Privacy Policy

Version of 12 October 2026. Change history and previous versions: section 11.

1. Data controller

The controller of personal data processed on skanfirmy.pl is Bartosz Kuć, running a sole proprietorship in Poland (tax ID (NIP) 7393933151). Contact for all personal data matters: info@skanfirmy.pl.

2. What data we process

The service requires no account or login and does not keep a database of natural persons in business — it fetches register data at the moment someone asks about a specific number (exception: the monitoring service, section 6). We process:

The tax micro-account generator also accepts a PESEL number. On the website the number is processed entirely in your browser and is never sent anywhere. The generator in our MCP server accepts only a tax ID (NIP).

3. How queries work

Tools that query the registers directly from your browser. The search on the home page, the VAT White List, KRS, the bank account check and the bulk check send the number from your browser directly to the official APIs:

Our server does not take part in these queries: we do not see them and do not store them. The register operator sees your IP address just as when you visit its website directly; its privacy policy applies.

For natural persons in business (no KRS number, including civil-law partnerships) these tools show only: first and last name (business name), tax ID (NIP), VAT status, town and the number of bank accounts in the Register. You can check whether a specific account is in the Register: the Ministry of Finance answers YES or NO, and this query also goes directly from your browser. The Register's API does not allow selecting fields, so your browser receives the full entry from the Ministry of Finance, including the address and the list of bank accounts. Right after receiving it, our code keeps only the fields listed above. It does not display or store the rest — including in the export (CSV, JSON) and when copying bank accounts in the bulk check. The home page also shows the individual tax micro-account calculated from the tax ID. This is an account for paying taxes to the tax office, not an account on which the entrepreneur receives payments. We recognise natural persons by the absence of a KRS number in their VAT Payers Register entry. That is why the same limited version also applies to other entities without a KRS number (e.g. municipalities and schools). For companies, the tools show the data needed for verification (including name, tax ID, VAT status, REGON, KRS number, address, registration date and bank accounts, and from KRS also the legal form, share capital, PKD codes, manner of representation and the functions of board members), without the names of board members, commercial proxies or partners.

The tools also download from our server a file listing the groups of numbers excluded following an objection or an authority's order (section 8). The file is the same for everyone and contains no numbers, only group identifiers; each group covers several hundred numbers. The request for the file does not contain the number being checked. If you check a tax ID in such a group, the tool does not query the register but refers you to the official search. When you search by KRS or REGON number, the register is queried, because only its response contains the tax ID — for a number in such a group we then do not show the result.

Tools that work locally. The micro-account generator, the PKD code search and the interest calculator compute everything in your browser and send nothing.

Queries through our server. The following run on our server functions (Cloudflare Pages Functions):

They are used by the REGON and VIES tools on the website, the browser extension (section 10), AI agents and programmatic integrations (API). Our function fetches the data from the register and passes it to the person who asked. We store neither queries nor responses in any database or in function logs — register data exists on our side only while the query is being handled. The exception is the address of the requested page, which may contain the number being checked, in Cloudflare's traffic statistics (section 5). Responses are not stored on Cloudflare's servers either. Responses about companies (other than VIES responses) may include a header that lets the requester's browser (or their proxy server) remember the result for up to 24 hours; responses about natural persons and all VIES responses may be remembered only by the requester's browser, for up to 1 hour.

For natural persons in business (no KRS number, including civil-law partnerships) our server's responses — on the website, in the API, in the MCP server and in the extension — contain only: first and last name (business name), tax ID (NIP), VAT status, town and the number of bank accounts. They do not contain the address, the list of bank accounts, the REGON number, PKD codes or the VAT registration date. A specific account can be confirmed through skanfirmy.pl/rachunek (YES/NO). From the REGON register (skanfirmy.pl/regon/{nip}) we give for natural persons only the tax ID, name, legal form (natural person, local unit of a natural person or civil-law partnership) together with the entity type code from that register, town and whether the business is active, and we refer you to the GUS search. We do not give the REGON number, PKD codes, address, municipality, county, province or dates. A query about the REGON number of a natural person (skanfirmy.pl/firma-po-regon/{regon}) does not return their data. The response only says that the number belongs to a natural person or a civil-law partnership and refers you to the GUS search. For Polish VAT numbers we give from VIES the name and whether the number is valid and, of the address — if VIES provides one — only the town. From KRS we show selected company data from the current extract (including name, legal form, registered office address, share capital, manner of representation and the functions of board members — without their names).

