Privacy notice
The data controller is Fundacja Insolitum, KRS 0001091091, NIP 7182168920, ul. Leśna 2, 18-400 Giełczyn, Polska. For privacy matters, contact kontakt@insolitum.pl.
Contact and donations
We process information in correspondence and bank transfer records, including sender details, amount, date and reference. Our legal bases under the GDPR are legitimate interest in responding to enquiries (Article 6(1)(f)), processing your donation (Article 6(1)(b)), and accounting and tax obligations (Article 6(1)(c)). We may retain information to establish, pursue or defend legal claims (Article 6(1)(f)).
Service providers
Necessary information may be shared with our bank, accountants, email and hosting providers, technical support and authorised public bodies. This website is hosted by Tsunami under insolitum.pl. When you choose an external payment page, that provider also processes data under its own privacy notice. The foundation website does not collect card numbers or BLIK codes.
Retention
Correspondence is kept for the time needed to address your enquiry and any related legal claims. Donation and accounting records are retained for periods required by accounting and tax law, generally five years calculated according to the rules applicable to each record, or longer where required by law or proceedings.
Your rights
Subject to the GDPR, you may request access, correction, erasure, restriction or portability and object to processing based on legitimate interest. You may complain to the Polish Data Protection Authority (UODO). Providing contact details is voluntary but may be necessary for us to respond. We do not make solely automated decisions about donors or use advertising profiling.
Technical privacy
The application has no advertising analytics, tracking pixels or embedded Facebook widgets. Language follows your browser preferences; manual selection is recorded in the page URL. Hosting providers may process IP addresses and technical information for operation and security. The administrator panel uses an essential session cookie which expires within 8 hours or upon sign-out. Reading bank details on the public website does not require an account.
International services and links
Infrastructure providers may process data outside the EEA using the safeguards required by Chapter V of the GDPR, as appropriate to each service, including adequacy decisions or standard contractual clauses. Contact kontakt@insolitum.pl for information about applicable safeguards. Facebook, the school website and external payment pages have their own privacy notices.