Privacy policy

The controller of the personal data collected through the website of the ABC Wspinania climbing school is Krzysztof Wróbel, trading as IQ SERVICE Krzysztof Wróbel, ul. Jurajska 47, 42-421 Rzędkowice, Poland, tax ID (NIP) 631-17-26-535, REGON 273538759.

For anything about your personal data, write to [email protected]. We reply within one month at the latest.

We collect only what a given matter needs:

• Contact form — your name, email address, phone number (if you give it) and your message. To answer your question. Legal basis: your consent (Art. 6(1)(a) GDPR) and replying to an enquiry before a possible contract (Art. 6(1)(b) GDPR).
• Course booking — first name, surname, email address, phone number and your notes. To run the course: confirm your place, send information about it, settle the payment. Legal basis: the contract for taking part in the course (Art. 6(1)(b) GDPR) and, for settlements, tax obligations (Art. 6(1)(c) GDPR).
• Participant account — first name, surname, email address, phone number, the language of our emails and your password (stored as a cryptographic hash it cannot be recovered from — nobody knows it, the school included). To keep your account and show your bookings. Legal basis: the contract for keeping the account (Art. 6(1)(b) GDPR).
• Newsletter — your email address and language. To send news about course dates, camps and new articles. Legal basis: your consent (Art. 6(1)(a) GDPR). Signing up has to be confirmed with a link in an email, so nobody can sign up someone else's address.
• Messages to people booked on a course — if you have a booking, we may write to you about the course (a meeting time, a change of plan). This is part of running the course, not marketing.
• Server logs — on every visit the server records technical data: IP address, date, the address visited and the browser type. To protect the site from abuse and to spot failures. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

Giving your data is voluntary, but without it we cannot answer your message, book you on a course or open an account.

• Contact-form messages — 12 months from sending, then deleted automatically.
• Course bookings — while the course is being organised, then for 5 years from the end of the year the course took place in (settlements and possible claims). After that, on 1 January, the personal data is removed from them automatically (name, email, phone, notes) — only an anonymous record of the date and the number of participants stays, for statistics. Exception: bookings attached to your account stay while you have the account — they are your history under My account. Once the account is deleted, the same 5-year rule applies.
• Account — until you delete it. An unconfirmed account is deleted automatically after 7 days. When an account is deleted, its course bookings stay with the school (no longer linked to it) on the terms above.
• Newsletter — until you unsubscribe. An unconfirmed sign-up is deleted automatically after 7 days. After you unsubscribe we keep your address, the text of the consent you gave and the dates of signing up and unsubscribing — to be able to show what you consented to and when you withdrew.
• Server logs — of limited size; the oldest entries are overwritten automatically.
• Backups — encrypted backups of the database are kept for up to 40 days, then deleted automatically.

We do not sell data or pass it on to anyone for marketing. We use trusted service providers who process data only on our behalf:

• Server provider (a data centre in the European Union) — the server the website and the database run on.
• Brevo (Sendinblue SAS, France, EU) — sending emails: booking confirmations, messages to participants and the newsletter. Brevo adds a mechanism counting opens and link clicks to emails; we use it in anonymised mode — the statistics are aggregate only and not attributed to any person.
• Cloudflare (Cloudflare, Inc., USA) — sits between visitors and the site and protects it from attacks; it sees, among other things, the visitor's IP address. Data goes to the USA under the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.
• Google (Google Ireland Ltd., EU) — storing backups on Google Drive. Backups are encrypted before they leave our server, so Google has no access to their content.
• Technical support — the person who maintains the website and the server.

We may also pass data to public authorities where the law requires it (for example to the tax office, for settlements).

You have the right to:

• access your data and receive a copy of it,
• have incorrect data corrected,
• have your data erased (“the right to be forgotten”),
• restrict processing,
• move your data to another controller,
• object to processing based on our legitimate interest (such as server logs),
• withdraw your consent at any time — without affecting what we did before you withdrew it.

The simplest way: write to [email protected]. Some things you can do yourself — delete your account under My account, and unsubscribe from the newsletter with the link at the bottom of every issue.

If you believe we process your data unlawfully, you can complain to the Polish data protection authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

The site uses no advertising or analytics cookies and does not track you across sites. That is why there is no cookie banner.

We use only the cookie needed to log in (payload-token) — it is set when you log in and keeps you logged in from page to page. Cloudflare may also set a technical cookie that protects the site from bots.

The connection to the site is encrypted (HTTPS). Account passwords are stored as a cryptographic hash they cannot be recovered from. Only the school has access to the data in the admin panel. Backups are encrypted before they leave the server.

We make no automated decisions about you and do not profile you. The only automatic step is the order of the waiting list: when a course is full, a booking goes onto the list, and the school decides who gets a place from it.

If we change how we process data, we will update this page and the version date at the top.