PRIVACY POLICY AND COOKIES

REGULATIONS FOR PROVIDING SERVICES BY ELECTRONIC MEANS ON THE ACADEMIA SOMBRERO PLATFORM

 

This Privacy Policy (hereinafter: "Policy") contains information about the processing of your personal data in connection with the use of the website academiasombrero.pl (hereinafter "Website") and the services provided by the Administrator.

Personal data administrator

The administrator of your personal data isMichelle Szklarska Castañeda, running a business under the nameSOMBRERO MICHELLE SZKLARSKA CASTAÑEDA in Gdansk, having NIP: , REGON: , in accordance with the information indicated in the Central Register and Information on Economic Activity (hereinafter: "Administrator").

Contact with the Administrator

In all matters related to the processing of personal data, you can contact the Administrator electronically by sending an email toinfo@academiasombrero.com.

Themeans of personal data protection

The Administrator applies modern organizational and technical safeguards to ensure the best possible protection of your personal data and guarantees that it processes them in accordance with the provisions of the Regulation of the European Parliament and Council (EU) 2016/679 of April 27, 2016, on the protection of natural persons in relation to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: "GDPR"), the Act of May 10, 2018, on the protection of personal data, and other provisions on the protection of personal data.

Information about processed personal data

Using the Website and the services provided by the Administrator requires the processing of your personal data. Below you will find detailed information about the purposes and legal bases for processing, as well as the duration of processing and the obligation or voluntariness of providing them.

Purpose of processing	Processed personal data	Legal basis
Conclusion and performance of a contract for the provision of electronic services, as well as taking steps to conclude it (including preparing a quote/offer)	first and last name/company; place of residence/headquarters; email address; phone number;	art. 6 sec. 1 lit. b GDPR (processing is necessary for the performance of a contract concluded with the person to whom the data relates or for taking steps to conclude it)

Providing the above-mentioned personal data is a condition for concluding and performing the contract for the provision of services by electronic means (their provision is voluntary, but the consequence of not providing them will be the inability to conclude and perform the aforementioned contract). The Administrator will process the above-mentioned personal data until the statute of limitations for claims arising from the service contract.

 

Purpose of processing	Processed personal data	Legal basis
Handling the contact form	1) first name; 2) email address; 3) phone number.	art. 6 sec. 1 lit. f GDPR (processing is necessary to pursue the legitimate interest of the Administrator, in this case, to respond to the message sent)
Providing the above-mentioned personal data is voluntary but necessary to receive a response to the sent message (the consequence of not providing them will be the inability to receive a response). The Administrator will process the above-mentioned personal data until an effective objection is raised or the purpose of processing is achieved.

 

Purpose of processing	Processed personal data	Managing the Administrator's profiles on Facebook, Instagram, (hereinafter collectively: "
Services")1. your profile name; 2. data you posted on your profile as "public"; 3. your image (if visible in publicly available photos on your profile); 4. personal data you posted in comments under the content published on the Administrator's profile or sent in a private message to the Administrator's profile; 5. statistical and advertising data collected by the Services; 6. your profile name.	art. 6 sec. 1 lit. f GDPR (processing is necessary to pursue the legitimate interest of the Administrator, in this case, managing profiles on the Services)	art. 6 ust. 1 lit. f RODO(przetwarzanie jest niezbędne w celu realizacji prawnie uzasadnionego interesu Administratora, w tym przypadku prowadzenia profili w Serwisach)

Providing the aforementioned personal data is voluntary but necessary for you to use the Administrator's profile in the given Service (the consequence of not providing them will be the inability to use the Administrator's profile). The Administrator will process the aforementioned personal data until an effective objection is raised or the purpose of processing is achieved. The Administrator informs that, in terms of statistical and advertising data, the co-administrator of personal data is the entity responsible for managing the given Service, namely: 1. Meta Platforms Ireland Limited – with respect to Facebook and Instagram Services; Detailed information regarding the mutual agreements between the Administrator and the aforementioned entities as well as the processing of personal data by these entities can be found in the privacy policies and other documents published in the Services. Any questions and claims arising from your use of the Services should be directed directly to the aforementioned entities.

