Privacy policy

Privacy Policy of the Flyport Educational and Entertainment Zone by Baltona

We are the Administrator of Your Personal Data
Ensuring the security of your data is not only our obligation but also a matter of trust we aim to build mutually. That’s why we’ve created this document. It contains information about how we use your data, why we have the right to do so, and how long we keep it. Additionally, you will learn about your rights under GDPR.

The information is divided into two sections:

The first part explains your data – when and how we process it – presented in the form of dedicated information clauses.
The second part explains how cookies work, which monitor your online activity related to using our website.

Customers and Visitors to Flyport
The administrator of Guests' personal data is PRZEDSIĘBIORSTWO HANDLU ZAGRANICZNEGO "BALTONA" S.A. located in Warsaw, at Komitetu Obrony Robotników 49, 02-146 Warsaw
Administrator's contact details: Komitetu Obrony Robotników 49, 02-146 Warsaw
Contact for the Data Protection Officer: rodo@baltona.pl

Purposes and Legal Bases for Processing:

Contract Performance: For example, reservation and ticket purchase via the website www.bilety.flyport.pl or call center, or actions taken before concluding a contract at your request, expressed in any way, e.g., by filling out a contact form on the website or during a call center contact (Art. 6(1)(b) GDPR if you are a customer; Art. 6(1)(f) GDPR if you are an individual acting on behalf of or for the customer).
Transaction Management: Related to ticket purchase via the website (Art. 6(1)(b) GDPR if you are a customer; Art. 6(1)(f) GDPR if you are an individual acting on behalf of or for the customer).
Legal Obligations: Compliance with legal requirements, especially tax and accounting regulations, and consumer rights (Art. 6(1)(c) GDPR).
Legitimate Interests: To establish, pursue, or defend claims (Art. 6(1)(f) GDPR).
Consent-Based Purposes: For purposes specified in consent given for data processing, if such consent was provided (Art. 6(1)(a) GDPR). Note: Providing data beyond what is required by the Administrator or marked as optional is a clear action equivalent to consenting to the processing of personal data for the purposes provided.

Data Retention Period:
Personal data will be retained until the expiry of claim limitation periods arising from the contract, e.g., the expiry of limitation periods for claims under ticket sales (generally 2 years from the date the claim became enforceable).
Certain data will also be retained until the expiry of data retention obligations under specific regulations, particularly accounting documents.
If we process certain data based on the Administrator’s legitimate interests (Art. 6(1)(f) GDPR) and you raise a valid objection before the basic retention period ends, the data will be processed for a shorter time, i.e., until your objection is addressed.
If we process certain data based on your consent (Art. 6(1)(a) GDPR) and you withdraw your consent before the basic retention period ends, the data will be processed for a shorter time, i.e., until consent is withdrawn.

Data Scope:
Our customer (contracting party) may be an individual – a person purchasing a ticket, or an institution, e.g., a commercial company. In the latter case, we process personal data of individuals acting on behalf of the institution, e.g., the CEO, authorized representatives, or contact persons for contract performance.
The data we collect includes: name, surname, email address, phone number, VAT ID, address, vehicle registration number (if using parking).

Data Source:
We normally obtain data directly from you. Your personal data may also be obtained from another source, e.g., from our client – a company, if you are its employee or representative (e.g., for event space rental).

Data Provision Obligation:
Providing certain data is necessary for concluding and subsequently performing the contract. Remember, the contract may be concluded in various ways, e.g., by purchasing a ticket online or during a call center conversation.

What If You Do Not Provide Your Data:
If you do not provide the data required to conclude the contract, the contract cannot be concluded.

Data Recipients:
Recipients are external entities to whom we transfer your data. We share your data with:

Government authorities or other entities authorized by law if necessary for legal obligations,
Our service providers, including those mentioned below,
Service providers supporting online ticket sales, e.g., SoftCOM,
Providers of accounting, advisory, auditing, or legal services,
Document and media disposal or archiving companies,
Courier and postal service companies,
Banks and other financial and payment institutions, e.g., AutoPay.

