Privacy policy

The controller of your personal data is STRAMA Sport i Turystyka Sp. z o.o., ul. Balzera 19A, 34-500 Zakopane, Poland, tax no. (NIP) 7361737323, business no. (REGON) 389743998.

School office: ul. Balzera 28, 34-500 Zakopane.
Phone: 18 201 16 46, 18 201 14 41.
E-mail: szkolastrama@nosal.pl.

In any matter concerning personal data you can write to the e-mail address above or come to the school office. [TO BE CONFIRMED: whether the company has appointed a data protection officer and what their contact address is - the old policy mentioned a DPO but gave no address.]

We collect only the data we need in order to organise your training and get in touch with you.

BOOKING AND RUNNING THE TRAINING - first name and surname, e-mail address, phone number, participant details (name, age, level) and anything you tell the instructor yourself that affects how the lesson is run. Legal basis: Article 6(1)(b) GDPR - processing is necessary to perform a contract. If you pass on information about the participant's health (conditions, limitations), we process it only with your consent - Article 9(2)(a) GDPR - and only to keep the lesson safe.

PAYMENT - the data needed to settle the order. The transaction itself goes through the payment provider; we do not store card numbers.

CONTACT - your name and e-mail address or phone number, when you write to us through the form, by e-mail or call us. Legal basis: Article 6(1)(f) GDPR - our legitimate interest, namely answering you.

ACCOUNTS AND ACCOUNTING DOCUMENTS - the details on the invoice. Legal basis: Article 6(1)(c) GDPR - an obligation arising from tax law.

COMPLAINTS, REFUNDS AND ANY CLAIMS - data from the order and the correspondence. Legal basis: Article 6(1)(f) GDPR - defending against claims and pursuing our own.

PHOTOGRAPHS FROM LESSONS - during training we take individual and group photographs, which may appear on our website and social media profiles. If you would rather they did not, simply tell the school office or the instructor before the lesson.

Giving us your data is voluntary, but without it we cannot book your training or answer your message - we would have nowhere to reply. You give information about health only if you want to; we pass it on to the instructor so that they can adapt the lesson.

We do not sell data and we do not make it available to anyone for their own marketing purposes.

Your data goes only to those parties without whom the service cannot be delivered:

- the operator of the shop and booking system in which you place your order (sklep.strama-szkola.pl);
- the payment provider - it handles the transaction and is itself the controller of the payment data;
- the hosting and e-mail provider, on whose servers this site and our mailbox run;
- the accounting office - for accounting documents;
- the insurer - only for trips abroad, where insurance is compulsory (SIGNAL IDUNA Bezpieczne Podroze);
- hotels and carriers - only for trips abroad, to the extent needed for accommodation and transport;
- state authorities - where the law requires us to hand data over.

[TO BE CONFIRMED: the name and address of the hosting company and the name of the payment provider used by the shop - both should be named here.]

A few elements of this site come from other companies' servers. Every time such an element loads, that company sees your IP address and basic browser data. We list them all, because that is the only way for you to know who your browser introduces itself to:

- GOOGLE FONTS - the site loads typefaces from the servers of Google Ireland Limited. Google receives your IP address in the process.

- YOUTUBE VIDEOS - we embed them in privacy-enhanced mode (youtube-nocookie.com). In this mode YouTube saves no cookies until you click play.

- THE GOOGLE MAPS MAP on the Contact page - it loads from Google's servers and passes them your IP address.

- THE CONTACT FORM - data from the form goes to our mailbox and nowhere else.

- WEBCAMS AND LINKS TO PARTNER SITES (including Ski Training Centre Nosal and Stramusland) - once you click, you leave our site and the privacy policy of that site applies. We are not responsible for the content or the rules of the sites we link to.

Some of these companies are based outside the European Economic Area or transfer data to the United States. This happens on the terms those companies set out - among others on the basis of standard contractual clauses and the European Commission's adequacy decision (the Data Privacy Framework).

Cookies are small text files saved by your browser. Our site uses them sparingly, and we name them here:

- strama_cart_token - remembers your basket so that it does not start from scratch when you come back. It is saved only once you add something to the basket. It lives as long as the basket in the shop, at most 7 days. It is marked HttpOnly, which means no script on the page can reach it.

- WordPress technical cookies - saved only for people who log in to the site's back end. They do not affect an ordinary visitor.

We use no advertising or profiling cookies and we do not build profiles of visitors' behaviour.

You can delete or block cookies at any time in your browser settings. Blocking them will not shut you out of the site - the only thing that will stop working is remembering the basket.

[TO BE CONFIRMED: whether Google Analytics, the Meta Pixel or any other statistics or advertising tool runs on the site. If so, it has to be named here and a cookie consent banner has to be added; there is no such tool in the theme code.]

- Data from bookings and from running the training - for the term of the contract, and afterwards until claims become time-barred.
- Accounting documents - 5 years, counted from the end of the tax year they relate to (a requirement of tax law).
- E-mail correspondence and form submissions - for as long as it takes to deal with the matter and a short period afterwards.
- Data processed on the basis of consent - until that consent is withdrawn.

[TO BE CONFIRMED: the exact periods - the above are the limits set by law, but the policy should state the specific figures adopted by the company.]

At any time you may:

- request access to your data and a copy of it;
- have your data corrected if it is inaccurate or incomplete;
- request erasure of your data if we have no grounds to keep it any longer;
- request that processing be restricted;
- transfer your data to another controller;
- object to processing based on our legitimate interest;
- withdraw your consent - without affecting what we lawfully did before you withdrew it.

To exercise any of these rights, write to szkolastrama@nosal.pl or come to the school office.

If you believe we are processing your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warszawa, Poland.

The site runs over an encrypted HTTPS connection. Only those members of school staff who need it for their work have access to booking data. We never ask - by e-mail or by phone - for your password or your full payment card number.

We update this policy whenever the way the site works or the scope of the data we process changes. The current version is always available at this address. The date of the last update is given at the bottom of the page.

[TO BE CONFIRMED: the date this version comes into force.]