BTLA Broker · version 2026-09-25.1
This policy explains how we process data when you use btlabroker.eu, contact us and complete insurance questionnaires. It also covers cookies and following links to Colonnade travel insurance.
Key information: the information in the form is used to handle your enquiry. Sending an enquiry does not subscribe you to a newsletter or give consent to advertising. Do not provide health information, your PESEL number, passwords or identity document details in the questionnaires.
1. Data controller and contact
The data controller is BTLA BROKER LEADER sp. z o.o. with its registered office in Katowice, al. Wojciecha Korfantego 138A lok. 114, 40-156 Katowice, KRS 0000592726, NIP 9542761036. We use the BTLA Broker brand on this website.
For personal data matters and to exercise your rights, you can write to [email protected] or at the postal address above. You can also contact us by telephone: 32 307 70 37. We have not appointed a data protection officer; privacy matters are handled by the controller.
2. What data we receive
- Contact: data you enter in a form or message, in particular your name, email address, telephone number, company name and enquiry. The scope depends on your chosen contact method.
- Insurance questionnaires: information about your business and insurance needs, such as property, fleet, investment projects, number of employees or a planned business trip. Business information may constitute personal data, particularly for sole traders. We ask for what is needed for an initial discussion; we do not collect traveller lists or medical records.
- Handling your case: correspondence, responses, arrangements, case status, contact dates and information needed to organise further assistance. For questionnaires, we also record the submission date, the version of the privacy information provided, the source page and a technical campaign identifier if present in the link.
- Website operation: the server receives connection data, including the IP address, request date and time, page address and information supplied by the browser. These are used to deliver the website and prevent misuse. The questionnaire register does not store a raw IP address as a case field.
We receive data primarily from you. If a company representative contacts us, we ask for business contact details and information about that company. Do not enter other people’s details unless they are needed to handle the enquiry. If further data is needed at a later stage, we will explain its scope, purpose and how to provide it securely.
Providing data is voluntary. Required fields are marked on the form. Without contact details we cannot respond, and without the information required for the selected enquiry type we cannot carry out an initial assessment. You may leave optional fields blank.
3. Purposes and legal bases for processing
- Answering questions, arranging a conversation and contacting a company representative: Article 6(1)(f) GDPR. Our legitimate interest is handling incoming correspondence, identifying the needs of interested businesses and maintaining business contact.
- Steps taken at your request before entering into a contract: Article 6(1)(b) GDPR, where you, as an individual, are to be a party to the contract. Where you act solely on behalf of a company, we process your contact details on the basis of the legitimate interest described above.
- Protecting the website and preventing spam: Article 6(1)(f) GDPR. Our legitimate interest is website security, continuity of service and limiting repeated and automated submissions.
- Establishing, pursuing or defending claims: Article 6(1)(f) GDPR, to the extent actually necessary to protect our rights, for example arrangements relevant to a dispute.
- Handling data requests and demonstrating compliance with GDPR obligations: Article 6(1)(c) GDPR in connection with the controller's obligations, in particular Article 5(2) and Articles 12–22 GDPR.
The form is not intended to obtain general consent to any use of your data. We do not make responding to your enquiry conditional on marketing consent. If we offer a separate consent-based service in future, we will explain its purpose and let you choose freely.
The initial questionnaire does not conclude an insurance contract. Detailed processing when entering into and performing a brokerage or insurance contract is covered by information provided at the relevant stage. We do not use the questionnaire to make solely automated decisions that produce legal effects or similarly significantly affect you. The travel guide result is not an automated assessment of eligibility for insurance.
4. Data recipients and external services
Access is available to authorised people handling enquiries and to service providers needed to operate the website: hosting, system maintenance and security, backups and email. We share data only to the extent needed to provide the relevant service.
The website uses WordPress and WPForms. Questionnaire submissions go to BTLA's private register in the website database. The contact form may save an entry in WPForms and send an email notification. We use hosting from WEBD (Globtel Internet Szymon Hersztek) and Microsoft 365 business email. The presence of WPForms software alone does not mean the contents of all submissions are shared with its developer.
If we agree to prepare a proposal that requires contacting an insurer, relevant data may be passed to that insurer to the extent necessary for the agreed action. Submitting the questionnaire does not automatically send it to all insurers. Data may also be received by advisers assisting us with a particular matter and by authorities legally entitled to receive it.
Using Microsoft’s global services may involve processing some data outside the European Economic Area, including in the USA, for example for technical support. The service terms provide mechanisms to safeguard transfers, particularly the European Commission’s standard contractual clauses; an adequacy decision may apply where appropriate. You can obtain information about the relevant safeguards or a copy by writing to [email protected]. The provider’s terms are available in Microsoft's Data Protection Addendum. We do not assume that all operations involving the cloud service take place exclusively in Poland.