 

Purpose of processing	Processed personal data	Legal basis
Conclusion and execution of the language course agreement	1. first and last name; 2. email address; 3. phone number.	art. 6 sec. 1 lit. b GDPR (processing is necessary for the performance of the language course agreement concluded with the person to whom the data relates, or for taking steps to conclude it)
Providing the aforementioned personal data is a condition for concluding and executing the language course agreement (providing them is voluntary, but the consequence of not providing them will be the inability to conclude and execute the aforementioned agreement). The Administrator will process the aforementioned personal data until the claims arising from the language course agreement are time-barred.

 

Purpose of processing	Processed personal data	Legal basis
Conducting a complaint procedure	1. first and last name 2. email address	art. 6 sec. 1 lit. c GDPR (processing is necessary to fulfill a legal obligation incumbent on the Administrator, in this case the obligations: – to respond to the complaint – art. 7a of the Consumer Rights Act; – to fulfill the Client's rights arising from the provisions on the Administrator's liability in the event of a digital service's non-compliance with the relevant agreement)

Providing the aforementioned personal data is a condition for receiving a response to the complaint or exercising the Client's rights arising from the provisions on the Administrator's liability in the event of a digital service's non-compliance with the relevant agreement (providing them is voluntary, but the consequence of not providing them will be the inability to receive a response to the complaint and exercise the aforementioned rights). The Administrator will process the aforementioned personal data during the complaint procedure, and in the case of exercising the aforementioned Client's rights – until they are time-barred.

 

Purpose of processing	Processed personal data	Legal basis
Establishing, pursuing, or defending against claims	1. first and last name/company; 2. email address; 3. residence/business address;	art. 6 sec. 1 lit. f GDPR (processing is necessary for the realization of the Administrator's legitimate interest, in this case establishing, pursuing, or defending against claims that may arise in connection with the provision of services or use of the website)

Providing the aforementioned personal data is voluntary, but necessary for establishing, pursuing, or defending against claims that may arise in connection with the provision of services or use of the website (the consequence of not providing the aforementioned data will be the inability of the Administrator to undertake the aforementioned actions). The Administrator will process the aforementioned personal data until the expiration of the limitation periods for claims that may arise in connection with the provision of services or use of the website.

 

 

Purpose of processing	Processed personal data	Legal basis
Analysis of your activity on the website	1. date and time of visit; 2. IP address of the device; 3. type of operating system of the device; 4. approximate location; 5. type of web browser; 6. time spent on the website; 7. visited subpages and other actions taken on the website.	art. 6 sec. 1 lit. f GDPR (processing is necessary for the realization of the Administrator's legitimate interest, in this case obtaining information about your activity on the website)

Providing the aforementioned personal data is voluntary, but necessary for the Administrator to obtain information about your activity on the website (the consequence of not providing them will be the Administrator's inability to obtain the aforementioned information). The Administrator will process the aforementioned personal data until an effective objection is raised or the purpose of processing is achieved.

 

Purpose of processing	Processed personal data	Legal basis
Website Administration	1. IP address; 2. server date and time; 3. browser information; 4. operating system information. The above data is automatically recorded in so-called server logs whenever the Website is used (administering them without using server logs and automatic recording would not be possible).	Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Administrator, in this case, to ensure the proper functioning of the Website)
Providing the above personal data is voluntary but necessary to ensure the proper functioning of the Website (the consequence of not providing them will be the inability of the Website to function properly). The Administrator will process the above personal data until an effective objection is raised or the processing purpose is achieved.

