Privacy policy

This is an English translation of the Polish original, provided for information only and prepared with the help of AI. The Polish version is legally binding; in case of discrepancies, the Polish version prevails.

1. General information

This Privacy policy concerns the website available at adlegem.org (the “Website”) and contact with the Foundation through the email address given on the Website.

The controller of personal data is FUNDACJA OCHRONY PRAW AD LEGEM (Foundation for the Protection of the Rights – Ad Legem), with its registered office in Kraków, ul. Myśliwska 57/5E, 30-718 Kraków, KRS 0001268203, NIP 6793376535 (the “Foundation”).

The Foundation can be contacted in writing at its registered office address or electronically at kontakt@adlegem.org. The same address is used for matters relating to personal data protection.

The Website is informational. It does not offer contact forms, user accounts or newsletter sign-up. Personal data are processed in accordance with the GDPR and other applicable law.

2. Data provided in correspondence

When an email is sent, the Foundation processes the sender’s address, the content of the message and its attachments, and any other data provided by the sender, such as their name or telephone number, if given.

Providing data is voluntary. To reply, we need an address at which we can contact the sender and information that allows us to understand the enquiry. Without such information it may not be possible to reply or to clarify the matter.

Please provide only the information needed to present your enquiry. Before sending documents relating to an individual case, it is advisable to agree with the Foundation on what to send and how.

Personal data are processed for the following purposes:

  • handling correspondence and replying to enquiries — on the basis of Article 6(1)(f) GDPR; the Foundation’s legitimate interest is enabling contact and clarifying matters raised in connection with its activities;
  • handling requests concerning the rights of data subjects — on the basis of Article 6(1)(c) GDPR, in connection with the obligations under Articles 12–22 GDPR;
  • the establishment, exercise or defence of legal claims, where necessary — on the basis of Article 6(1)(f) GDPR; the Foundation’s legitimate interest is the protection of its rights.

The data of senders are not used to send unsolicited marketing information. Merely sending a message does not mean consent to marketing.

This policy covers ordinary correspondence and use of the Website. If contact leads to individual support requiring a different scope of data processing, the Foundation provides the relevant information before such processing begins.

Displaying a page requires the processing of the technical data necessary to handle the connection, in particular the IP address. Depending on the hosting configuration, data may be recorded in server logs and may also include the time of the request, the address of the page displayed, information about the browser and connection errors.

To the extent that technical data constitute personal data, the legal basis for processing them is Article 6(1)(f) GDPR. The Foundation’s legitimate interest is ensuring the proper operation and security of the Website, diagnosing failures and detecting abuse.

The Foundation keeps aggregate statistics of visits to the Website using Plausible Analytics, provided by Plausible Insights OÜ, based in Estonia, which processes data on servers in the European Union. The statistics cover, among other things, the pages visited, the source of the visit, approximate location and the type of browser and device. They do not make it possible to identify who visited the Website — the IP address is used only at the moment of the visit and is not stored. The legal basis for processing is the Foundation’s legitimate interest (Article 6(1)(f) GDPR): understanding which content is read in order to develop the Website.

5. Recipients of data

Data may be accessed by authorised persons acting on behalf of the Foundation and by providers of hosting, email and technical support, to the extent necessary to provide those services. Where a provider processes data on the Foundation’s behalf, it does so under an appropriate data processing agreement.

Data may be disclosed to competent authorities where required by applicable law. The Foundation does not sell data or disclose them to other entities for their own marketing purposes.

6. Transfers of data outside the EEA

The Foundation does not transfer data outside the EEA.

7. Data retention period

Data contained in ordinary correspondence are kept for as long as needed to handle the enquiry and, after the matter has been closed, for no longer than 12 months from the last message, where further retention is needed to continue the contact or to explain its course.

Data related to handling requests concerning rights under the GDPR are kept for as long as needed to handle the request and then for 12 months from the end of its handling, in order to document its course.

Where longer retention is required by a specific legal obligation or needed for the establishment, exercise or defence of legal claims, only the necessary data are kept, for the period required by law or until the proceedings have ended and the relevant limitation period has expired.

Technical logs, where recorded, are kept in accordance with the privacy policy of the hosting provider. Where particular entries are needed to investigate a detected incident, they are kept until the investigation has been completed and, in the case of claims, on the terms set out above.

8. Rights of data subjects

Under the conditions set out in the GDPR, you have the right:

  • of access to your data and to obtain a copy of them;
  • to rectification of your data;
  • to request erasure of your data;
  • to request restriction of processing of your data;
  • to object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation.

Requests can be sent to the Foundation’s email address or by post to its registered office. The extent to which individual rights can be exercised depends on the conditions laid down in the law.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO). Information on lodging complaints is available at https://uodo.gov.pl.

9. Cookies

The Website does not use cookies. Using it does not require consent to the use of cookies.

10. Profiling and automated decisions

Data are not used for profiling or for automated decision-making concerning people who use the Website or contact the Foundation.

11. Data security

The Foundation applies appropriate technical and organisational measures to protect data against unauthorised access, loss, destruction or unauthorised alteration. Access to data is limited to the persons who need it to carry out their tasks.

12. Updates to the Policy

The Policy is updated when there is a change in the way data are processed, in the functions of the Website or in the applicable law. The current version is available on the Website.