Data Transfer:
No, we will not transfer your data outside the European Economic Area.

Automated Decisions:
Your data will not be subject to decisions based solely on automated processing, including profiling, that have legal effects or similarly significant impacts.

Your Rights:

Access to your personal data – within the limits of Art. 15 GDPR,
Rectification of your personal data – within the limits of Art. 16 GDPR,
Erasure of your personal data – within the limits of Art. 17 GDPR,
Restriction of processing of your personal data – within the limits of Art. 18 GDPR,
Data portability – within the limits of Art. 20 GDPR,
Withdrawal of consent at any time if consent was the basis for processing, without affecting the legality of processing before consent withdrawal,
The right to object at any time to the processing of your personal data – within the limits of Art. 21 GDPR – if the legal basis for processing is the legitimate interest of the Administrator or a third party (Art. 6(1)(f) GDPR) – when filing an objection, you should specify the reasons related to your particular situation, unless the objection concerns processing for direct marketing purposes – in which case no such reason is required.

Right to Lodge a Complaint:
If you believe we are processing your personal data unlawfully, you may file a complaint with the President of the Personal Data Protection Office. More information is available on the office's website.

Privacy Policy for Users of the "Contact" Tab on the Website

The Administrator of Your Personal Data
The administrator of Guests' personal data is PRZEDSIĘBIORSTWO HANDLU ZAGRANICZNEGO "BALTONA" S.A., located in Warsaw, at Komitetu Obrony Robotników 49, 02-146 Warsaw.
Administrator's contact details: Komitetu Obrony Robotników 49, 02-146 Warsaw
Contact for the Data Protection Officer: rodo@baltona.pl

Purposes and Legal Bases for Processing:

Contact with Potential Clients: To take actions before concluding a contract, at the client’s request, expressed by leaving data in the "Contact" tab on the website (Art. 6(1)(b) GDPR if you are a potential client; Art. 6(1)(f) GDPR if you are an individual acting on behalf of or for the client).
Responding to Inquiries: To answer questions submitted via the "Contact" tab (Art. 6(1)(f) GDPR).
Consent-Based Purposes: For purposes specified in consent given for data processing, if such consent was provided (Art. 6(1)(a) GDPR).

Data Retention Period:
Personal data will be retained until we present you with an offer, and then for 3 months from the presentation of the offer, if the offer was not accepted.
If our offer is accepted and a contract is established, your data will be processed for the duration dedicated to clients with an active contract.
If your inquiry did not concern our offer, your data will be retained for 3 months from the response provided.
If we process certain data based on the Administrator’s legitimate interests (Art. 6(1)(f) GDPR) and you raise a valid objection before the basic retention period ends, the data will be processed for a shorter time, i.e., until your objection is addressed.
If we process certain data based on your consent (Art. 6(1)(a) GDPR) and you withdraw your consent before the basic retention period ends, the data will be processed for a shorter time, i.e., until consent is withdrawn.

Data Scope:
Typically, the data includes: name, surname, email address, and phone number.

Data Source:
We normally obtain data directly from you.

Data Provision Obligation:
Providing certain data is not a statutory requirement or a condition for concluding a contract.

What If You Do Not Provide Your Data:
If you do not provide the data, we will not be able to present our offer to you or respond to other questions you may have.

Data Recipients:
Recipients are external entities to whom we transfer your data:

Entities that provide us with IT tools for storing your data or entities that have access to your data as part of IT system maintenance.

Data Transfer:
No, we will not transfer your data outside the European Economic Area.

Automated Decisions:
Your data will not be subject to decisions based solely on automated processing, including profiling, that have legal effects or similarly significant impacts.