 

Purpose of processing	Processed personal data	Legal basis
Adding comments on the Website	1. first name; 2. email address; 3. IP number.	Article 6(1)(a) GDPR (the processing of personal data is based on consent given)
Providing the above personal data is voluntary but necessary to add a comment (the consequence of not providing them will be the inability to add a comment). The Administrator will process the above personal data until the consent given is withdrawn (comment is deleted).

 

Purpose of processing	Processed personal data	Legal basis
Adding reviews of services	1. first name and (optionally) last name; 2. email address; 3. IP number.	Article 6(1)(a) GDPR (the processing of personal data is based on consent given)

Providing the above personal data is voluntary but necessary to add a review (the consequence of not providing them will be the inability to add a review). The Administrator will process the above personal data until the consent given is withdrawn (review is deleted).

 

Profiling

In order to create your profile for marketing purposes and to direct direct marketing to you (e.g., ads on the Facebook social network) tailored to your preferences, the Administrator will process your personal data in an automated manner, including profiling them – however, this will not have any legal effects on you nor will it significantly affect your situation.

The scope of the profiled personal data corresponds to the scope indicated above regarding the analysis of your activity on the Website.

The legal basis for the processing of personal data for the above purpose is Article 6(1)(f) GDPR, under which the Administrator may process personal data to pursue its legitimate interests, in this case, conducting marketing activities tailored to the preferences of recipients. Providing the above personal data is voluntary but necessary to achieve the above purpose (the consequence of not providing them will be the inability of the Administrator to conduct marketing activities tailored to the preferences of recipients).

The Administrator will process personal data for profiling purposes until an effective objection is raised or the processing purpose is achieved.

Also, remember that you can disable the Facebook Pixel in the cookie pop-up window.

Recipients of personal data

The recipients of personal data will be the following external entities cooperating with the Administrator:

domain provider;

online payment service provider;

data hosting service provider;

internet service provider used by the Administrator to deliver digital goods

companies providing tools for analyzing activity on the Website and directing direct marketing to users (including Google Analytics);

company providing accounting services.

Additionally, personal data may also be disclosed to public or private entities if such obligation arises from generally applicable laws or a valid decision.

Transfer of personal data to third countries

Due to the Administrator's use of tools such as Google Analytics or Facebook Pixel, your personal data may be transferred to the following third countries: the United Kingdom, Canada, the USA, Chile, Brazil, Israel, Saudi Arabia, Qatar, India, China, South Korea, Japan, Singapore, Taiwan (Republic of China), Indonesia, and Australia. The basis for the transfer of data to the above third countries is:

in the case of the United Kingdom, Canada, Israel, and Japan – decisions of the European Commission confirming an adequate level of protection of personal data in each of the aforementioned third countries;

in the case of the USA, Chile, Brazil, Saudi Arabia, Qatar, India, China, South Korea, Singapore, Taiwan (Republic of China), Indonesia, and Australia – contractual clauses ensuring an adequate level of protection, in accordance with the standard contractual clauses specified in the Commission's implementing decision (EU) 2021/914 of June 4, 2021, regarding standard contractual clauses for the transfer of personal data to third countries under the Regulation of the European Parliament and Council (EU) 2016/679.

You can obtain from the Administrator a copy of the data transferred to a third country.

Rights

In relation to the processing of personal data, you have the following rights:

the right to information about which personal data concerning you are being processed by the Administrator and to receive a copy of that data (the so-called right of access). The first copy of the data is free; for subsequent copies, the Administrator may charge a fee;

if the processed data becomes outdated or incomplete (or otherwise incorrect), you have the right to request its rectification;

in certain situations, you may request the Administrator to delete your personal data, for example when:

the data is no longer necessary for the purposes for which the Administrator informed you;

you have effectively withdrawn your consent to the processing of data – provided that the Administrator has no right to process the data on another legal basis;

the processing is unlawful;

the need to delete the data arises from a legal obligation imposed on the Administrator;