A number included in the page address (e.g. /nip/{number}) appears in Cloudflare's traffic statistics (section 5). In MCP queries and account checks (skanfirmy.pl/rachunek) the numbers are sent in the body of the request, so they do not appear in those statistics. The monitoring tools available through the API and MCP with a key are described in section 6.

The number of queries to data pages and the API from a single IP address is limited (20 queries per 10 seconds) to protect the service against abuse. The MCP server has a separate, higher limit: 60 queries per 10 seconds from a single IP address. Some AI assistants (connectors in their providers' services) connect to the MCP server from the provider's shared IP addresses, so a limit like the one for pages would block many users at once. The limit for pages and the API does not cover bots that Cloudflare recognises as verified — including search engine crawlers, but also, for example, crawlers of companies developing AI models and SEO tools. We block access to pages with numbers (/nip/, /nips/, /regon/, /firma-po-regon/, /vies/) for verified bots that Cloudflare classifies as crawlers collecting data to train AI models. In our robots.txt file we ask crawlers that collect data to train artificial intelligence models not to fetch pages with numbers (/nip/, /nips/, /regon/, /firma-po-regon/, /vies/) and not to use them for training.

Who receives the register data. The person or program that sent the query: a user of the website, the extension, the API or the MCP server (including an AI assistant acting on their behalf). Each of them decides for themselves how to use the data obtained.

4. Local storage in your browser

The tools on the site's pages save the displayed fields of the result in your browser's local storage (localStorage) so that the register is not queried again for the same number. For natural persons we save only the fields the tools show (section 3): first and last name (business name), tax ID (NIP), VAT status, town and the number of bank accounts, and the REGON tool — the name, tax ID, legal form, town and whether the business is active; without the address or bank account numbers. Entries older than 24 hours are deleted automatically when you open any page of the site other than the result pages for a specific number (e.g. /nip/{number}). Entries in the older format saved before 27 September 2026 (they may contain the address and bank account numbers) are deleted the first time you open such a page. We also store the accessibility bar settings in local storage. In session storage (sessionStorage) the home page remembers that you have closed the bulk check suggestion; the entry disappears when you close the tab. This data is never sent anywhere; you can delete it at any time by clearing the site data in your browser.

5. Traffic statistics, cookies and tracking

We use no cookies and no analytics or advertising scripts.

Our infrastructure provider, Cloudflare, automatically records technical data about every request to the service at skanfirmy.pl: IP address, browser (user-agent), country, time and the address of the requested page. For pages such as skanfirmy.pl/nip/{number}, /nips/{list}, /regon/{nip}, /firma-po-regon/{regon} or /vies/{country}/{number} the page address contains the number being checked. These statistics are available to us for 31 days. We use them only to keep the service secure and running and to handle requests concerning personal data. We do not combine them with other data or use them to identify the people asking.

Since 27 September 2026 we also keep our own aggregate counters of queries to data pages and the API (including from the REGON and VIES tools on the website) and to the MCP server: the daily number of requests per channel (e.g. /nip, /regon, an MCP server tool), response format (e.g. HTML or JSON), type of client program and response code. The type of program comes from the User-Agent header (browser, known crawler, HTTP library or the first word of the program's name) or from the name an MCP program reports itself when connecting. We do not store IP addresses, the numbers checked, page addresses, arguments or results. The counters are kept in a Cloudflare D1 database with EU jurisdiction for 90 days. Purpose: developing the service, including planning paid options. The counters are generally not personal data; where a program's name contains someone's name, the legal basis is Art. 6(1)(f) GDPR.

Measurement in emails. Emails of the monitoring service (section 6) are sent by Brevo. In the HTML version of messages, Brevo adds an invisible image (a so-called pixel) and routes links through its own server to measure opens and clicks and to protect sending against abuse — for automatically sent messages Brevo does not allow this to be switched off. Since 29 September 2026 the measurement has been anonymous: Brevo does not attribute opens and clicks to your email address and does not show us IP addresses, and we do not use this data for profiling or marketing. Events recorded earlier may contain the recipient's address, the IP address and the address of the clicked link; Brevo keeps them, like the whole sending log, for up to 12 months (section 6). If your email program does not load images or you read the plain text version, the open is not measured; links in the plain text version lead directly to their destination.

6. Company monitoring (optional service)

skanfirmy.pl offers an optional company monitoring service: you watch selected tax IDs (up to 10 per email address), and once a day we check the VAT Payers Register and notify you of a change in VAT status, bank account or registration data shown in the Register (name, address, KRS or REGON number) — by email and, for programmatic integrations, also by webhook (push notification), API and the MCP server. For natural persons in business we notify you only of changes in VAT status and bank accounts (see below). This is the only service that stores data about companies and people in our database; the other tools work without an account, and all that remains in the database after their use are aggregate query counters (sections 2–5). Providing an email address is voluntary but necessary to use monitoring — without it we cannot send notifications.