Your Rights:

Access to your personal data – within the limits of Art. 15 GDPR,
Rectification of your personal data – within the limits of Art. 16 GDPR,
Erasure of your personal data – within the limits of Art. 17 GDPR,
Restriction of processing of your personal data – within the limits of Art. 18 GDPR,
Data portability – within the limits of Art. 20 GDPR,
Withdrawal of consent at any time if consent was the basis for processing, without affecting the legality of processing before consent withdrawal,
The right to object at any time to the processing of your personal data – within the limits of Art. 21 GDPR – if the legal basis for processing is the legitimate interest of the Administrator or a third party (Art. 6(1)(f) GDPR) – when filing an objection, you should specify the reasons related to your particular situation, unless the objection concerns processing for direct marketing purposes – in which case no such reason is required.

Video Surveillance (Persons on Recordings)

Data Controller
The data controller for Guests is PRZEDSIĘBIORSTWO HANDLU ZAGRANICZNEGO "BALTONA" S.A., with its registered office in Warsaw, ul. Komitetu Obrony Robotników 49, 02-146 Warsaw.
Data Controller's Contact Information: ul. Komitetu Obrony Robotników 49, 02-146 Warsaw
Contact for Data Protection Officer: rodo@baltona.pl

Purpose and Legal Basis for Processing:

Ensuring the safety of individuals (including children) and property within the Flyport educational and entertainment zone by recording the image of persons (including children) present in this area (Article 6(1)(f) GDPR).
Implementing the data controller’s legitimate interest to establish, pursue, or defend against claims (Article 6(1)(f) GDPR).

Data Retention Period:

The standard retention period for surveillance data is 30 days from the date of recording. However, due to the overwriting of data caused by limited storage capacity, data may be deleted earlier. If processing may be related to claims, data will be processed until the statute of limitations for such claims expires.
If we process certain data based on the legitimate interest of the data controller (Article 6(1)(f) GDPR) and you submit a valid objection to processing before the end of the standard retention period, the data will be processed for a shorter period, i.e., until your objection is considered.

Scope of Data: Your image.
Source of Data: You are the source of the data; we do not obtain your image from other entities.
Obligation to Provide Data: Providing data is not a contractual or statutory requirement.
Consequences of Not Providing Data: There are no consequences related to the above. However, it is technically impossible to enter the Flyport educational and entertainment zone without being recorded by surveillance cameras.

Data Recipients:

Public authorities or other entities authorized under the law if necessary to fulfill legal obligations,
Companies providing services and/or delivering monitoring and security,
Companies providing legal assistance.

Data Transfer: We will not transfer your data outside the European Economic Area.

Your Rights:

Access to your personal data – within the limits of Article 15 GDPR,
Correction of your personal data – within the limits of Article 16 GDPR,
Erasure of your personal data – within the limits of Article 17 GDPR,
Restriction of the processing of your personal data – within the limits of Article 18 GDPR,
Data portability – within the limits of Article 20 GDPR,
Withdrawal of consent at any time if it was the basis for processing, although this does not affect the legality of processing carried out before the withdrawal of consent,
The right to object at any time to the processing of your personal data – within the limits of Article 21 GDPR – if the legal basis for processing is the legitimate interest of the data controller or a third party (Article 6(1)(f) GDPR) – when filing an objection, you should specify the reasons related to your particular situation, unless the objection concerns processing for direct marketing purposes – in which case there is no requirement to specify such reasons.

Right to Lodge a Complaint:
If you believe that we process your personal data unlawfully, you can file a complaint with the President of the Office for Personal Data Protection. More information on this can be found on the Office's website.

Contacts with Customer Service, Including Complaints

Purpose and Legal Basis for Processing:

Handling complaints (Article 6(1)(c) GDPR in conjunction with Article 7a of the Consumer Rights Act).
Implementing the data controller’s legitimate interest to prepare a response to questions unrelated to complaints and send it (Article 6(1)(f) GDPR).
Implementing the data controller’s legitimate interest to establish, pursue, or defend against claims (Article 6(1)(f) GDPR).

