General provisions
This website privacy policy is an informational document. It primarily outlines the principles regarding the processing of personal data by the Administrator, including the legal grounds, purposes and scope of data processing, as well as the rights of individuals whose data is processed. It also contains information about the use of cookies and analytical tools on the website.
The Administrator of personal data collected through the Website is
Park Edukacyjny „Interakcje” Sp. z o.o., ul. Stefana Okrzei 2, 43-300 Bielsko-Biała, Poland, NIP (tax identification number): 7010345193, REGON: 146163128, KRS: 0000423869, referred to as the “Administrator” and acting as the Service Provider of the Website.
Personal data on the website is processed by the Administrator in accordance with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation - GDPR). The official text of the GDPR: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679
Using the website and providing data is voluntary. The Administrator ensures the protection of the personal data it processes by applying particular care to the rights and interests of the individuals whose data is collected. Specifically, the Administrator is responsible for ensuring that the data it collects is (1) processed in accordance with the law; (2) collected for specific, lawful purposes and not processed further in ways inconsistent with those purposes; (3) accurate and adequate for the purposes it is being processed for; (4) stored in a form that permits identification of the data subject for no longer than necessary to achieve the purpose of processing; and (5) processed securely, including protection against unauthorised or unlawful processing and accidental loss, destruction or damage, using appropriate technical or organisational measures.
Taking into account the nature, scope, context and purposes of processing as well as the risks to individuals’ rights and freedoms, the Administrator implements appropriate technical and organisational measures to ensure that processing is carried out in accordance with the GDPR and that it can demonstrate this compliance. These measures are reviewed and updated as necessary. The Administrator uses technical measures to prevent unauthorised persons from gaining access to and modifying personal data transmitted electronically.
Legal bases for data processing
The Administrator is authorised to process personal data in cases where at least one of the following conditions is met: (1) the data subject has given consent to the processing of their personal data for one or more specific purposes; (2) the processing is necessary for the performance of a contract to which the data subject is a party or for taking steps at the data subject’s request prior to entering into a contract; (3) the processing is necessary for compliance with a legal obligation to which the Administrator is subject; or (4) the processing is necessary for the purposes of the legitimate interests pursued by the Administrator or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
The processing of personal data by the Administrator requires the existence of at least one of the bases listed in section 2 of this privacy policy. The specific bases for the processing of Users’ and Clients’ personal data by the Administrator are indicated in the next section of this privacy policy in relation to each purpose of processing.
Purpose, basis, duration and scope of data processing
The purpose, basis, duration, scope and recipients of personal data processed by the Administrator depend on the activities performed by the User. The Administrator may process personal data for the following purposes, on the following legal grounds, for the specified periods and within the indicated scope:
Users
Downloading the product catalogue or product documentation - purpose: sending the product catalogue or a product documentation package to the e-mail address provided and making them available for download; basis: consent (Article 6(1)(a) GDPR), which may be withdrawn at any time by writing to biuro@npz.edu.pl; scope: e-mail address, date of the request, address of the page from which the form was sent, source of the visit (e.g. advertising campaign parameters, landing page); period: 24 months from the request, after which the data is deleted automatically, unless consent is withdrawn earlier. The address is not used for a newsletter. It is used for marketing contact only if a separate, voluntary consent is ticked (see below).
Marketing contact after downloading the catalogue or documentation - applies only to people who ticked the separate, voluntary consent to be contacted for marketing purposes in the form; purpose: sending information about the Administrator’s offer and contact from an advisor at the e-mail address provided; basis: consent (Article 6(1)(a) GDPR) and consent to contact by e-mail for direct marketing purposes (Article 398 of the Polish Electronic Communications Law), which may be withdrawn at any time by writing to biuro@npz.edu.pl, without affecting access to the catalogue and documentation; not giving this consent does not limit the download; scope: e-mail address, date and wording of the consent given; period: until consent is withdrawn, and the form entry on the website is deleted automatically 24 months after the request.
Enquiry and service request forms - purpose: answering the enquiry, preparing a quotation or handling a service request; basis: consent (Article 6(1)(a) GDPR), which may be withdrawn at any time by writing to biuro@npz.edu.pl; scope: data provided in the form (name and surname, e-mail address, phone number, name of the institution or company, content of the message, attached photos), date of the request, address of the page from which the form was sent, source of the visit (e.g. advertising campaign parameters, landing page); recipients: the Administrator’s export department with a copy to the office, or the service department; period: 24 months from the request, after which the data is deleted automatically, unless consent is withdrawn earlier. Photos attached to service requests are sent to the service department by e-mail and are not stored on the website server.
For the proper functioning of the website, the Administrator uses the services of external entities (such as software providers). The Administrator only uses processors that provide sufficient guarantees of implementing appropriate technical and organisational measures so that processing meets the requirements of the GDPR and protects the rights of data subjects.
The transfer of data by the Administrator does not occur in every case and not to all recipients or categories of recipients indicated in this privacy policy. The Administrator shares data only when necessary to achieve a specific purpose of processing, and only to the extent necessary to achieve it.