What data we store when you use the service:

What notifications contain. In emails, bank account numbers are shortened (the first 2 and last 4 digits are shown). Webhooks, the API (/changes) and the MCP tools pass on the full data of companies, including full account numbers. For natural persons in business, all channels — email, webhook, API and MCP — pass on only the VAT status and shortened account numbers, without the name or town. We do not track changes in the name, address or REGON number of these persons. Whether a specific account is in the VAT Payers Register can be checked via skanfirmy.pl/rachunek. You see the change history from the day you added a watch for a given tax ID (up to 90 days back).

Numbers in a group excluded under section 8 cannot be watched. We suspend existing watches of such numbers without an automatic notification: we do not check these numbers, send notifications about them or show their data or changes, and we only store the data already saved. If the exclusion becomes final, we delete these watches together with the saved state, the change history and the entries in the notification log, and in the proof of consent we replace the number with the marker “restricted”. This may also affect a number you watch even though its owner has not objected.

The data of the watched entrepreneurs comes from the public VAT Payers Register, not from the people it concerns (Art. 14 GDPR). Information for those people is given in section 8.

Where and for how long. We store the service data in a Cloudflare D1 database with European Union jurisdiction — the database runs and stores data only in the EU. The service's server function writes technical operating logs (without email addresses or data of watched companies), kept for 7 days. Retention periods:

Sign-up and unsubscribing. Sign-up requires confirmation by clicking the link in an email (double opt-in). Every later addition of numbers through the form also requires email confirmation; through the API and the MCP server you add numbers with the API key, which only a confirmed subscriber receives. The form's reply (“Done — check your inbox and confirm the sign-up.”) does not say whether the address already uses the service or which numbers it watches. If you submit numbers you already watch, or the new numbers do not fit within the limit of 10 tax IDs, we send the explanation by email to the address in the request. From the form we send at most 2 messages a day to one address (after unsubscribing — 1).

You can withdraw your consent to notifications at any time — via the link in the footer of any alert (on the page that opens, you confirm with a single button), with the unsubscribe button in your email program or by writing to info@skanfirmy.pl. When you unsubscribe, we delete your watches, API key and webhook settings, stop sending messages, and add your address to the suppression list. The unsubscribe button in your email program is handled by Brevo: it adds the address to its block list and immediately stops delivering to it. Addresses that permanently reject messages (hard bounce) or reported our message as spam are also added to that list. Every day at 6:00 UTC we download the whole block list of our Brevo account and apply the entries concerning skanfirmy.pl messages: we treat an unsubscribe via the button as unsubscribing, and a hard bounce or spam report as unsubscribing with the address blocked on the suppression list. Entries without a sender (e.g. some hard bounces) are applied only to addresses already in our database; entries concerning our other services are skipped. We therefore delete the watches at the next successful synchronisation — usually the next day. We keep the proof of consent for 3 years (see above). We delete the remaining data in full at your request (section 7).

Processors. To provide the service we use — only on our behalf and for the purposes of this service:

We do not sell your email address or any other data of yours and — apart from Brevo's processing of part of the sending data for its own purposes, mainly protection against spam (section 9) — we do not share it with anyone for their own purposes. Transfers of data outside the EEA are described in section 9.

Legal basis. Email address and delivery of the notifications you ordered — Art. 6(1)(b) GDPR (providing a service you requested). Confirming your sign-up by double opt-in is also your consent to receive email notifications from us (Art. 398 of the Polish Electronic Communications Law), which you can withdraw at any time — withdrawal ends the service. Data of watched companies (tax ID and information from the VAT Payers Register), proof of consent (date and IP address of confirmations), the suppression list, the block list downloaded from Brevo, the sending log and the measurement of opens and clicks by Brevo — Art. 6(1)(f) GDPR (legitimate interest: providing and monitoring the service, accountability for consent, respecting your unsubscribe and the security of sending).

Automated processing. We make no decisions about you based solely on automated processing (including profiling) within the meaning of Art. 22 GDPR. The only automated steps are the daily comparison of company records from the VAT Payers Register and sending notifications — this has no legal effects on you.