Data Retention Period:

Data processed in connection with handling complaints will be stored until the expiration of legal storage obligations (e.g., related to payment of funds); in other cases, for 2 years from the end of the complaint procedure, understood as the provision of a response to the complaint.
Data processed for preparing a response to questions unrelated to complaints and sending it will be processed for 2 years from the response.
Recorded telephone conversations with customer service/call center are stored for 2 years from the recording.
If any claims arise within the 2-year period related to the subject of the matter you contacted customer service about, the data will be processed until the claims are satisfied or the statute of limitations for claims expires.
If we process certain data based on the legitimate interest of the data controller (Article 6(1)(f) GDPR) and you submit a valid objection to processing before the end of the standard retention period, the data will be processed for a shorter period, i.e., until your objection is considered.

Scope of Data: Typically, this includes basic contact details: name, email address, phone number, and information related to the complaint or non-complaint query.
Source of Data: We generally collect data directly from you.
Obligation to Provide Data: Providing data is not a statutory requirement or a condition for concluding a contract.
Consequences of Not Providing Data: If you do not provide data, we will not be able to process your complaint or respond to a question unrelated to a complaint.

Data Recipients:

Public authorities or other entities authorized under the law if necessary to fulfill legal obligations,
Providers of external IT systems supporting and providing IT solutions,
Entities providing accounting, advisory, auditing, or legal services,
Document and media disposal or archiving companies,
Courier and postal service providers,
Banks and other financial and payment institutions, for example, in the case of processing refunds.

Data Transfer: We will not transfer your data outside the European Economic Area.

Automated Decisions: Your data will not be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significant impacts.

Your Rights:

Access to your personal data – within the limits of Article 15 GDPR,
Correction of your personal data – within the limits of Article 16 GDPR,
Erasure of your personal data – within the limits of Article 17 GDPR,
Restriction of the processing of your personal data – within the limits of Article 18 GDPR,
Data portability – within the limits of Article 20 GDPR,
Withdrawal of consent at any time if it was the basis for processing, although this does not affect the legality of processing carried out before the withdrawal of consent,
The right to object at any time to the processing of your personal data – within the limits of Article 21 GDPR – if the legal basis for processing is the legitimate interest of the data controller or a third party (Article 6(1)(f) GDPR) – when filing an objection, you should specify the reasons related to your particular situation, unless the objection concerns processing for direct marketing purposes – in which case there is no requirement to specify such reasons.

Contractors and Their Representatives

Purpose and Legal Basis for Processing:

Execution of a contract with a contractor or taking steps prior to entering into a contract, at the contractor's request, expressed in any manner, such as by completing a contact form on the website (Article 6(1)(b) GDPR – if you are a contractor; Article 6(1)(f) GDPR – if you are a natural person acting on behalf of or representing a contractor).
Compliance with legal obligations, particularly tax and accounting obligations (Article 6(1)(c) GDPR).
Implementation of the data controller’s legitimate interest to establish, pursue, or defend against claims (Article 6(1)(f) GDPR).

Data Retention Period:

Personal data will be retained until the expiration of the statute of limitations for claims arising from the contract with the contractor (generally 3 years from the date the claim became enforceable).
Specific data will also be retained until the expiration of data retention obligations arising from specific regulations, particularly the retention of accounting documents.
If we process certain data based on the legitimate interest of the data controller (Article 6(1)(f) GDPR) and you submit a valid objection to processing before the end of the standard retention period, the data will be processed for a shorter period, i.e., until your objection is considered.

Scope of Data:
Our contractor (contracting party) may be a natural person conducting business or an institution, e.g., a commercial company. In the latter case, we process personal data of individuals acting on behalf of the institution, such as the president, authorized representatives, or contact persons regarding the execution of the contract.
Before entering into a contract with a contractor, we collect data necessary to start negotiating the terms of cooperation. Typically, these are basic contact details: name, email address, phone number. For contractors who are natural persons, additional data necessary for the conclusion of the contract, such as PESEL (Polish identification number), is also collected.
During the term of the contract with the contractor, we may

process further data, such as information about invoices issued by the contractor or the overall history of cooperation.