Personal data of Users may be shared with the following recipients or categories of recipients:
- service providers supplying the Administrator with technical, IT and organisational solutions that enable the Administrator to conduct its business, including the website and the electronic services provided through it (in particular providers of website software, e-mail and hosting services, and software for business management and technical support) - the Administrator shares the Client’s personal data with the selected provider acting on its behalf only when and to the extent necessary to achieve the purpose of processing in line with this privacy policy.
Rights of data subjects
Right of access, rectification, restriction, erasure or portability - the data subject has the right to request access to their personal data, its rectification, erasure (“the right to be forgotten”) or restriction of processing, the right to object to processing and the right to data portability. Detailed conditions for exercising these rights are set out in Articles 15-21 GDPR.
Right to withdraw consent at any time - if the data is processed on the basis of consent (Article 6(1)(a) or Article 9(2)(a) GDPR), the data subject has the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
Right to lodge a complaint with a supervisory authority - the data subject has the right to lodge a complaint with a supervisory authority in the manner set out in the GDPR and Polish law, in particular the Personal Data Protection Act. In Poland, the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).
Right to object - the data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data, including profiling. In that case the Administrator may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
Right to object to direct marketing - if personal data is processed for direct marketing purposes, the data subject has the right to object at any time to such processing, including profiling to the extent that it is related to direct marketing.
To exercise the rights described in this section, you can contact the Administrator by sending a written or electronic message to the Administrator’s address indicated at the beginning of this privacy policy or by using the contact form available on the Website.
Cookies policy
Cookies are small text files sent by a server and stored on the device of the person visiting the website (e.g. on the hard drive of a computer or laptop, or on the memory card of a smartphone, depending on the device used). Detailed information on cookies, including their history, can be found here: https://en.wikipedia.org/wiki/HTTP_cookie.
The Administrator may process data stored in cookies during visitors’ use of the website for the following purposes:
- remembering data entered in forms;
- customising the website’s content to the User’s individual preferences (e.g. colours, font size, page layout) and optimising the use of the website;
- keeping anonymous statistics showing how the website is used - only after consent to statistical cookies;
- remarketing, i.e. studying the behaviour of website visitors through anonymous analysis of their actions (e.g. repeated visits to specific pages, keywords) in order to create their profile and show them advertisements matching their expected interests, also when they visit other websites in the advertising network of Google Ireland Limited and Meta Platforms Ireland Limited - only after consent to marketing cookies;
Most web browsers accept cookies by default. Everyone can set the conditions for using cookies in their own browser settings. This means, for example, that cookies can be partially limited (e.g. temporarily) or disabled completely - in the latter case, however, some website functions may be affected.
Statistical and marketing cookies are stored only after consent is given in the banner shown on the first visit to the website. Consent can be changed or withdrawn at any time via the “Cookie settings” link in the website footer. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.
Detailed information on changing cookie settings and deleting cookies in the most popular web browsers is available in the browser’s help section and on the following pages (just click the link):
https://www.google.com/chrome/privacy/
https://www.mozilla.org/en-US/privacy/firefox/
https://privacy.microsoft.com/en-us/ie11-win7-privacy-statement
https://www.opera.com/privacy
https://www.apple.com/legal/privacy/en-ww/
https://support.microsoft.com/en-ie/help/4468242/microsoft-edge-browsing-data-and-privacy-microsoft-privacy
The Administrator may use Google Analytics, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). These services help the Administrator analyse traffic on the Website. The data collected is processed anonymously (so-called usage data that does not allow individuals to be identified) to generate statistics useful for managing the Website. This data is aggregated and anonymous, i.e. it contains no features identifying (no personal data of) the people visiting the website. Using these services, the Administrator collects data such as the sources and media through which visitors reach the website and how they behave on it, information about the devices and browsers they use, IP address and domain, geographical data, demographic data (age, gender) and interests.
You can also block Google Analytics from collecting information about your activity on the Website by installing the browser add-on provided by Google Ireland Ltd., available here: https://tools.google.com/dlpage/gaoptout?hl=en.
With consent to marketing cookies, the Administrator uses Google Ads, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), and the Meta pixel, provided by Meta Platforms Ireland Limited. They are used to measure the effectiveness of the Administrator’s advertising, e.g. whether an enquiry was sent or a catalogue ordered after clicking an ad, and to show ads to people who have visited the website.
The website uses Google Consent Mode. Without consent, Google tools do not store cookies on the visitor’s device, and Google receives only technical information about the page view and the consent status, without cookie identifiers.
Cookies stored by the website:
- npz_zgoda - remembers the choice made in the consent banner; valid for 12 months; always stored, necessary for the banner to work;
- _ga, _ga_RG6W1JGYXS, _ga_8JYV0PD4G4 - Google Analytics, visit statistics; valid for up to 400 days; only after consent to statistical cookies;
- _gcl_au - Google Ads, measuring advertising effectiveness; valid for 90 days; only after consent to marketing cookies;
- _fbp - Meta, measuring advertising effectiveness and ads for people who have visited the website; valid for 90 days; only after consent to marketing cookies;
- npz_kampania (browser session storage) - remembers the source of the visit for the form; until the browser tab is closed; only after consent to marketing cookies.
Language versions
This privacy policy is a translation of the Polish version. In the event of any discrepancy, the Polish version shall prevail.