7. Your rights (GDPR)

With regard to the personal data we process, you have the right to access your data and obtain a copy, to rectification, erasure, restriction of processing, to object, to data portability and to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). To exercise these rights, write to info@skanfirmy.pl. We reply without undue delay and within one month at the latest. Taking into account the complexity and number of requests, we may extend this period by a further two months; we will inform you of this within one month, giving the reasons (Art. 12(3) GDPR). You also have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland) or with the supervisory authority in the EU Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). The rights of entrepreneurs whose data comes from the registers are described in section 8.

8. Are you an entrepreneur whose data is in a register?

If you run a sole proprietorship or are a partner in a civil-law partnership, your data in the public registers is personal data. The service shows a limited part of it to anyone who asks about your number (scope below). We do not receive it from you, so we give the information required by Art. 14 GDPR in this section.

What data and where from. From the VAT Payers Register kept by the Head of the National Revenue Administration (Art. 96b of the Polish VAT Act) we fetch the entity's whole entry with every search for a number, because the Register's API does not allow selecting fields. The entry includes first and last name (business name), tax ID (NIP), REGON, VAT status, registration or removal dates, address and bank account numbers. We show only the first and last name (business name), tax ID (NIP), VAT status, town and the number of bank accounts. At the request of the person asking, we confirm (YES/NO) whether an account they give is in the Register. We discard the other fields right after fetching them — we neither display nor store them. This applies to all channels, including tools that run in the requester's browser (section 3). From the REGON register (Statistics Poland, GUS) we show only the name, legal form (also as the entity type code), town and whether the business is active — without the REGON number, PKD codes, address, municipality, county, province or dates. From the EU VIES system: the name, whether the EU VAT number is valid and — if VIES provides an address — the town. The address in the VAT Payers Register may be a home address, so of the address we show only the town.

For what purpose and on what legal basis. So that users can verify a business partner, in particular its VAT status and bank account before paying. The tax consequences of a payment depend on this (including Art. 117ba of the Polish Tax Ordinance, Art. 22p of the Personal Income Tax Act and Art. 15d of the Corporate Income Tax Act). The legal basis is legitimate interest (Art. 6(1)(f) GDPR): above all the interest of users who check a business partner before paying, and our interest in running the service and developing our services, including paid ones. The free tools also show our competence and may lead to enquiries about the controller's paid services (the “Services” page). We do not use entrepreneurs' data from the registers to promote those services or for any other marketing. We have assessed these interests in a documented balancing test, separately for each way of access. On request we will provide information about this assessment; we present the full document to the President of the Personal Data Protection Office at their request. We keep processing to a minimum:

Who may receive the data. Anyone who asks about your number: a user of the website, the extension, the API or the MCP server (including an AI assistant acting on their behalf) — in the scope described above. If someone watches your number in the monitoring service — also that subscriber (by email, webhook, API or MCP; only the VAT status and shortened account numbers). The number being checked is also received by the operator of the register we query (Ministry of Finance, GUS, European Commission — VIES system). The processors listed in section 9 process the data on our behalf.

For how long. Register data exists on our side only while a query is being handled. Exceptions:

Your rights. You have the right to access the data, to request its rectification, erasure or restriction of processing, the right to object and the right to lodge a complaint with the President of the Personal Data Protection Office or with another supervisory authority (section 7). The data comes from the registers, so rectification takes place at the source (e.g. in CEIDG, the Central Register of Business Activity). The service fetches data live, so a change in the register is visible with the next query.

Objection and excluding your number. You may object to the processing of your data in the service on grounds relating to your particular situation (Art. 21(1) GDPR). Write to info@skanfirmy.pl, give your tax ID (NIP) and describe the circumstances. While your objection is being assessed, you may request restriction of processing (Art. 18(1)(d) GDPR). We assess every objection individually and reply with reasons — without undue delay and within one month at the latest (on the possible extension — section 7). We may ask you to confirm that the request comes from you. If we do not uphold your objection in full, you may lodge a complaint with a supervisory authority (section 7).

We do not show the address (other than the town) or the lists of bank accounts of natural persons in business to anyone, regardless of any objection. If we uphold an objection, we stop showing the data covered by it in all channels of the service. If we uphold it also as regards the remaining data (first and last name, tax ID, town) — e.g. where even this limited data threatens a person's safety — or if a supervisory authority or a court orders it, we exclude the number from all channels of the service: the website (including the tools that run in the browser), the API, the MCP server, the extension and the monitoring service. We exclude the number in the same way, temporarily, while your objection is being assessed if you request restriction of processing. The service then refers you to the Ministry of Finance VAT payer register search. For technical reasons such a referral also appears for several hundred other numbers in the same group. It does not mean that the entity is not in the Register or that it has objected. The micro-account generator still works for excluded numbers, because it computes the account number from the digits of the tax ID alone, without register data. The exclusion applies only to skanfirmy.pl — public authorities continue to publish your data at the source.

