§1. Personal Data Controller
The Controller of the personal data of the Exhibition’s Users is Fundacja Urbaniak.Com with its registered office in Warsaw, Poland (ul. Żelazna 67/75, 00-871 Warsaw), entered into the Register of Entrepreneurs of the National Court Register under KRS number 0000213808, NIP 7251891649, REGON 473299900 (hereinafter: “Controller” or “Foundation”).
§2. Contact in Matters of Personal Data Protection
In matters concerning the processing of personal data, you can contact the Controller via the email address: fundacja@urbaniak.com or in writing to the address indicated in §1.
§3. Scope and Purposes of Data Processing
1. In connection with the use of the Exhibition, the Controller processes basic technical data generated automatically in connection with visits to the Exhibition, in particular: IP address, information about the device and web browser type, date and time of the visit, and viewed subpages. This data is recorded at the hosting infrastructure level exclusively for the purposes indicated in sec. 2 below.
2. This data is processed for the purposes of:
a) ensuring the proper and secure functioning of the Exhibition,
b) establishing, pursuing, or defending against potential claims related to the functioning of the Exhibition.
3. The Exhibition currently does not use any separate tools for recording visit statistics (e.g., Google Analytics, Matomo) — the data indicated in sec. 1 is not used for statistical or analytical purposes. In the event of implementing such a tool in the future, this Policy will be updated accordingly prior to its launch.
4. The Controller does not use the data referred to in this section to accept orders, process payments, or fulfill purchases — these activities are performed exclusively by the Seller, through their own separate website, under the rules defined in their own privacy policy.
§4. Legal Bases for Processing
1. The data indicated in §3 is processed on the basis of:
a) Art. 6(1)(f) GDPR (the legitimate interest of the Controller) — with regard to ensuring the security and proper functioning of the Exhibition,
b) Art. 6(1)(a) GDPR (consent) — to the extent that processing would take place via cookies requiring the User’s consent in accordance with §5.
§5. Cookies and Similar Technologies
1. The Exhibition uses cookies and similar technologies:
a) necessary for the proper functioning of the Exhibition — not requiring the User’s consent,
b) other than necessary (e.g., statistical/analytical) — currently not utilized; if they are implemented in the future, their use will require the User’s prior, voluntary consent, expressed in accordance with Art. 402 of the Act of July 12, 2024 — Electronic Communications Law.
2. The Exhibition operates a cookie consent management mechanism (cookie banner), through which the User can express or withdraw consent for non-essential cookies at any time — also within the settings of their own web browser.
§6. Data Recipients
1. Users’ personal data may be transferred to the entity providing hosting services to the Controller — OVH Sp. z o.o. (OVHcloud) — to which the Controller has entrusted data processing based on a data processing agreement concluded in accordance with Art. 28 GDPR (OVH Data Protection Agreement).
2. Users’ personal data is not transferred to the Seller in connection with the use of the Exhibition. Data transferred in connection with the conclusion of a sales agreement in the Seller’s Store is subject to a separate privacy policy of that website, for which the Seller is solely responsible.
§7. Transfer of Data Outside the European Economic Area
1. In accordance with the data processing agreement concluded with the hosting service provider indicated in §6, personal data may be processed by entities from that provider’s group located outside the European Economic Area — depending on the data center location chosen by the Controller when ordering the hosting service. In such cases, the transfer takes place using standard contractual clauses approved by the European Commission’s Implementing Decision (EU) 2021/914, which constitute part of the concluded data processing agreement.
§8. Data Retention Period
The data referred to in §3 is stored for a period no longer than is necessary to achieve the purposes indicated in §3, no longer than the duration of the hosting services agreement concluded by the Controller, subject to periods resulting from legal provisions, including the limitation periods for claims. Upon termination of this agreement, the data is subject to deletion by the hosting service provider, in accordance with the concluded data processing agreement.
§9. Rights of Data Subjects
The User has the right to: access their data, rectify it, erase it, restrict its processing, data portability, and object to processing based on Art. 6(1)(f) GDPR, as well as the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).
§10. Changes to the Privacy Policy
The Foundation reserves the right to amend this Privacy Policy, in particular in connection with a change in legal provisions or a change in the scope of the Exhibition’s functionality. The current content of the Policy is always available at the Exhibition.