5. How long we retain data
The retention period depends on the purpose and progress of the particular matter. We apply the following criteria:
- Enquiries and correspondence: for the time needed to respond and complete the agreed activities. This ends, for example, when a final response is provided, further contact is declined or service under a contract begins. After that, we retain only data needed for another purpose listed in this policy that still applies.
- Contract or legal obligation: if an enquiry leads to working together, the necessary information becomes part of the records of that relationship. We explain the retention periods arising from its nature and the relevant rules when providing those services.
- Claims: only the necessary material relating to a particular claim, until the applicable limitation period expires or, if proceedings have begun, until they are finally concluded and the steps needed to settle the case are complete. This does not mean that every enquiry is retained in full indefinitely.
- Security: technical data is retained for as long as it is useful for detecting and investigating errors or misuse, taking account of the hosting provider's log rotation. Where a record relates to a particular incident, the relevant extract may be preserved while the incident is investigated or claims are pursued.
- Preventing duplicate submissions: the technical identifier for repeat questionnaire submission is valid for 24 hours; expired identifiers are removed by a clean-up task. The rate limiter works in 10-minute windows and uses a hash rather than a raw IP address.
Correspondence and backups require separate management. Deleting a record does not immediately delete every copy in email or backups. Backups are used to restore the system; data deleted from active handling remains in them until overwritten in the backup cycle and is not reused for routine contact. On request, we will explain the period or criterion applicable to your case.
6. Your rights
Subject to the GDPR, you may request access to your data and a copy of it, rectification, erasure or restriction of processing. The right to data portability applies to data processed by automated means on the basis of consent or a contract, to the extent provided for in the GDPR.
You have the right to object on grounds relating to your particular situation to processing based on our legitimate interest. If data were used for direct marketing, you could object to that use at any time. Where a particular operation is based on consent, you can withdraw it without affecting the lawfulness of earlier processing.
Write to [email protected] and describe your request. You do not have to use a special form. We may request information needed to confirm your identity where there are reasonable doubts. As a rule, we respond within one month; any extension and its reasons are explained in accordance with the GDPR.
You can lodge a complaint with the President of Poland’s Personal Data Protection Office. Information on contact methods and complaints is available at uodo.gov.pl. Some rights are subject to conditions and exceptions, for example where retaining certain data is required by law.
7. Cookies, browser storage and statistics
Cookies are small pieces of information stored in your browser. WordPress may use technical cookies needed for logging in, maintaining a session and remembering dashboard settings for website administrators. Their scope depends on the use of these features; they are not required simply to read the offer as a visitor who is not logged in.
Our forms use settings that limit additional data collection: WPForms user tracking identifiers and recording a user’s journey between pages are disabled. Form performance may be measured using aggregate WPForms statistics, such as views or successful submissions; these are not used to build an individual visitor’s advertising profile.
We enable optional BTLA statistics and Google Analytics after your choice in the privacy panel. Details are provided in the supplement below. Browsing the website alone does not constitute consent.
You can inspect, block or delete stored cookies and website data in your browser settings. Blocking technical features may make logging in or using features requiring a session more difficult. Cookies and similar mechanisms necessary to provide a service requested by the user are subject to Article 399 of the Polish Electronic Communications Law.
8. Personal travel guide and links to Colonnade
The short guide on the travel insurance page asks about your destination, activities and travel dates. Your answers are used to display information in your browser. The guide does not save these answers as an enquiry to BTLA or automatically send them to the Colonnade calculator.
The external Colonnade website opens only when you select the button to view its offer. The link contains a BTLA partner identifier, which attributes the visit to our link. It does not identify the person completing the guide. The destination website receives normal connection data, such as an IP address, and the information you provide directly to it.
The controller of data collected on the insurer's website is Colonnade Insurance S.A., operating in Poland through its branch. The rules for quotes, purchase, data processing and cookies are described in Colonnade privacy policy. Read it before entering data in the external form. Information in the BTLA guide does not replace the insurance terms or an assessment of your insurance needs.
9. Policy updates
We update this document when the website's operation, services used or data processing arrangements change. The version number appears at the beginning. Significant changes requiring additional information or consent are explained in the relevant place before the new processing begins. When a questionnaire is submitted, we record the version of the information in force at the time of submission.
Enquiry handling register
Enquiries sent through insurance questionnaires and the contact form are saved in a private BTLA service register on our website. The register contains the information provided, a case reference, the submission page and progress information. Access is restricted to authorised staff handling enquiries and administrators. The contact form may also store the submission in WPForms and send it by email, according to its configuration. These records are used to handle your enquiry; they do not require consent to advertising measurement. The processing grounds, retention period and individuals’ rights are described in this policy.
