Privacy Policy

Working English translation. The legally binding version is the Polish version available at /privacy-policy.

Personal data and Privacy Policy

§ 1. Personal data administrator

1.

The Administrator of the personal data of Users is the Operator indicated in the Terms of Service.

2.

Personal data is processed in accordance with applicable law, in particular:

  • Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR),
  • the Polish Act on Provision of Services by Electronic Means,
  • the Polish Consumer Rights Act.

§ 2. Scope and purposes of data processing

1.

Users' personal data may be processed for the purposes of:

  • performance of the Contract,
  • managing the User Account,
  • processing payments,
  • contact with the User,
  • issuing sales documents,
  • handling complaints,
  • fulfilling obligations under applicable law,
  • ensuring the proper operation of the Service.
2.

The scope of processed data is limited to data necessary to fulfil the purposes stated above.

3.

The Operator does not process special category data, in particular data concerning health, unless required by law.

§ 3. Data recipients

1.

Users' personal data may be transferred to entities cooperating with the Operator only to the extent necessary to provide services related to the operation of the Service and the sale of digital content, in particular:

  • WebToLearn – provider of the course platform and the digital content access system,
  • Paynow (mBank S.A.) – the electronic payment operator,
  • the website hosting provider,
  • the entity providing accounting and bookkeeping services,
  • providers of IT and technical services supporting the operation of the Service,
  • providers of analytics and marketing tools (e.g. Google, Meta) – only to the extent necessary for statistics, traffic analysis or promotional activities,
  • providers of mailing or newsletter systems – only if the user has subscribed to the newsletter.
2.

These entities process data on the basis of relevant data processing agreements or as separate data controllers in accordance with applicable law.

3.

Personal data is not sold to third parties.

§ 4. Rights of the User

1.

The User has the right to:

  • access to their data,
  • rectification of data,
  • erasure of data,
  • restriction of processing,
  • data portability,
  • objection to data processing,
  • lodging a complaint with the President of the Personal Data Protection Office.
2.

Detailed information on the processing of personal data is available in the Privacy Policy on the Service.

§ 5. Data security

1.

The Operator applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or unauthorised modification.

2.

The Operator exercises due diligence in securing personal data and limits access to data exclusively to authorised persons.

Personal data retention period

Personal data is stored for the period necessary to fulfil the purpose for which it was collected, and subsequently for the period required by law or until any claims become time-barred.

In particular:

  • User account on the platform — for the period of active access to digital content and for a maximum of 12 months after access expires.
  • Order-related data — for the period required by tax and accounting regulations (as a rule, 6 years).
  • Data related to complaints or contact — until the matter is concluded and any claims become time-barred.
  • Newsletter data — until consent is withdrawn.
  • Analytical data and cookies — in accordance with the lifespan of individual cookies or the user’s browser settings.

After the indicated periods, data is deleted or anonymised, unless its further storage is required by applicable law.

Access to the platform and account expiry

Access to digital content

Access to purchased digital content is granted for the period stated in the description of the product or offer available on the website.

After the access period expires, the user account may be deactivated or deleted along with associated data, except for data whose further storage is required by law, billing purposes, tax obligations or the legitimate interest of the Administrator.

The Administrator may also retain a limited scope of data necessary to defend against or pursue claims in accordance with applicable law.

Payments

Electronic payments are processed via the Paynow operator handled by mBank S.A.

The Administrator does not process the full payment card data of users directly. The data necessary to process payments is processed directly by the payment operator in accordance with its terms and privacy policy.

Transfer of data outside the European Economic Area

Some service providers used by the Administrator may process data outside the European Economic Area, in particular in the United States.

Data transfers take place in accordance with the mechanisms provided for by the GDPR, in particular on the basis of standard contractual clauses approved by the European Commission or other grounds legalising data transfers in accordance with applicable law.

Support and contact with the user

Support provided by the Administrator covers exclusively technical and organisational matters and those related to the operation of the platform, access to digital content, payments, complaints and order fulfilment.

The Administrator does not provide psychological, therapeutic, medical or diagnostic services as part of support or contact with the user.