Source of Data:

Typically, we collect data directly from you.
Your personal data may also be obtained from other sources, such as our contractor – a company if you are its employee or representative. Sometimes, we obtain personal data from publicly available sources, such as the contractor's website.

Obligation to Provide Data:

Providing certain data is necessary for concluding and performing the contract.
If you do not provide the data required for concluding or performing the contract, the contract cannot be concluded or properly executed.

Data Recipients:

Public authorities or other entities authorized under the law if necessary to fulfill legal obligations,
External providers of IT systems, providing support and delivering IT solutions,
Entities auditing our operations or experts,
Providers of accounting, legal advisory, or debt collection services,
Companies specializing in document and media disposal or archiving,
Courier and postal service providers,
Banks and other financial and payment institutions,
Companies within the data controller’s capital group.

Data Transfer:

We will not transfer your data outside the European Economic Area.

Automated Decisions:

Your data will not be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significant impacts.

Your Rights:

Access to your personal data – within the limits of Article 15 GDPR,
Correction of your personal data – within the limits of Article 16 GDPR,
Erasure of your personal data – within the limits of Article 17 GDPR,
Restriction of the processing of your personal data – within the limits of Article 18 GDPR,
Data portability – within the limits of Article 20 GDPR,
Withdrawal of consent at any time if it was the basis for processing, although this does not affect the legality of processing carried out before the withdrawal of consent,
The right to object at any time to the processing of your personal data – within the limits of Article 21 GDPR – if the legal basis for processing is the legitimate interest of the data controller or a third party (Article 6(1)(f) GDPR) – when filing an objection, you should specify the reasons related to your particular situation, unless the objection concerns processing for direct marketing purposes – in which case there is no requirement to specify such reasons.

Recipients of Marketing Communications

Data Controller
The data controller for Guests is PRZEDSIĘBIORSTWO HANDLU ZAGRANICZNEGO "BALTONA" S.A., with its registered office at ul. Komitetu Obrony Robotników 49, 02-146 Warsaw.
Data Controller's Contact Information: ul. Komitetu Obrony Robotników 49, 02-146 Warsaw
Contact for Data Protection Officer: rodo@baltona.pl

Purpose and Legal Basis for Processing:

To pursue the legitimate interest of the data controller in marketing their own products and services (Article 6(1)(f) GDPR) using the following communication methods:
- Email messages, including newsletters.
  Note: Some forms of communication require separate consent, specifically email messages (Article 10 of the Act on Providing Electronic Services).
To comply with legal obligations, particularly the Act on Providing Electronic Services (Article 6(1)(c) GDPR).
To pursue the legitimate interest of the data controller in establishing, pursuing, or defending against claims related to the sending of marketing communications, if such claims arise (Article 6(1)(f) GDPR).
For the purposes specified in any consents given for data processing, if such consents were provided (Article 6(1)(a) GDPR).

Data Retention Period:

If you raise specific claims related to our marketing communications, data will be retained until the expiration of the limitation periods for such claims.
Certain data will also be retained until the expiration of data retention obligations under specific regulations, particularly the Act on Providing Electronic Services.
If we process specific data based on the legitimate interest of the data controller (Article 6(1)(f) GDPR) and you file a valid objection before the end of the standard retention period, the data will be processed for a shorter period, i.e., until your objection is considered (unless the objection relates to processing for direct marketing purposes – in which case, no justification for the objection is required).
If we process specific data based on your consent (Article 6(1)(a) GDPR) and you withdraw consent before the end of the standard retention period, the data will be processed for a shorter period, i.e., until the consent is withdrawn.

Scope of Data:

Typically, the data required for sending marketing communications includes only necessary details such as name and email address.

Source of Data:

Typically, we obtain data directly from you.

