) and Overpass servers (help points, street map), routing.openstreetmap.de (walking and driving routes; your device sends the start and destination), TomTom (traffic speed and disruptions; our server only sends an approximate position), IMGW-PIB, Deutscher Wetterdienst and NINA/BBK (official warnings) and GDACS (disasters worldwide). For connections made directly from your device (map tiles, Overpass, routes) the provider sees your IP address, as with any website you visit.
3. Who receives your data
We share personal data only with service providers who help us run the website and who process it on our behalf under data processing agreements: our hosting provider, our email delivery provider, our AI provider (Anthropic, PBC), browser push services (Google, Apple, Mozilla; only the notification address, no content), TomTom (only an approximate position) and, for orders, payment and shipping providers. We do not sell your personal data.
4. Transfers outside the EU
Some providers, such as Anthropic, Apple, Google, Meta and Microsoft, are based in the USA. Where data is transferred outside the European Economic Area, we rely on an adequacy decision (such as the EU-US Data Privacy Framework, where the provider is certified) or on the European Commission’s Standard Contractual Clauses.
5. Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy,
- have inaccurate data corrected,
- have your data deleted,
- restrict processing,
- data portability,
- object to processing based on legitimate interest,
- withdraw your consent at any time.
To use any of these rights, email hello@survivalzone.eu. We will reply within one month.
You also have the right to lodge a complaint with a data protection supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl). You can also contact the authority in the EU country where you live.
6. Children
Our newsletter and AI assistant are not directed at children under 16. We do not knowingly collect their data.
7. Changes to this policy
We may update this policy when our services or the law change. The current version is always available on this page, with the date of the last update at the top.