Privacy Policy

The controller of personal data collected through the kuzmina.pl website (the "Website") is Olga Kuzmina Balet, ul. Mariana Rapackiego 3B, 71-467 Szczecin, Poland (the "Controller"). In all matters relating to the protection of personal data, the Controller can be contacted at kuzmina@o2.pl.

Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 ("GDPR"), the Polish Electronic Communications Law of 12 July 2024 as regards cookies and similar technologies, and the applicable provisions of Polish law.

The Website provides a contact form and forms for asking about specific classes or events. Using them requires providing a full name, an e-mail address and the content of the message, and in the contact form also its subject; a phone number may be provided optionally. This data is processed in order to respond (Art. 6(1)(b) GDPR - steps taken at the request of the person prior to a possible contract), and otherwise - on the basis of the Controller's legitimate interest in conducting correspondence (Art. 6(1)(f) GDPR).

Messages from these forms are delivered to the Controller's mailbox via an external e-mail delivery provider; an automatic confirmation of receipt is also sent to the address provided. The provider keeps copies of sent messages for 30 days. The Website does not maintain its own database of submissions. Correspondence is kept until the matter is closed and, in justified cases, until the expiry of the limitation period for any claims.

Class pages provide a class sign-up form, operated by the ActiveNow system (Activenow sp. z o.o., Poland) - the school's customer management system, which processes the data on the Controller's behalf. The list of groups and schedules is fetched from ActiveNow's servers whenever a class page is opened, including for visitors who do not sign up; ActiveNow then receives connection data, including the IP address, browser information and the address of the page visited. The basis for this processing is the Controller's legitimate interest - presenting the current class offering (Art. 6(1)(f) GDPR). Data entered in the form is sent directly to the ActiveNow system. The form covers the participant's full name, optionally their date of birth, the full name of the parent or guardian (where the participant is a child), an e-mail address, optionally a phone number, and the chosen class group. A child's data is provided by their parent or legal guardian.

Sign-up data is processed in order to accept the application and to conclude and perform the contract for participation in classes, including billing (Art. 6(1)(b) GDPR) - for the duration of participation and afterwards for the period required by law or until the expiry of the limitation period for claims. Once the application is accepted, the ActiveNow system sends a confirmation with the class terms and conditions and an invitation to the client panel to the e-mail address provided. Participation in classes is governed by the school's terms and conditions.

The ActiveNow client panel is a service provided by Activenow sp. z o.o., which is a separate controller of the user account data (login, account settings); the processing of that data is described in the ActiveNow privacy policy available at activenow.io.

Providing the data is voluntary but necessary to receive a response or to have the sign-up accepted.

The Website uses a statistics tool that operates without cookies and without creating user profiles, hosted on servers in the European Union. Only aggregated traffic data is collected: pages visited, referral source, browser, operating system and device type, country, region and city, and events such as a button click or a form submission (without the form's content). The IP address is used only transiently - to distinguish visits within a single day and to determine an approximate location - and is not stored. The processing is based on the Controller's legitimate interest - analysing traffic on the Website (Art. 6(1)(f) GDPR).

To keep the Website working correctly, technical errors occurring in the browser are reported automatically to an external monitoring tool that stores data on servers in the European Union. An error report may include the address of the page visited, information about the browser and operating system, and a technical description of the error together with the events preceding it. Reports do not include users' IP addresses; the Website does not record sessions or activity recordings. Reports are kept for 90 days. The processing is based on the Controller's legitimate interest - maintaining the reliability and security of the Website (Art. 6(1)(f) GDPR).

The Website is maintained on the infrastructure of an external hosting provider. As part of this service, the provider processes network connection data, including IP addresses, to the extent necessary to deliver the Website's content, ensure its security and protect against abuse; technical logs are kept short-term. The contact form and the question forms are handled on the provider's servers located in the European Union. Mechanisms protecting against automated traffic (bots) may analyse browser signals and temporarily store in the browser information necessary to verify the connection. The processing is based on the Controller's legitimate interest - maintaining and securing the Website (Art. 6(1)(f) GDPR).

Personal data may be passed to the following categories of recipients: the hosting and IT infrastructure provider, the e-mail delivery provider, the statistics tool provider, the error monitoring tool provider, the web font provider (section 11), and Activenow sp. z o.o. as the provider of the school's customer management system (section 2). These entities process data on the Controller's behalf, under the agreements or terms of service concluded with them, and only to the extent necessary to provide their services. Once the map or a video is clicked (sections 9 and 10), connection data is received by Google, which processes it as a separate controller.

The forms are handled on servers in the European Union, statistics and error reports are stored in the European Union, and the ActiveNow system - in Poland. Copies of e-mails sent from the forms are stored by the e-mail delivery provider in the United States, for 30 days. The hosting, e-mail delivery and web font providers, as well as Google, are based in the United States, so data may be transferred outside the EEA - solely on the basis of a European Commission adequacy decision (the EU-US Data Privacy Framework) or standard contractual clauses (SCC). A copy of the safeguards applied can be obtained by contacting the Controller.

The Website uses no cookies that require consent and displays no cookie banner. The only information the Website stores in the browser is whether a list of posts has been expanded on listing pages (browser session storage, cleared when the tab is closed). The Google map and YouTube videos are loaded only after a click - only then may Google store its own cookies or identifiers in the browser (sections 9 and 10). The hosting provider's bot protection mechanisms may temporarily store information necessary to verify the connection (section 5).

Cookies and data stored by websites can be deleted or blocked in the browser settings, which may however affect the operation of some of the Website's features.

The Website's contact page provides a directions map supplied by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The map is loaded only after a click; until then the browser does not connect to Google's servers. Loading the map involves Google processing connection data, including the IP address, and may involve Google storing its own cookies in the user's browser. The detailed rules of data processing by Google are described in the privacy policy available at policies.google.com/privacy.

Some posts on the Website embed videos from YouTube (Google Ireland Limited) in privacy-enhanced mode (the youtube-nocookie.com domain). The player is loaded only after the play button is clicked; until then the browser does not connect to Google's servers, and no video thumbnail is fetched either. After the click, Google receives connection data, including the IP address, and may store its own identifiers or cookies in the browser. The details are described in Google's privacy policy available at policies.google.com/privacy.

The Website uses fonts supplied by an external provider (Adobe Fonts). When each page loads, the browser fetches the font files from the provider's servers, which thereby receive connection data - the IP address, browser information and the domain the request comes from - in order to deliver the fonts and account for the licence; the provider does not store cookies in the process. The processing is based on the Controller's legitimate interest - a consistent presentation of the Website (Art. 6(1)(f) GDPR).

Every data subject has the right to access their data, rectify it, erase it, restrict its processing, port it, and object to processing based on legitimate interest. Where processing is based on consent, the consent can be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal. They also have the right to lodge a complaint with the President of the Personal Data Protection Office (uodo.gov.pl).

Requests concerning the exercise of these rights can be sent to kuzmina@o2.pl. Matters concerning a user account in the ActiveNow client panel should be addressed to Activenow sp. z o.o.

Personal data is not used for automated decision-making, including profiling. The Policy may be updated - the current version is published on this page together with the date of the last update.