Privacy policy

1Personal Data Controller

The controller of personal data is “Młodzi Wojownicy Konrad Baraniecki”, ul. Południowa 3, 05-520 Konstancin-Jeziorna, Poland, NIP (Polish Tax Identification Number): 1231107678, operating under the name Centrum Rozwoju Dziecka SKILLZ Młodzi Wojownicy, hereinafter referred to as the “Controller”.

2Purposes and Legal Bases of Data Processing

Personal data of Parents or Legal Guardians and participants is processed to the extent necessary for the operation of the Centre, in particular for the following purposes:

1. receiving and handling a participant’s application;
2. entering into and performing an agreement concerning participation in classes;
3. organising and conducting classes;
4. maintaining accounts and processing payments;
5. communicating with Parents or Legal Guardians on organisational matters and matters relating to their child’s participation;
6. fulfilling obligations arising from legal provisions, in particular tax and accounting obligations;
7. establishing, pursuing or defending possible legal claims;
8. ensuring the safety of individuals and protecting property in connection with the operation of video surveillance.

The legal basis for processing data, depending on the purpose of processing, is:

1. Article 6(1)(b) of the GDPR – processing necessary for entering into or performing a contract;
2. Article 6(1)(c) of the GDPR – processing necessary for compliance with a legal obligation to which the Controller is subject;
3. Article 6(1)(f) of the GDPR – the legitimate interests pursued by the Controller, in particular ensuring safety, protecting property, and establishing, pursuing or defending legal claims;
4. Article 6(1)(a) of the GDPR – consent of the data subject, where, in a particular case, processing is based on voluntarily given consent.

3Categories of Personal Data Processed

In connection with enrolling a child, using the ActiveNow system, electronic forms or other means of contacting the Centre, the following data may be processed in particular:

1. the first name and surname of the Parent or Legal Guardian;
2. email address;
3. telephone number;
4. the participant’s first name and surname;
5. the participant’s date of birth or age, where necessary to assign them to an appropriate group;
6. information relating to participation in classes, attendance and payments;
7. other information provided by the Parent or Legal Guardian where necessary for the proper organisation and delivery of classes.

Providing the data required to enter into and perform an agreement is voluntary; however, failure to provide it may make it impossible to enrol a participant or for the Centre to provide its services.

4Recipients of Personal Data

Personal data may be disclosed to entities providing services to the Controller that are necessary for the operation of the business, in particular:

1. providers of IT systems and participant management systems, including ActiveNow;
2. providers of bookkeeping and accounting services;
3. hosting and IT service providers;
4. payment service providers;
5. providers of legal or debt collection services, where necessary to pursue or defend claims;
6. public authorities and other entities authorised to receive the data under applicable law.

Data is disclosed only to the extent necessary to achieve the specified purpose.

5Data Retention Periods

Personal data relating to participation in classes is processed for the duration of the agreement and, following its termination, for the period necessary to establish, pursue or defend claims, generally until the expiry of the applicable limitation period.

Data contained in accounting and settlement records is retained for the period required by applicable tax and accounting laws.

Data processed to fulfil the Controller’s legal obligations is retained for the period required by the relevant provisions of law.

Data processed on the basis of the Controller’s legitimate interests is retained for as long as necessary to fulfil the relevant purpose or until an effective objection is made, unless further processing is permitted or required by law.

Data processed on the basis of consent is retained until that consent is withdrawn, unless further processing is permitted on another legal basis.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Once the applicable retention period has expired, data is deleted or anonymised, unless further retention is required by law.

6Rights of Data Subjects

Data subjects have, in the circumstances specified by the GDPR, the following rights in particular:

1. the right of access to their personal data;
2. the right to rectification of data;
3. the right to erasure of data;
4. the right to restriction of processing;
5. the right to object to processing;
6. the right to data portability;
7. the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych);
8. where data is processed on the basis of consent, the right to withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal.

7Recovery of Outstanding Payments and Debt Collection

Where payments become overdue, the Controller may process the personal data of the Parent or Legal Guardian for the purpose of establishing, pursuing or securing amounts owed to Centrum Rozwoju Dziecka SKILLZ Młodzi Wojownicy.

The legal basis for processing data for this purpose is the Controller’s legitimate interest under Article 6(1)(f) of the GDPR, consisting of recovering amounts owed and establishing, pursuing or defending claims.

If payments due remain unpaid, personal data may be disclosed, to the extent necessary to recover the debt, to entities assisting the Controller in that process, in particular debt collection agencies, law firms, courts, court enforcement officers (bailiffs) and other entities authorised under applicable law.

Only the data necessary to pursue the specific debt will be disclosed.

Data relating to outstanding debts and claims may be processed for the period necessary to pursue or defend them, taking into account the applicable limitation periods and obligations arising from the law.

8Video Surveillance (CCTV)

Video surveillance is operated on the premises of Centrum Rozwoju Dziecka SKILLZ Młodzi Wojownicy.

Video surveillance is used for the following purposes:

1. ensuring the safety of class participants, Parents, Legal Guardians, employees and contractors;
2. protecting property;
3. investigating incidents that may threaten the safety of individuals or property.

The legal basis for processing data obtained through video surveillance is the Controller’s legitimate interest under Article 6(1)(f) of the GDPR.

Video recordings are retained for no longer than 30 days, unless a recording constitutes evidence in legal proceedings or the Controller becomes aware that it may constitute evidence in such proceedings. In that case, the recording may be retained until the final conclusion of the relevant proceedings or until there is no longer a need to preserve it as evidence.

Recordings may be disclosed only to entities authorised to receive them under applicable law or where necessary to establish, pursue or defend claims.

Data subjects have the rights provided for by the GDPR to the extent that those rights apply to data obtained through video surveillance.

9Voluntary Provision of Data

Providing personal data is voluntary; however, where data is necessary to enter into and perform an agreement, failure to provide it may make it impossible to admit a participant to the programme or for the Centre to continue providing its services.

Where processing is based on consent, giving consent is voluntary.