LEGAL
Last updated: 8 October 2026
The controller of the personal data described in this Policy is TGV sp. z o.o., with its registered office in Warsaw, Aleja Niepodległości 54/34, 02-626 Warsaw, Poland, entered in the National Court Register (KRS) under number 0000534661, tax ID (NIP) 5213684806 ("TGV", "we"). TGV develops and provides the BAX Index platform and the products of the BAX family.
This Policy consists of two parts:
Contact for data protection matters: [email protected] or by post at our registered office.
BAX is designed to collect as little data as possible.
The baxindex.com website uses cookies necessary for session management (login state) and Google Analytics 4 cookies, stored for up to 2 years.
In addition, two measurement tools run on baxindex.com: Google Analytics 4 (website traffic statistics, see section 5) and BAX's own measurement. BAX's own measurement on baxindex.com covers the same categories of data that Part B describes for the path after consent, including storing campaign parameters on the device for the duration of the browser tab.
Information stored on the device by the measurement script on publisher sites is described in Part B.
BAX uses the following third-party services:
If you are located in the European Economic Area, you have rights including access to your personal data, correction of inaccurate data, deletion of your data, and the right to object to processing. To exercise these rights, please contact us at [email protected]. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland. Details concerning measurement data from publisher sites are in section B8.
Account data (email, subscription status) is retained for as long as your account is active. If you close your account, your data is deleted within 30 days. Audit data stored in your BAX workspace is controlled by you and can be deleted on request. The retention period for measurement data from publisher sites is described in section B7.
BAX is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, contact us immediately at [email protected].
We may update this Policy from time to time. We will notify you of material changes via email or by posting a notice on baxindex.com.
TGV sp. z o.o., Aleja Niepodległości 54/34, 02-626 Warsaw, Poland, KRS 0000534661, NIP 5213684806.
Privacy questions: [email protected]
General enquiries: [email protected]
The publishers we work with place the BAX script on their sites. The script measures the extent to which content is actually read and viewed: how much time the user actively spends on it, how far they scroll and how they interact with it. The results help the publisher assess content performance. The measurement is not used to display advertising, build advertising profiles or identify individuals.
Full measurement starts only after the user gives consent in the publisher's consent management platform (CMP): under the IAB TCF standard for purposes 1 and 8, and for publishers using other tools, for the relevant analytics or statistics category.
If the user does not give consent, the script stores no information on the device and does not create a browser identifier. We then send only data about a single content view: the page address without parameters, the title and type of the page, the source of the visit (the referring page address and campaign parameters), active time, scroll depth, counters of interactions with the content, information on whether a mouse was used, and the country determined from the IP address. The view receives a random identifier that is not stored anywhere and does not allow subsequent views by the same person to be linked.
We do not collect content typed into forms or keys pressed, we do not record sessions or screens, and we do not combine the data with data from other sources in order to identify a person.
| Purpose of processing | Purpose in IAB TCF 2.2 | Legal basis |
|---|---|---|
| Storing information on the device and accessing it | Purpose 1 | consent, Article 399(1) of the Polish Electronic Communications Law |
| Measurement of attention and content performance, statistical reports for the publisher | Purpose 8 | consent, Article 6(1)(a) GDPR |
| Statistics of content views without consent, without a browser identifier | not applicable | legitimate interest of the publisher and TGV in measuring content performance, Article 6(1)(f) GDPR |
| Detecting and filtering invalid traffic (bots, automated traffic) | Special purpose 1 | legitimate interest of TGV and the publisher in the reliability of measurement, Article 6(1)(f) GDPR |
Detection of invalid traffic takes place only within sessions in which the user has given consent to Purpose 1. The development and calibration of the measurement methodology is carried out solely on aggregated data.
Sessions are automatically assigned to categories of content consumption style (for example attentive reading, quick skimming). The classification concerns a single visit, serves statistical purposes only and does not produce legal effects or similarly significant effects on the user within the meaning of Article 22 GDPR.
You can withdraw consent at any time in the privacy settings on the publisher's site (CMP). Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. You have the right to object to processing based on legitimate interest.
We do not sell data and do not share it for advertising purposes.
Cloudflare, Inc. may process data outside the European Economic Area. This takes place on the basis of the EU-U.S. Data Privacy Framework and standard contractual clauses approved by the European Commission.
We keep raw data for 24 months from collection and then delete it. Aggregated results that do not allow linking to a specific session or device may be kept longer.
You have the right of access to your data, rectification, erasure, restriction of processing, portability and objection. Because we use only pseudonymous identifiers that are not stored on the device, in most cases we are unable to link data to a specific person (Article 11 GDPR). If you provide additional information enabling such linking, we will consider your request. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland.