Cookie Policy

This website does not build advertising profiles and does not display advertising. It counts visits with Cloudflare statistics, which save nothing in your browser and read nothing from it. If you consent to statistics, Google Analytics is added with two _ga cookies; without that consent the Google script is not loaded at all. It does, however, save four technical pieces of information in the browser — the chosen theme, a marker that the intro has been shown, your choice from the consent bar and, after logging in with a Member’s code, a session cookie — and, in the preview version before publication, also an access cookie. We list them right next to this, together with the Google Analytics cookies. External materials work separately: a YouTube video and an Instagram post connect you to Google or Meta only when you yourself click.

The complete list of what we save deliberately: four items in the public version, two Google Analytics cookies that are created only after you consent to statistics, and one additional item, only in the preview before publication; no others. The three entries in browser storage stay on your device and go nowhere. The browser attaches the bni-czlonek and bni-preview cookies to every request to our server and sends them only there, to no one else. The _ga and _ga_<ID> cookies belong to our domain, but the Google Analytics script reads them and sends their content to Google together with the measurement data; we describe this in the section Google Analytics. You delete all of them by clearing the site data in your browser.

None of this information contains your first name, surname or e-mail address. The theme, the intro marker and the consent record are technical and are not used to measure traffic or for advertising — we reach for them only so that the page behaves as it did last time. Each time the page is opened we check the saved theme so as not to flash a light screen in dark mode. The consent record is four things: two yes-or-no values (external materials and statistics), the date of the choice and the version number of the record. The version number is there so that we can ask you again when the consent bar changes: on 30 September 2026 the statistics category was added, so the bar asks again also those who had already saved a choice. The _ga and _ga_<ID> cookies serve only Google Analytics statistics and are created only after consent.

A separate matter is the ordinary browser cache — it is not in the table, because it is not a marker, but since we promise a complete list, we mention it too. We send the Member search tool’s response with a header that forbids saving it (`no-store`) — the browser keeps nothing of it, and the same phrase goes to the server every time. The company look-up by NIP number in the forms works differently: the browser may keep the response with the name and address from the register in its cache for up to an hour, so that it does not ask the register a second time when the same number is entered again. This is a transport record on your device — we do not read it and do not send it anywhere; it disappears together with the browser cache. The server-side buffer is described in the Privacy Policy.

Cookies are small text files that a website saves in the visitor’s browser. They usually serve to remember settings, maintain a session after logging in, or to measure traffic and target advertising.

The website is an information site — it has no basket or user account. The only login is the access code for Members before the people search tool and the materials form; it is maintained by the session cookie from the table above and nothing else. We do not use advertising or session-recording tools: Meta Pixel, Google Ads, Hotjar and any other tool building a visitor profile for advertising do not operate here. We count traffic in two ways: without cookies, with Cloudflare statistics, and, only with your consent, in Google Analytics 4 with advertising features switched off. Both are described in the sections below.

The typefaces the website uses are uploaded to our server and loaded from there. Your browser does not connect to Google’s servers when fetching them.

We measure the number of visits and which pages are read with Cloudflare Web Analytics (Cloudflare, Inc.). When a page loads, the browser fetches a small script from Cloudflare’s servers, which sends them information about the visit: the page address, the page you came from, the browser and device type, the country and the page load time.

The script saves nothing on your device and reads nothing from it — it uses no cookies or browser storage, assigns you no identifier and does not recognise you on your next visit. Cloudflare does not store your IP address for the statistics. We see only aggregate data — how many visits a page had, from which countries and devices — with no way of identifying a specific person.

Because nothing is saved on your device or read from it, the Cloudflare statistics do not require consent and have no entry in the consent bar. The “Statistics (Google Analytics)” item in the bar concerns only the tool described in the next section. Popular ad-blocking extensions block the script — the website then works unchanged. The legal basis and the recipient of the data are described in the Privacy Policy.

Alongside the Cloudflare statistics we use Google Analytics 4 (Google Ireland Limited). It shows us, in aggregate data, how the website is used: which pages are read, where visitors come from and what devices they use. On that basis we improve the website. We do not use this data for advertising or to profile visitors.

Without your consent the Google Analytics script is not loaded at all: the browser does not connect to the www.googletagmanager.com server, nothing is sent to Google and no cookie is created. This is the basic mode of Google’s consent mechanism, Consent Mode. You give consent in the consent bar: with the “Accept” button or with the “Statistics (Google Analytics)” item in the settings. The item is off by default, and “Essential only” does not switch it on.

After consent the browser fetches the script from www.googletagmanager.com, and Google Analytics sets two cookies on the bnipolska.pl domain: _ga, which tells one browser from another, and _ga_<ID>, which stores the session state. Both are valid for 13 months. Data about the visit then goes to Google: the page address, the page you came from, the browser and device type and the identifier from the _ga cookie.

We have configured Google Analytics as follows:

• advertising features off: the ad_storage, ad_user_data and ad_personalization consents are always denied, regardless of your choice;
• Google signals off and ad personalisation signals off, so the data is not linked with a Google account or used for advertising;
• no link with Google Ads;
• no IP addresses: Google Analytics 4 does not log or store IP addresses;
• 14 months: that is how long data is kept in Google Analytics, after which it is deleted.