if personal data is processed by the Administrator based on the consent granted for processing or for the purpose of fulfilling a contract with him, you have the right to transfer your data to another administrator;

if personal data is processed by the Administrator based on your granted consent for processing, you have the right to withdraw that consent at any time (the withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal);

if you believe that the processed personal data is incorrect, the processing is unlawful, or the Administrator no longer needs certain data, you can request that for a specified, necessary period (e.g., to verify the accuracy of the data or to pursue claims) the Administrator does not perform any operations on the data, but only stores it;

you have the right to object to the processing of personal data based on the legitimate interest of the Administrator. In the event of a successful objection, the Administrator will cease processing personal data for the aforementioned purpose; you have the right to lodge a complaint with the President of the Personal Data Protection Office if you believe that the processing of personal data violates the provisions of GDPR.

Cookies

The Administrator informs that the website uses "cookies", which are installed on your end device. These are small text files that can be read by the Administrator's system as well as by systems belonging to other entities whose services the Administrator uses (e.g., Facebook, Google).

The Administrator uses cookies for the following purposes:

ensuring the proper functioning of the website – thanks to cookies, it is possible for the website to operate efficiently, to use the available functions, and to navigate comfortably between individual subpages;

ensuring security – cookies are used for authenticating users and preventing unauthorized access to customer accounts. They thus serve to protect users' personal data from unauthorized access;

increasing the comfort of browsing the website – thanks to cookies, it is possible to detect errors on some subpages and to continuously improve them;

maintaining session state after logging into the account – thanks to cookies, it is not necessary to provide authentication data on every subpage viewed, which enhances the comfort of using the website;

creating statistics – cookies are used to analyze how users use the website (e.g., how many users visit it, how long they stay on it, which content generates the most interest). This enables continuous improvement of the website and adaptation of its operation to user preferences.

"Conducting marketing activities – thanks to cookies, the Administrator can direct advertisements to users tailored to their preferences."

"The Administrator can store both permanent and temporary cookies on your device. Temporary cookies are usually deleted when the browser is closed, whereas closing the browser does not delete permanent cookies."

"Information about the cookies used by the Administrator is displayed in the panel located at the bottom of the website. Depending on your decision, you can enable or disable cookies of specific categories (except for essential cookies) and change these settings at any time."

"Data collected through cookies do not allow the Administrator to identify you."

"The Administrator uses the following tools that utilize cookies:"

"Essential cookies of the website – these cookies enable the proper and secure functioning of the website (they are used, among other things, to adjust the layout of the website to the device's screen), therefore their disabling is not possible (the operation of these cookies is a condition for using the website). Essential cookies remain on your end device for up to 1 year;"

"Google Analytics – this tool (using cookies provided by Google LLC) allows for the collection of statistical data on how users use the website, including the number of visits, duration of visits, search engine used, and location. The collected data helps improve the website and make it more user-friendly. Cookies used by Google Analytics remain on your end device for up to 2 years;"

"Google Ads – this tool (using cookies provided by Google LLC) allows for the collection of data about your preferences (including visited subpages, viewed content) and enables targeting advertisements displayed to you on other websites you visit. Cookies used by Google Ads remain on your end device for up to 3 months;"

"Facebook Pixel – this tool (using cookies provided by Meta Platforms Ireland Limited) allows for determining that you visited the website, as well as directing advertisements displayed on social media platforms Facebook and Instagram to you and measuring their effectiveness. Cookies used by Facebook Pixel remain on your end device for up to 3 months."

"Through most commonly used browsers, you can check whether cookies have been installed on your device, as well as delete installed cookies and block their installation in the future by the website or other sites. However, disabling or limiting cookie support may cause significant difficulties in using the website, such as the need to log in on each subpage, longer loading times, and restrictions in using functionalities."

"Final provisions"""""

"In matters not regulated by this Policy, the generally applicable provisions on the protection of personal data apply."

"The policy is in effect from March 4, 2024."