1. Joint controllers
The joint controllers of your personal data are:
Karolina Kasprzyk, tax ID (NIP) 5651508386, address: ul. Jana Kowalczyka 9 lok. 20, 03-193 Warszawa, Poland;
Agnieszka Drabarek, tax ID (NIP) 5272962069, address: ul. Jana Ostroroga 29 lok. 65, 01-163 Warszawa, Poland;
The shared point of contact is biuro@muzykamarzen.pl. You may also exercise your rights against each of the controllers separately.
2. Essence of the joint controllership arrangement
The controllers jointly determine the purposes and means of handling enquiries. They have agreed on a shared point of contact, on how requests from data subjects are answered, on data security, on the selection of processors, on breach handling and on applying the retention periods. Regardless of that division, both remain responsible for the lawfulness of the processing.
3. What data we process
your name, e-mail address, phone number, the optional date of your event and the content of your message;
data provided during any further contact by e-mail or telephone;
limited technical data required to run and protect the website;
anonymous or aggregated Umami statistics.
We never send the content of the form, your e-mail address, your phone number or any other identifier to Umami.
4. Purposes and legal bases
replying, preparing a quote and taking steps prior to a contract — Article 6(1)(b) GDPR;
website security, abuse prevention and defence of claims — Article 6(1)(f) GDPR;
legal obligations once a contract is concluded — Article 6(1)(c) GDPR;
anonymous measurement of how the site performs, via Umami — Article 6(1)(f) GDPR.
The form is not used for a newsletter or for direct marketing. The website accepts no payments and takes no online bookings.
5. Providing your data is voluntary
Providing the required data is voluntary, but it is necessary for us to reply. The date of the event is optional.
6. Recipients of the data
Your data may be received by the parties required to run the website and handle your enquiry:
the hosting/VPS, database, mailbox and e-mail delivery providers;
the people maintaining the website, acting under an authorisation or a data processing agreement;
accounting or legal advisers, where necessary;
public authorities, where required by law.
7. Retention periods
enquiries that do not lead to a contract: up to 12 months from the last contact;
data related to a contract: for as long as tax, accounting and limitation periods require;
server and reverse proxy logs: 30 days at most;
Umami statistics: 13 months at most.
8. Your rights
You may request access to your data, its rectification, erasure, restriction of processing and portability, and you may object to processing based on a legitimate interest.
Send your request to biuro@muzykamarzen.pl. You may also lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).
9. Automated decisions and transfers
We do not profile the data submitted through the form and we take no decisions based solely on automated processing. The data is processed on the infrastructure of the providers listed in section 6, and any transfer outside the European Economic Area takes place solely on the basis of the mechanisms set out in Chapter V of the GDPR. Social media services and YouTube operate under their own terms once you open a link or start a recording.
10. Umami and Do Not Track
Umami measures anonymous page views and the contact_success event, which contains no form data. The script honours Do Not Track. The analytics run without a separate banner; the interpretive risk under Article 399 of the Polish Electronic Communications Law has been accepted and the decision will be reassessed if the way we measure traffic changes.
11. Changes to this document
We update this document whenever the form, the purposes, the recipients or the analytics change. It was prepared without a formal review by a lawyer and does not constitute legal advice.
Legal basis: the GDPR.