Privacy Policy

I. ABOUT US

Fun school sp. z o.o., with its registered office at 34-511 Kościelisko, Sywarne 34c/2, Poland

Tax Identification Number (NIP): 7361733408, National Court Register (KRS): 0000843060

Personal data is collected and processed in accordance with the terms and principles set out in this Privacy Policy.

II. GENERAL PROVISIONS

At Podstolice Ski School, we attach particular importance to protecting the privacy of our customers, business partners, employees, and associates. One of the key aspects of this commitment is protecting the rights and freedoms of individuals in connection with the processing of their personal data.

We ensure that your personal data is processed in accordance with the General Data Protection Regulation (EU) 2016/679 (hereinafter referred to as the "GDPR"), the Polish Personal Data Protection Act, and other applicable legislation, including employment and accounting regulations.

Podstolice Ski School is a data controller within the meaning of Article 4(7) of the GDPR. We also use the services of data processors referred to in Article 4(8) of the GDPR, who process personal data on behalf of the controller (such as accounting firms, IT service providers, and security companies).

Podstolice Ski School implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk of infringement of individuals' rights and freedoms, taking into account the likelihood and severity of potential threats. Our personal data protection activities are based on established policies and procedures, as well as regular training to improve the knowledge and skills of our employees and associates.

III. HOW WE USE YOUR PERSONAL DATA

As an employer, we process the personal data of our employees and individuals who cooperate with us under arrangements other than employment contracts. Contact details obtained from business partners (including their employees) are used to conclude and efficiently perform contracts. We use our customers' personal data to fulfill contracts and provide our services. We also conduct marketing activities to reach as many interested individuals as possible and provide them with up-to-date information about our products and services.

We share your personal data with third parties only with your consent or when required to do so by law.

IV. PRINCIPLES AND LEGAL BASES FOR PROCESSING YOUR DATA

We take particular care to protect the interests of individuals whose personal data we process. In particular, we ensure that personal data is:

• processed lawfully, fairly, and transparently;
• collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes;
• adequate, relevant, and limited to what is necessary for the purposes for which it is processed;
• accurate and, where necessary, kept up to date. We take appropriate measures to ensure that inaccurate personal data is erased or corrected without delay;
• stored in a form that permits identification of individuals for no longer than is necessary for the purposes for which the data is processed;
• processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and accidental loss or destruction.

We generally process your personal data on the basis of consent, which may be withdrawn at any time. Processing may also be necessary for the performance of a contract to which you are a party or to take steps at your request before entering into a contract.

In certain situations, processing is necessary to comply with a legal obligation imposed on us as the data controller. Such obligations may arise, for example, from employment or accounting regulations.

Processing may also be necessary for the purposes of our legitimate interests, such as establishing, exercising, or defending legal claims arising from our business activities.

V. YOUR RIGHTS

We take appropriate measures to provide you with all relevant information and communicate with you regarding the processing of your personal data in a concise, transparent, understandable, and easily accessible manner. You have the right to:

• receive information when your personal data is collected;
• obtain information upon request about whether your personal data is being processed, as well as other information specified in Article 15 of the GDPR, including the right to obtain a copy of your data;
• request the correction of inaccurate personal data;
• request the erasure of your personal data (the right to be forgotten);
• request restriction of processing;
• data portability;
• object to processing;
• not be subject to decisions based solely on automated processing, including profiling;
• receive information about personal data breaches.

Furthermore, if your personal data is processed on the basis of consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

To exercise any of these rights, please contact us by email at podstolice@funschool.pl.

The security of your personal data is our priority. However, if you believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).

VI. HOW WE WILL COMMUNICATE WITH YOU

We provide information in writing or by other means, including electronically where appropriate. At your request, we may provide information orally, provided that your identity has been verified by other means. If you submit your request electronically, we will, where possible, respond electronically unless you indicate a different preferred method of communication.

VII. HOW LONG WILL IT TAKE TO RESPOND TO YOUR REQUEST?

We aim to provide information without undue delay, generally within one month of receiving your request.

Where necessary, this period may be extended by a further two months due to the complexity of the request. In any case, within one month of receiving your request, we will inform you of the actions taken and, where applicable, of any extension, including the reasons for the delay.

VIII. SUBCONTRACTORS / DATA PROCESSORS

When we cooperate with entities that process personal data on our behalf, we use only those data processors that provide sufficient guarantees of implementing appropriate technical and organizational measures to ensure that processing complies with the GDPR and protects the rights of individuals.

We carefully assess the entities to which we entrust the processing of your personal data. We conclude detailed agreements with them and periodically verify that their processing activities comply with those agreements and applicable legal requirements.

Recipients of your personal data may include:

• entities and authorities authorized to process personal data under applicable law, as well as banks where necessary for financial settlements;
• institutions providing funding for the performance of contracts concluded with the Data Controller;
• entities cooperating with us on marketing campaigns;
• the accounting firm Informe sp. z o.o., Mirosław Szulc;
• Przelewy24, a provider of online and card payment processing services;
• Facebook, the social media platform, in accordance with its applicable data protection policies;
• Regionalne Centrum Ubezpieczeń Zakopane, an insurance company;
• Team Solution – Agencja Interaktywna, an IT services company.

IX. HOW WE PROTECT YOUR PERSONAL DATA

To comply with legal requirements, we have developed detailed procedures covering, among other things:

• data protection by design and by default;
• data protection impact assessments;
• personal data breach notifications;
• maintaining records of processing activities;
• data retention;
• exercising the rights of data subjects.

We regularly review and update our documentation to demonstrate compliance with legal requirements in accordance with the GDPR accountability principle. We also strive to incorporate industry best practices to protect the interests of individuals whose personal data we process.

X. DATA RETENTION

We store personal data in a form that permits the identification of individuals for no longer than is necessary for the purposes for which the data is processed. Once this period has expired, we anonymize the data (remove information that could identify an individual) or delete it. Our data retention procedures ensure that personal data is stored for the shortest period necessary.

We determine data retention periods primarily on the basis of applicable legal requirements (such as those governing the retention of employment records and accounting documents), as well as the legitimate interests of the Data Controller (such as marketing activities). Our data retention policy applies to personal data processed in both paper and electronic formats.

XI. AUTHORIZATIONS

We ensure that every person acting under our authority who has access to personal data processes it only on our instructions, unless otherwise required by European Union or Member State law.

XII. COOKIES

Cookies are small files stored on your computer that contain settings and other information used by the websites you visit. Cookies may store website preferences or be used to track users' interactions with websites.

We use cookies for purposes including adapting the content of our websites to your preferences, optimizing website functionality, maintaining your session after logging in so that you do not have to re-enter your username and password on every page, and supporting and enforcing security measures.