PRIVACY POLICY AND INFORMATION ON THE PROCESSING OF PERSONAL DATA

                                                                                        Kostovgymnastics Akademia Gimnastyki

​

​

​

1. Data Controller

​

The Data Controller is:

​

Kostovgymnastics Akademia Gimnastyki

Akademia Gimnastyki / Kostadin Kostow
Ul. Zimowa 23/23, 05-500 Nowa Iwiczna
NIP: 526-251-15-14

E-mail: info@kostovgymnastics.com
Telephone: 602384110

​

Academy website:

​

https://kostovgymnastics.com

​

The Data Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR"), the Polish Act on the Protection of Personal Data, and other applicable legal provisions.

​

2. Scope of the Privacy Policy

​

This Privacy Policy sets out the rules for processing the personal data of persons who:

• use the Academy's website;

• contact the Academy;

• register themselves or their child for classes;

• use the booking system;

• participate in classes;

• are parents or legal guardians of participants;

• use other services provided by the Academy.

• ​

3. What Personal Data May We Process?

​

Depending on the type of contact or service, we may process:

Parent or legal guardian data:

• first and last name;

• telephone number;

• e-mail address;

• data required for billing and payments;

• information concerning registrations and bookings.

Participant data:

• first and last name;

• age or date of birth – where necessary for the organisation of classes;

• information concerning the group or type of class;

• information provided by a parent/legal guardian in connection with the participant's safety.

Technical data:

• IP address;

• device information;

• browser information;

• information concerning the use of the website;

• data stored through cookies.

The participant's image may be processed where appropriate consent has been given for its use.

​

4. Purposes of Processing Personal Data

​

Personal data may be processed for the following purposes:

1. handling enquiries submitted through the contact form;

2. contacting a parent/legal guardian;

3. making and managing bookings;

4. organising classes;

5. maintaining participant lists;

6. processing payments and settlements;

7. fulfilling tax and accounting obligations;

8. performing a contract or taking steps prior to entering into a contract;

9. ensuring the safety of participants;

10. establishing, pursuing or defending against claims;

11. ensuring the security of the website;

12. managing user accounts, where such accounts are used;

13. carrying out promotional activities where there is an appropriate legal basis;

14. publishing images – exclusively to the extent covered by separate consent.

15. ​

5. Legal Bases for Processing

​

Personal data may be processed on the following legal bases:

• Article 6(1)(b) GDPR – where processing is necessary for the performance of a contract or for taking steps at the request of the data subject prior to entering into a contract;

• Article 6(1)(c) GDPR – where processing is necessary for compliance with a legal obligation;

• Article 6(1)(f) GDPR – where processing is necessary for the purposes of the legitimate interests pursued by the Data Controller;

• Article 6(1)(a) GDPR – where the data subject has given voluntary consent for a specific purpose.

The Data Controller does not use consent as the legal basis where processing may lawfully be based on another legal basis.

​

6. Children's Data

​

Kostovgymnastics Akademia Gimnastyki provides classes for children and young people.

A child's personal data may be processed in particular for the purposes of:

• registering the child for classes;

• organising classes;

• contacting a parent/legal guardian;

• maintaining participant records;

• ensuring safety during classes;

• performing the contract.

The Data Controller applies the principle of data minimisation and should not collect data that is not necessary for a specific purpose.

If a parent or legal guardian provides the Academy with additional information concerning the child, the Data Controller processes such information only to the extent and on the legal basis appropriate for the particular type of data.

​

7. Health Information

​

If, in connection with the organisation of classes, a parent/legal guardian provides information concerning the child's health, limitations or contraindications, such information may constitute special categories of personal data within the meaning of the GDPR.

Such information should not be provided through an ordinary contact form unless the Data Controller has ensured an appropriate legal basis and adequate protective measures.

The Academy collects only information necessary to ensure the participant's safety and the proper organisation of classes.

​

8. Recipients of Personal Data

​

Personal data may be transferred to entities that support the Data Controller in conducting its activities, to the extent necessary to achieve a specific purpose.

These may include, in particular:

• hosting and website service providers;

• Wix.com – to the extent necessary for the use of the platform and its functions;

• e-mail service providers;

• booking system providers, where used;

• payment service providers, where used;

• accounting offices;

• IT service providers;

• entities providing legal services;

• public authorities authorised under applicable law.

Where the Data Controller uses data processors to process data on its behalf, it takes the measures required by the GDPR, including entering into appropriate data processing agreements or ensuring another appropriate legal basis.

​

9. Transfer of Data Outside the European Economic Area

​

In connection with the use of internet service providers, personal data may be processed outside the European Economic Area.

Where such a transfer takes place, the Data Controller shall ensure that appropriate mechanisms provided for under the GDPR are applied.

​

10. Data Retention Period

​

Personal data is stored for no longer than is necessary to fulfil the purpose for which it was collected.

In particular:

• data related to the performance of a contract – for the duration of the contract and for the period necessary to fulfil legal obligations or protect against claims;

• accounting and tax data – for the period required by applicable law;

• data submitted through the contact form – for the period necessary to handle the matter and, where applicable, protect against claims;

• data processed on the basis of consent – until the consent is withdrawn, unless another legal basis exists for further processing;

• cookie data – in accordance with the applicable retention period for the particular type of cookie.

 

11. Rights of the Data Subject

​

The data subject has, to the extent provided for by the GDPR, the right to:

• access their personal data;

• obtain a copy of their personal data;

• rectify their personal data;

• erase their personal data;

• restrict processing;

• data portability;

• object to processing;

• withdraw consent where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

​

12. Exercising Data Subject Rights

​

To exercise your rights, please contact the Data Controller:

info@kostovgymnastics.com

or in writing:

Kostovgymnastics Akademia Gimnastyki
Ul. Zimowa 23/23
05-500 Nowa Iwiczna
Poland

The Data Controller shall respond to requests in accordance with the time limits specified in the GDPR.

​

13. Right to Lodge a Complaint

​

The data subject has the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) if they believe that the processing of their personal data infringes data protection regulations.

​

14. Contact Forms and Registrations

​

Data provided through forms is processed for the purpose of handling the submission, responding to an enquiry, making a booking or providing the service.

The Data Controller does not require the provision of data that is not necessary to process the particular enquiry or request.

​

15. Image and Likeness

​

A participant's image may be used in the Academy's promotional materials on the basis of separate consent, where such consent is required.

Consent to the publication of an image:

• is voluntary;

• is independent of registration for classes;

• is not a condition of participation;

• specifies the purpose for which the image may be used;

• may specify particular places or media of publication;

• may be withdrawn.

In the case of children, the Data Controller pays particular attention to protecting their privacy and safety.

The Polish Personal Data Protection Office (UODO) highlights the specific risks associated with publishing children's images online and the need to properly define the conditions for the use of such images.

​

16. Automated Decision-Making

​

The Data Controller does not make decisions concerning customers that produce legal effects or similarly significant effects solely as a result of automated processing of personal data.

​

17. Security

​

The Data Controller applies appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, destruction, alteration or disclosure.

​

18. Changes to the Privacy Policy

​

This Privacy Policy may be updated in the event of changes to applicable law, the operation of the website, the scope of services or the tools used.

The current version is published on:

​

kostovgymnastics.com

​

19. Contact

​

Kostovgymnastics Akademia Gimnastyki
Akademia Gimnastyki / Kostadin Kostow
Ul. Zimowa 23/23
05-500 Nowa Iwiczna
NIP: 526-251-15-14
E-mail: info@kostovgymnastics.com
Telephone: 602384110