Privacy Policy

Working draft. Passages in square brackets [ ] await the company’s details and require legal review before publication. This English version is a courtesy translation; the Polish text prevails.

1. Data controller

The controller of your personal data is [full company name], with its registered office at [street and number], [postcode] [town], NIP [XXX-XXX-XX-XX], REGON [XXXXXXXXX].

For matters concerning personal data: [e-mail address], tel. [phone number].

2. What data we collect and why

Sign-up form. We collect your full name, phone number, the student’s age group and preferred lesson format, in order to contact you and present a course offer. Legal basis: Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and Article 6(1)(a) GDPR (your consent).

Contact form. We collect your full name, e-mail address, optionally a phone number, and your message, in order to answer your enquiry. Legal basis: Article 6(1)(a) and (f) GDPR (our legitimate interest in conducting correspondence).

Website chat. If you write to us in the chat box, we keep the name you give, the conversation, any files you attach (pictures or documents), the address of the page you write from and the time of each message, in order to answer your question. Conversations and files are kept until the School deletes them. Your browser remembers the conversation’s number in its local storage (no cookies), so that you see our answer when you come back. Legal basis: Article 6(1)(b) and (f) GDPR.

Contract and accounting. If you become our student, we process the data required to conclude and perform the contract and to issue accounting documents. Legal basis: Article 6(1)(b) and Article 6(1)(c) GDPR (tax and accounting obligations).

Providing your data is voluntary, but without it we cannot contact you or deliver the service.

3. How long we keep your data

Form submissions are kept for [period — e.g. 12 months] from our last contact, unless you withdraw your consent earlier. Contract and accounting data are kept for the period required by tax law (currently 5 years from the end of the tax year).

4. Recipients of the data

Your data may be entrusted to organisations that provide services to us:

• website hosting (server infrastructure),
• e-mail provider — [provider name],
• accounting office — [accounting office name],
• competent public authorities, where required by law.

We do not sell or share your data with third parties for marketing purposes.

5. Cookies and analytics

This site uses no analytics or tracking cookies whatsoever. There is no Google Analytics, no Meta/Facebook pixel, no third-party advertising script, and no cookie-consent banner, because there is nothing to consent to.

The site stores exactly one functional value in your browser: your choice of light or dark mode (via localStorage, key bw-theme). It never leaves your device and cannot identify you. You may delete it at any time by clearing the site’s data in your browser.

WordPress sets its own session cookies only for people logging into the school’s administration panel. This does not apply to ordinary visitors.

The Google Map embedded on the Contact page loads from Google’s servers only once you scroll to it; at that point Google may record your IP address on the terms set out in Google’s own privacy policy.

6. Your rights

In connection with the processing of your data you have the right to:

• access your data and receive a copy of it,
• have your data rectified,
• have your data erased (the “right to be forgotten”),
• restrict processing,
• object to processing,
• data portability,
• withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal,
• lodge a complaint with the supervisory authority: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

To exercise any of these rights, write to us at [e-mail address].

7. Transfers outside the European Economic Area

The hosting infrastructure may be located outside the EEA. Where that is the case, the transfer takes place on the basis of standard contractual clauses approved by the European Commission. [To be confirmed with the hosting provider.]

8. Automated decision-making

We do not make automated decisions about you and we do not carry out profiling.

9. Changes to this policy

We may update this policy, for example when the law or the scope of our services changes. The current version is always available at this address. Last updated: [date].