Privacy Policy
This Policy informs users (Users) of the https://szkolastok.pl website (Website) about the purposes and legal bases for processing personal data on the Website, how the data are used, and the rights available to Users in connection with that processing. The personal data controller (Controller) protects Users' privacy and ensures the security of the data they provide. The Controller observes the principles of personal data processing and applies technical and organisational measures to ensure data security and lawful processing. Users' personal data are always processed under the applicable law, in particular the Telecommunications Law Act and the Regulation of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR). Personal data may be processed in Users' cookies under the rules set out in the Cookie Policy.
Who is the personal data controller?
The personal data controller is Maciej Kolasa Szkoła Narciarska "STOK" with its registered office at ul. Antałówka 3, 34-500Zakopane, KRS: 0001004571, NIP: 7352909799, REGON: 523762759. Contact address: biuro@szkolastok.pl
Users whose personal data are processed may also contact the Controller by another method of their choice, including verbally or in writing.
Purposes and legal bases for processing personal data
- Communication through the Website's contact form
Personal data are processed for the purposes of the Controller's legitimate interests (Article 6(1)(f) GDPR). The Controller's legitimate interest is communication with a person requesting a response, in particular providing assistance to the User and answering the User's questions. Communication may take place for many reasons that are difficult to categorise. Providing personal data is voluntary, but may be necessary to receive a response from the Controller. - Communication using the contact details provided on the Website
Personal data are processed for the purposes of the Controller's legitimate interests (Article 6(1)(f) GDPR). The Controller's legitimate interest is communication with a person requesting a response, in particular providing assistance to the User and answering the User's questions. Communication may take place for many reasons that are difficult to categorise. Providing personal data is voluntary, but may be necessary to receive a response from the Controller. - Pursuing and defending claims, preventing fraud, producing statistics and analyses, ensuring the security of the IT environment and using internal control systems
Personal data are processed for the purposes of the Controller's legitimate interests (Article 6(1)(f) GDPR). The Controller's legitimate interest is the ability to carry out the activities listed above. - Installing and using cookies on the User's device
The Cookie Policy sets out in detail the purposes and legal bases for processing personal data in cookies.
Recipients of personal data
Users' data will not be disclosed to other third parties unless this proves necessary and the User consents, or the obligation or possibility of disclosure follows from mandatory provisions of law, a final court judgment or a final decision of the competent authority. The Website may contain links to other websites. The Controller is not responsible for personal data processing in connection with the User's use of those websites. After following a link to another website, the User should first read its privacy policy and personal data protection procedures. The Controller does not transfer personal data to third countries outside the EEA or to international organisations.
What is profiling, and are data on the Website profiled?
Profiling means any automated processing of personal data that enables an individual's personal aspects to be evaluated, in particular analysis or prediction of aspects concerning work performance, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, where it produces legal effects concerning that person or similarly significantly affects them. Data on the Website are not profiled. If personal data were to become subject to profiling as the Website develops, the Controller would inform Users, and profiling would take place in accordance with the relevant law. In the event of profiling, the Controller would implement appropriate measures to protect Users' rights, freedoms and legitimate interests, including the possibility of human intervention by the Controller and the opportunity to express their own position and challenge the decision.
What rights do Users have?
The User has the right to access their personal data and the rights to rectification, erasure, restriction of processing and data portability. The User also has the right to object to the processing of personal data, particularly in relation to profiling. To exercise these rights, the User may contact the Controller by email at biuro@szkolastok.pl. The User may also contact the Controller by another method of their choice, including verbally or in writing. The User has the right to lodge a complaint with the President of the Personal Data Protection Office if they consider that the processing of their personal data infringes mandatory provisions of law.
How does the Controller protect personal data?
The Controller protects Users' data against unauthorised access, disclosure, alteration and destruction. In particular, the Controller uses data encryption, physical security measures and verification within IT systems. The Controller also uses antivirus software and firewalls. Access to Users' data is restricted to authorised persons bound by confidentiality obligations and subcontractors who have entered into personal data processing agreements with the Controller.
How long are personal data processed?
Users' data are processed for the period during which they use the Website. Where personal data are processed in connection with:
- Communication through the Website's contact form — personal data will be processed for the period necessary to respond to the User and complete their enquiry, or until the User makes an effective objection.
- Communication using the contact details provided on the Website — personal data will be processed for the period necessary to respond to the User and complete their enquiry, or until the User makes an effective objection.
- Pursuing and defending claims, preventing fraud, producing statistics and analyses, ensuring the security of the IT environment and using internal control systems — personal data will be processed for the period justified by the nature of those activities or the law, or until the User makes an effective objection.
- Installing and using cookies on the User's device — personal data will be processed for the period specified in the Cookie Policy.
Expiry of the processing period under one legal basis does not mean that personal data cannot be processed under another legal basis. Once the processing period has expired and all legal bases for processing have ceased to apply, personal data are permanently deleted or anonymised.
Entry into force and changes to the Privacy Policy
The Privacy Policy and any changes take effect when published on the Website.
To ensure that the Privacy Policy meets current legal requirements, the Controller reserves the right to change it. Users are informed of changes on the Website.