Obligation to Provide Data:

Providing data is not a contractual or statutory requirement.

Consequences of Not Providing Data:

There are no consequences as it is not a contractual or statutory requirement.

Recipients of Data:

External entities to whom we may disclose your data include:
- Providers of external IT systems who provide support and deliver IT solutions,
- Entities that send marketing communications on our behalf,
- Courier and postal service providers,
- Companies that dispose of or archive documents and other media.

Data Transfer:

We will not transfer your data outside the European Economic Area.

Automated Decisions:

Your data will not be subject to decisions based solely on automated processing, including profiling, that have legal effects or similar significant impacts.
We do not make automated decisions based on the data processed during the sending of marketing communications.

Your Rights:

Access to your personal data – within the limits of Article 15 GDPR,
Correction of your personal data – within the limits of Article 16 GDPR,
Erasure of your personal data – within the limits of Article 17 GDPR,
Restriction of the processing of your personal data – within the limits of Article 18 GDPR,
Data portability – within the limits of Article 20 GDPR,
Withdrawal of consent at any time if it was the basis for processing, although this does not affect the legality of processing carried out before the withdrawal of consent,
The right to object at any time to the processing of your personal data – within the limits of Article 21 GDPR – if the legal basis for processing is the legitimate interest of the data controller or a third party (Article 6(1)(f) GDPR) – when filing an objection, you should specify the reasons related to your particular situation, unless the objection concerns processing for direct marketing purposes – in which case, no justification for the objection is required.

Individuals Featured in Promotional Materials

Purpose and Legal Basis for Processing:

To promote the data controller (Article 6(1)(f) GDPR).
This includes the dissemination of images (to an unlimited number of people) within the scope of consent granted for image dissemination, as per Article 81 of the Act of February 4, 1994, on Copyright and Related Rights or through an agreement involving payment for posing.
To fulfill the terms of any agreement between the person depicted in the promotional material and the data controller, if such an agreement has been made (Article 6(1)(b) GDPR).
To comply with the data controller's obligations arising from specific regulations, particularly tax and accounting requirements, in the case of financial settlements between the data controller and the person featured in the promotional material (Article 6(1)(c) GDPR).
For the promotion of the data controller involving the dissemination of images of children. This is based on consent (Article 6(1)(a) GDPR), with consent being provided by the child's parent or legal guardian.
Consent is also required under Article 81 of the Act of February 4, 1994, on Copyright and Related Rights.
To pursue the legitimate interest of the data controller in establishing, pursuing, or defending against claims related to the inclusion of personal data in promotional materials, if such claims arise (Article 6(1)(f) GDPR).
For the purposes specified in any consents provided for data processing, if such consents were given (Article 6(1)(a) GDPR).

Data Retention Period:

Personal data will be retained until the end of the publication of the promotional material.
If an agreement (e.g., for posing) was made with the person featured in the promotional material, data will also be processed until the expiration of the limitation period for claims arising from the agreement (typically 2 years from when the claim becomes enforceable).
Data will be retained until the expiration of limitation periods for claims related to your visibility in the data controller's promotional material (typically 2 years from when the claim becomes enforceable).
Personal data in the form of a child's image will be retained and disseminated until the consent for such processing is withdrawn by the parent/legal guardian or by the child upon reaching adulthood.
If we process data based on the legitimate interest of the data controller (Article 6(1)(f) GDPR) and you raise a valid objection before the end of the standard retention period, data will be processed for a shorter period, i.e., until your objection is considered.
If we process data based on your consent (Article 6(1)(a) GDPR) and you withdraw consent before the end of the standard retention period, data will be processed for a shorter period, i.e., until the consent is withdrawn.

Scope of Data:

Typically, this includes your image or the image of your child.

Source of Data:

Typically, data is obtained directly from you or your child.

Obligation to Provide Data:

Providing data is neither a contractual nor statutory requirement, except in cases where an agreement is made with individuals featured in promotional materials, e.g., for posing.