For information: the VAT Payers Register discloses the home address of a natural person who has not indicated a permanent place of business (Art. 96b(3)(7) of the Polish VAT Act). Indicating such a place at a different address in CEIDG changes the address disclosed in the Register.

Automated decisions. We make no decisions based solely on automated processing, including profiling.

9. Legal bases, processors and transfers outside the EEA

Legal bases:

Processors. They act only on our instructions, under data processing agreements: Cloudflare, Inc. — website hosting, server functions, the monitoring service database (EU jurisdiction), traffic statistics and forwarding of email sent to info@skanfirmy.pl; Brevo (Sendinblue SAS, France) — sending the monitoring service emails, including the measurement of opens and clicks (section 5); Google (Google Workspace) — the mailbox that receives correspondence sent to info@skanfirmy.pl; 1Password (AgileBits Inc., Canada) — storing exclusion records, without numbers; the records are encrypted on our devices with a key that 1Password does not know and are stored in the EU.

Other recipients. Brevo also processes part of the sending data (including message content and delivery data) as a separate controller — to protect against spam and abuse (including training its systems that detect them), for statistics and to establish, exercise or defend its legal claims (Brevo's privacy policy). To handle correspondence and keep documentation we also use other IT service providers.

Transfers outside the EEA. Traffic is handled by Cloudflare's global network and correspondence by Google, so queries, statistics, logs and correspondence may also be processed outside the European Economic Area. Brevo stores data in the EU and may process it outside the EEA — in the USA and India — for technical support and through its subcontractors. To the extent that Cloudflare, Brevo and Google process data outside the EEA or share it with affiliates outside the EEA, this takes place on the basis of European Commission adequacy decisions (including the EU-US Data Privacy Framework) and/or standard contractual clauses (SCC).

Anyone, including people outside the EEA, can use the website, the API and the MCP server — they then fetch the data themselves, on their own initiative and without an account, as from public register search tools. We do not treat such availability as a transfer of data to a third country (cf. judgment of the CJEU of 6 November 2003, C-101/01 Lindqvist). The monitoring service sends data to a specific subscriber (by email, by webhook, or via the API and MCP with a key), so it is intended only for subscribers from the EEA and from countries for which the European Commission has found an adequate level of protection (section 6 of the Terms). If a subscriber gives a webhook address on a server outside the EEA, the onward transfer is their processing as a separate controller.

10. Chrome extension (Skan Firmy)

The “Skan Firmy” browser extension follows the same principles as the website. Detecting NIP/REGON/KRS numbers on the open page happens entirely locally in the browser. When you check a company, the only thing sent off your device is the number you deliberately check — to skanfirmy.pl, which fetches the data from the MF, KRS, GUS and VIES registers (section 3; the number also appears in the traffic statistics, section 5). The extension receives from skanfirmy.pl the same limited data as the other channels: for natural persons without the address, lists of bank accounts, REGON number, PKD codes or VAT registration date (section 3). From version 1.3.0 the extension can also check a bank account: the tax ID and account number are then sent to skanfirmy.pl (and on to the Ministry of Finance) in the body of the request, and nothing is stored. If you use monitoring in the extension: when you sign up, the extension passes the email address and numbers you provide to us (section 6), and after you enter your API key, it fetches the changes for your watches from skanfirmy.pl every 6 hours and shows a notification.

Check results (for natural persons — first and last name (business name), tax ID, VAT status, town and number of bank accounts), recent check history, favourites, settings and the optional monitoring API key are stored locally (chrome.storage) on your device and do not reach us. Exception: Chrome may sync the extension language you choose between your devices if you have sync turned on in the browser. From version 1.3.0 check results are kept for up to 24 hours, and those about natural persons for up to 1 hour; the extension deletes expired entries automatically (earlier versions kept results for up to 24 hours and deleted them on the next read). The check history (up to the 8 most recent numbers with the name) and favourites stay on your device until you delete them. Apart from the number being checked, the extension does not send the content of the pages you visit, does not track your browsing and does not load external code. It uses its permissions only for verifying companies and monitoring notifications; access to page content is one-off and triggered only by your click or a keyboard shortcut.

11. Changes to this policy and version history

We publish every change on this page with its date and a description. Previous version: skanfirmy.pl/en/polityka-archiwum/2026-10-02.

Earlier versions are available on request.

← Back to skanfirmy.pl