In force from 24 August 2026
1. Controller
The controller of personal data is Fundacja Dziko, Krzywe 19A, 19-411 Świętajno, Poland, KRS 0000779318, NIP 5213861674, REGON 382953669. Contact on data protection matters: asktotems@gmail.com, telephone +48 787 907 058.
We have not appointed a data protection officer, as the conditions in article 37 of the General Data Protection Regulation are not met.
2. What we collect
When you book an expedition we collect your name, e-mail address, telephone number, country of residence, the number of participants and the chosen date. Where an invoice is requested we also collect the billing address and, for businesses, the tax identification number.
Health information voluntarily provided by a participant and relevant to safety is processed solely on the basis of their explicit consent and is deleted immediately after the expedition ends.
When you use the website, technical data such as your IP address, browser type and pages visited are collected.
3. Purposes and legal bases
Conclusion and performance of the contract for the expedition, including organisational contact, under article 6(1)(b) of the General Data Protection Regulation.
Issuing and retaining accounting records and meeting tax obligations under Polish law, under article 6(1)(c).
Handling complaints and establishing, exercising or defending legal claims, under article 6(1)(f), our legitimate interest being the protection of our rights.
Safeguarding participants on the basis of voluntarily provided health information, under article 9(2)(a).
Publication of a participant’s image in promotional material, solely on the basis of separate consent, under article 6(1)(a).
4. Recipients
Data may be shared with: Stripe Payments Europe, Limited and its affiliates, as our payment processor; the accounting firm serving the foundation, Kancelaria Podatkowa Farina Sp. z o.o., Warsaw, Poland; our hosting and e-mail providers; and bodies entitled to receive data under applicable law.
Each of these processes data under a data processing agreement or under its own statutory duties.
5. Transfers outside the European Economic Area
Payment data may be transferred to Stripe entities located in the United States. Such transfers take place on the basis of the standard contractual clauses adopted by the European Commission and, where applicable, the EU-US Data Privacy Framework.
Where our e-mail or hosting provider processes data outside the European Economic Area, the same safeguards apply. A copy of the safeguards is available on request at the address in clause 1.
6. Retention
Data connected with payments and accounting is retained for 5 years counted from the end of the calendar year in which the tax payment fell due, as required by Polish tax law.
Data needed to defend against claims is retained for the limitation period, which as a rule is 3 years for claims connected with business activity.
Data processed on the basis of consent is retained until the consent is withdrawn.
7. Your rights
You have the right of access to your data and the right to rectification, erasure, restriction of processing and data portability, and the right to object to processing based on our legitimate interest.
Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before the withdrawal.
You have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal
Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland, or with the supervisory authority in your country of residence.
8. Is providing data required
Providing data is voluntary but necessary to conclude and perform the contract. Without contact details a booking cannot be confirmed.
9. Automated decision making
We do not use your data for automated decision making or for profiling producing legal effects.
10. Cookies
The website uses cookies necessary for it to function and, subject to your consent, cookies used to measure
traffic. Consent may be withdrawn or changed on the website or in your browser settings.