Consequences of Not Providing Data:

There are no consequences except for situations where data is necessary to conclude an agreement – in which case, the agreement cannot be concluded and, for example, payment for posing cannot be made.

Recipients of Data:

External entities to whom we may disclose your data (or your child's image) include:
- Entities providing us with IT tools for data storage or those accessing your data during IT system maintenance,
- Entities supporting us in producing promotional materials, such as photographers or graphic designers handling professional editing of promotional materials,
- Legal service providers if needed, e.g., in connection with reported claims.

Data Transfer:

We will not transfer your data (or your child's image) outside the European Economic Area.

Automated Decisions:

Your data (or your child's image) will not be subject to decisions based solely on automated processing, including profiling, that have legal effects or similarly significant impacts.
Automated decisions are not made based on data processed in promotional materials.

Your Rights:

Access to your personal data – within the limits of Article 15 GDPR,
Correction of your personal data – within the limits of Article 16 GDPR,
Erasure of your personal data – within the limits of Article 17 GDPR,
Restriction of the processing of your personal data – within the limits of Article 18 GDPR,
Data portability – within the limits of Article 20 GDPR,
Withdrawal of consent at any time if it was the basis for processing, although this does not affect the legality of processing carried out before the withdrawal of consent,
The right to object at any time to the processing of your personal data – within the limits of Article 21 GDPR – if the legal basis for processing is the legitimate interest of the data controller or a third party (Article 6(1)(f) GDPR) – when filing an objection, you should specify the reasons related to your particular situation, unless the objection concerns processing for direct marketing purposes – in which case, no justification for the objection is required.

Users of the Website

Purpose and Legal Basis for Processing:

To ensure the functionality of the website and facilitate its use (Article 6(1)(f) GDPR).
To conduct analysis and statistics regarding users' use of the data controller’s website (Article 6(1)(f) GDPR).
For purposes specified in any consents provided for data processing, if such consents were given (Article 6(1)(a) GDPR).
To comply with legal obligations, particularly under the Telecommunications Law and the Act on Providing Electronic Services (Article 6(1)(c) GDPR).

Data Retention Period:

Data will be retained until the expiration of legal obligations related to data retention under specific regulations, particularly the Telecommunications Law and the Act on Providing Electronic Services.
If data is processed based on the legitimate interest of the data controller (Article 6(1)(f) GDPR) and you raise a valid objection to processing, data will be processed for this purpose only until your objection is addressed.
If data is processed based on your consent (Article 6(1)(a) GDPR) and you withdraw consent, data will be processed for this purpose only until consent is withdrawn.

Scope of Data:

Typically includes data such as IP address and information from cookies, such as details about your device, browser, and interactions with our website. Detailed information on these data types can be found in the cookie policy section.

Source of Data:

Data is usually obtained directly from you as a user of our website.

Obligation to Provide Data:

Providing data is neither a contractual nor statutory requirement.

Consequences of Not Providing Data:

There are no consequences as long as data provision is not required for specific purposes.

Recipients of Data:

External entities to whom we may disclose your data include:
- State authorities or other authorized entities if necessary to fulfill legal obligations,
- Entities providing us with IT tools for data processing.

Data Transfer:

We will not transfer your data outside the European Economic Area.

Automated Decisions:

Your data will not be subject to decisions based solely on automated processing, including profiling, which has legal effects or similarly significant impacts.

Your Rights:

Access to your personal data – within the limits of Article 15 GDPR,
Correction of your personal data – within the limits of Article 16 GDPR,
Erasure of your personal data – within the limits of Article 17 GDPR,
Restriction of the processing of your personal data – within the limits of Article 18 GDPR,
Data portability – within the limits of Article 20 GDPR,
Withdrawal of consent at any time if it was the basis for processing, although this does not affect the legality of processing carried out before the withdrawal of consent,
The right to object at any time to the processing of your personal data – within the limits of Article 21 GDPR – if the legal basis for processing is the legitimate interest of the data controller or a third party (Article 6(1)(f) GDPR). When filing an objection, you should specify the reasons related to your particular situation, unless the objection concerns processing for direct marketing purposes – in which case, no justification is required.