How to withdraw consent: the “Cookie settings” link in the footer opens the consent bar; switch off the “Statistics (Google Analytics)” item and save your choice. Measurement stops, and the website deletes the _ga and _ga_<ID> cookies from your browser. Withdrawing consent does not affect the lawfulness of measurement before withdrawal. The legal basis, the recipient of the data and its transfer to the United States are described in the Privacy Policy.

Cookies are not the only way a website can save something on your device. Browsers also have local and session storage and a built-in database — websites use them to remember settings, the language version or the fact that a banner has already been closed. The law does not speak only of cookies: the obligation to ask for consent applies to every storing of information on the device and every access to information already stored there.

That is why we count it more broadly — and why we also listed above what is not a cookie. The website uses local and session storage in exactly the three places described in the table. It does not set up a database in the browser, does not install any software and has no mechanism that would operate after the tab is closed.

On a dozen or so sub-pages we embed recordings from YouTube. The player does not load on its own — until you click, you see a still frame and a button, and the browser does not connect to YouTube.

Clicking the play button starts the player in privacy-enhanced mode (youtube-nocookie.com). In this mode YouTube does not save cookies used to personalise advertising, but it may save the technical information needed to play the recording — also in the browser storage we describe above. Your IP address then also goes to Google. From that moment Google’s rules apply, not ours — they are described in the Google Privacy Policy ↗.

Instagram posts on the Events page work the same way: a post opens in a large window only after you click the button. The browser then connects to Instagram’s servers, passes your IP address there, and Instagram may save its own cookies and information in the browser storage. From that moment Meta’s rules apply — they are described in the Meta Privacy Policy ↗.

If you do not want this to happen — simply do not click play or the preview. All of the website’s content is available without starting the videos and posts.

If in the consent bar you chose “Essential only”, the video frame — and the window with the Instagram post — asks once more: before connecting it shows what will happen and waits for confirmation. With the choice “Accept” the video starts, and the post opens, immediately after clicking.

On your first visit to the website a consent bar appears. It has two buttons of equal weight — “Accept” and “Essential only” — because refusal must cost exactly the same as consent: one click. A third, smaller button, “Settings”, expands the categories: the essential one, which cannot be switched off, and two with a checkbox: external materials and “Statistics (Google Analytics)”. “Save choice” saves the state of both boxes. “Accept” switches both categories on, “Essential only” leaves both off. Statistics are off by default. The bar does not cover the content and does not block the page; you can close it with the Esc key, in which case we save nothing and the no-consent state applies.

Consent is not required for what is necessary to display the page you yourself request — as the electronic communications regulations provide. That is the case with the theme, the intro marker and the logged-in Member’s session cookie. The bar shows the theme and the marker as a fixed item, without a switch. The session cookie is created only after logging in with a Member’s code, outside the bar — the table above describes it. The Cloudflare statistics save nothing on the device and read nothing from it, and we show no advertising, so the bar does not ask about them. It asks about two things that need your consent: external materials that really go beyond this website (recordings from YouTube and Instagram posts), and Google Analytics statistics, which save cookies on your device and send data to Google.

• Accept: the recording starts immediately after you click the frame, the Instagram post opens immediately in the window, and the website loads Google Analytics.
• Essential only: before starting the player or opening the post, the frame asks for confirmation and says plainly that it connects you to Google or Meta; Google Analytics is not loaded.

In both cases, until you click, the browser connects neither to YouTube nor to Instagram — you see a still frame or a button loaded from our server. For external materials the consent bar neither unlocks nor blocks anything in advance; it only settles whether we ask once more before connecting. For statistics it decides directly: without consent Google Analytics does not run.

You can change your choice at any time: the “Cookie settings” link is in the footer, at the bottom of every page, next to the other documents. It opens the same bar, with the state that applies marked. The record of the choice itself is described in the table above: two values, a date and the version number of the record, nothing about you. Switching statistics off stops the measurement and deletes the _ga cookies.

If in the future we launch further tools that save something in the browser or build a visitor profile, a separate category will be added to the bar, and we will update this document before they are switched on.

Regardless of what a particular website does, every browser can be set to block cookies or to ask for consent at every attempt to save one. You will find the settings in your browser’s privacy section — the instructions are provided by the vendors:

• Google Chrome ↗
• Safari ↗
• Mozilla Firefox ↗
• Microsoft Edge ↗

Blocking cookies and browser storage will not shut you out of the content — the page will simply forget the chosen theme, show the home page intro afresh on every visit, ask for consents every time, and the Member login will not persist between sub-pages. It may, however, make it impossible to play the embedded videos and open the posts.

This document describes the state as at the date of publication. We will change it if the way the website works changes — and we will describe the change openly, not quietly.

The bnipolska.pl website is run by BNI Poland Sp. z o.o. with its registered office in Warsaw, ul. Chłodna 51, 00-867 Warszawa, KRS 0000475787, NIP 1132868575, REGON 146851390. It is the company that saves in your browser the cookies and entries described above and is the controller of your personal data — you will find its full details and the processing rules in the Privacy Policy.

Questions about cookies and personal data: rodo@bnipolska.pl or a letter to the registered office address.