Optional measurement of website and advertising effectiveness
After statistics consent, we retain the visit source, campaign tags and landing page within the session. We link this information to an enquiry if you submit one. We also count telephone, email and Colonnade link clicks. We do not store the contents of travel guide answers in click statistics.
Separate advertising consent allows us to save the Google Ads click identifier (GCLID) and link it to an enquiry, lead qualification and confirmation that a policy has been concluded. This data may be shared with Google Ireland Limited in an offline conversion file; the file contains no name, telephone number, email address or enquiry text. Google may process data outside the EEA under appropriate transfer safeguards. Provider information: Google privacy policy.
Podstawą opcjonalnego pomiaru jest zgoda (art. 6 ust. 1 lit. a RODO). Do czasu wyboru pomiar pozostaje wyłączony. Zmianę lub wycofanie zgody umożliwia przycisk „Prywatność — pomiar”. Brak zgody nie ogranicza możliwości kontaktu. Wycofanie nie narusza zgodności wcześniejszego przetwarzania; w sprawie usunięcia danych przypisanych do zapytania napisz na [email protected].
In localStorage, we store only consent choices (btla_consent_v1), for up to 180 days. In sessionStorage, after consent, we store the source and GCLID (btla_attribution_v1) until the browser tab session ends or for a maximum of 24 hours. Attribution data and GCLID are removed from the submission by a clean-up task after 90 days; the period for handling the submission itself is described above. We retain aggregate click counts for 90 days. The event integration uses the existing Google Analytics 4 tag. It does not add a second tag or change its configuration.
With current statistics consent, we send the click type, calculator use and confirmation that an enquiry has been accepted to the existing Google Analytics 4. Event parameters contain no name, telephone number, email address, case reference, form text or entered amounts. The confirmation key used to prevent duplicates remains in sessionStorage (btla_ga4_leads_v1) until the tab session ends; we do not send it to Google. The existing tag configuration, its cookies and data retention period should be checked separately. Lack of consent does not block forms.
Contact about a refused claim or payment amount
The post-loss assistance form is used to identify the subject of an enquiry and contact you about it. Information provided about the policy type, loss, decision, amounts and dates is saved with contact details in the non-public register described above. We do not accept attachments or health data through this form. Documents and any legal services are agreed separately; submitting the form does not automatically transfer the case to another entity. Separate, voluntary consent may authorise the broker to manually forward the submission to BTLA Legal, Oleś, Drzewiecki. Kancelaria Adwokatów Spółka Komandytowa, al. Korfantego 138 A lok. 114, Katowice, NIP 9542842651, KRS 0000980377. The law firm is a separate data controller; contact: 32 307 70 37, btla.eu. Consent is for contact and assessing the possibility of legal assistance. It may be withdrawn without affecting the lawfulness of earlier processing. Lack of consent does not prevent an enquiry to the broker. The calculators run locally in your browser. Amounts and dates entered are included in an enquiry only if the user adds the summary to the form and submits it.
Google Analytics 4 — statistics with your consent
After you select statistics consent, we also use Google Analytics 4 (a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The tool helps assess visits and how the website is used. It includes page views, visit sources, browser and device details, and cookie identifiers. Google also receives technical data, including the IP address, when a connection is made. Our integration code does not share names, email addresses, telephone numbers, questionnaire answers or calculator amounts.
The GA4 tag is blocked until consent — browsing the site or refusing consent does not activate it. Statistics consent does not enable ad personalisation or Google Signals. The Google Ads measurement option described above concerns a separate BTLA process.
This optional measurement is based on consent. You can withdraw it at any time through “Privacy — analytics”, deselect statistics and save your choice, or select “Essential only”. Withdrawal stops further measurement by this integration and removes accessible GA cookies from this website; it does not automatically delete data already shared with Google or affect the lawfulness of earlier processing.
Cookies _ga and _ga_15VPFYE3V6 have a lifetime of up to 180 days in this integration, without the expiry date being renewed on each visit. We store your consent choice in btla_consent_v1 for up to 180 days. The retention period for event and user data in GA4 depends on the settings of the Google Analytics property managed by BTLA; cookie expiry is not the report retention period.
Google may process data outside the EEA under the terms described in its documents, including appropriate transfer safeguards. See Google’s privacy policy and information on processing data from partner websites. For data matters and your rights, contact BTLA: [email protected].
BTLA videos on the website
Selected pages contain BTLA recordings stored on this website’s server. The video file is downloaded only after you use the “Watch video” button. Playback does not require a connection to TikTok.
The close button stops the video and removes the player from the current page. A separate link opens the recording on TikTok in a new tab; TikTok’s privacy rules apply when you choose that link.