Protection of Minors. Intervention Related to Suspected Child Abuse or When the Child is the Perpetrator

Purpose and Legal Basis for Processing:

To conduct intervention in cases of suspected child abuse or when there is information about a child being harmed, including contacting the child’s parents or legal guardians (Article 6(1)(c) GDPR in conjunction with Article 22c of the Act on Counteracting Threats of Sexual Offenses and Protecting Minors and the Policy for Protecting Children from Abuse of PRZEDSIĘBIORSTWO HANDLU ZAGRANICZNEGO "BALTONA" S.A.).
To conduct intervention when there is suspicion that a child is the perpetrator of abuse, including contacting the child’s parents or legal guardians (Article 6(1)(c) GDPR in conjunction with Article 22c of the Act on Counteracting Threats of Sexual Offenses and Protecting Minors and the Policy for Protecting Children from Abuse of PRZEDSIĘBIORSTWO HANDLU ZAGRANICZNEGO "BALTONA" S.A.).
To create documentation related to the intervention in cases of suspected child abuse or when there is information about a child being harmed or being a perpetrator, including preparing an Intervention Report (Article 6(1)(c) in conjunction with Article 22c of the Act on Counteracting Threats of Sexual Offenses and Protecting Minors and the Policy for Protecting Children from Abuse of PRZEDSIĘBIORSTWO HANDLU ZAGRANICZNEGO "BALTONA" S.A.).
To fulfill other legal obligations of the data controller (e.g., reporting suspicions or information about child abuse to the appropriate authorities) (Article 6(1)(c) GDPR).
To pursue the legitimate interest of the data controller in establishing, pursuing, or defending against claims (Article 6(1)(f) GDPR, and in case of special category data – also Article 9(2)(f) GDPR).

Data Retention Period:

Personal data related to the intervention will be retained until the end of the proceedings related to the report, including until it is transferred to authorized authorities.
If data is processed based on the legitimate interest of the data controller (Article 6(1)(f) GDPR) and you raise a valid objection to processing, data will be processed for this purpose only until your objection is addressed.

Scope of Data:

Includes the child’s name, the name of the person reporting the suspicion, the name of the child’s parent or legal guardian, and the contact number of the parent or legal guardian.

Source of Data:

Data is obtained from you or from someone who has reported that your health or life is in danger or that you are harming another person.

Obligation to Provide Data:

Providing data is voluntary but necessary for conducting the intervention or preparing documentation resulting from the intervention.

Consequences of Not Providing Data:

We will not be able to undertake the intervention or prepare the necessary documentation.

Recipients of Data:

External entities to whom we may disclose your data include:
- State authorities or other authorized entities if necessary to fulfill legal obligations,
- Entities providing us with IT tools for data processing.

Data Transfer:

We will not transfer your data outside the European Economic Area.

Cookies

What are cookies
Cookies are small text files that are saved on your computer or smartphone when you visit our website. There are different types of cookies.

Essential cookies ensure that our site remains stable. These cookies measure traffic and protect us from overloading the site. They remember your privacy choices or how you fill out our forms. Cookies also save the contents of your cart and monitor your login status. We use these cookies by default, meaning we save them on your computer or smartphone when you visit our website. [Art. 173(3) of the Telecommunications Law]

Types of cookies we use
Essential cookies ensure that our website and its core functions work properly. Without them, you cannot use our online services correctly. We do not need your consent to use these cookies. [Art. 173(3) of the Telecommunications Law]
Name: Location (language) choice
Purpose: To use your last choice upon revisiting the site
Storage period: 6 months

Changes to the Privacy Policy
If there are changes in the way we process your personal data, we will update this Privacy Policy and post the latest version on our website with advance notice proportional to the significance of the change.