Privacy policy and cookie policy – Pol-Langua.pl
This translation is provided for information only. The binding text is the Polish version of this document.
1. Controller of personal data
The controller of your personal data is:
- PW MATYSART Michał Matysiak (sole proprietorship registered in CEIDG, the Polish business register)
- Address: ul. Warszawska 85/1, 26-617 Radom, Poland
- NIP (tax ID): 7981427077
- REGON (statistical ID): 140583450
- Domain: pol-langua.pl
- Contact: langua@pol-langua.pl
- Phone and WhatsApp: +48 514 180 841 (main number)
- Phone for companies: +48 508 196 803
In the rest of this policy, the terms “Controller”, “we” and “Pol-Langua” are used interchangeably.
2. Data Protection Officer (DPO)
The Controller has not appointed a Data Protection Officer. In all matters relating to the processing of personal data and the exercise of your rights, please contact the Controller directly at langua@pol-langua.pl.
3. Scope of data collected
On pol-langua.pl we provide one form – the contact form, available in the “Contact” section of the website’s pages. The form has two variants: for a private individual and – after selecting the goal “Course for a company / employees” – for a company. Data entered in the form is processed by the Controller’s own server script running on the same hosting as the website and goes directly to the Controller’s e-mail inbox. We do not use any external form-handling service. The scope of data collected through this form is shown in the table below.
| Form | Required fields | Optional fields |
|---|---|---|
| Contact form – private individual | first name and surname, e-mail address; selection fields with a default value that you can change: native language, language of explanations during lessons (Polish, English, Russian or Spanish), learning goal | message (content of the enquiry) |
| Contact form – “company” variant | as above | company name, number of employees, industry, message (content of the enquiry) |
The following technical data is sent automatically together with the form (you do not enter it yourself):
- the identifier and language of the page from which the form was sent, and the address (URL) of that page;
- the thematic cluster of the page (e.g. exam, work, companies) and the label of the button or section (CTA) from which you go to the form – if the placement test was completed on the website before the form was sent, this label contains the approximate test result (e.g. “test-B1”);
- the type of enquiry (private individual or company);
- the parameters
utm_source,utm_mediumandutm_campaign, if they were present in the address through which you entered the website (e.g. from a search engine, a social media profile or a link in a message) – they are used solely to determine which channel brought the enquiry; - the IP address of the device from which the form was sent, and the date and time of sending;
- protection against automated sending (spam): a timestamp of filling in the form and a trap field invisible to the user.
After the form is sent, we send an automatic confirmation of receipt of the enquiry to the e-mail address provided, in the language of the page from which the form was sent. The confirmation contains the first name and surname, e-mail address and learning goal provided.
The placement test available on the website is scored in your browser – neither the answers nor the test result are sent to the Controller, unless you send the contact form after the test (in that case, as described above, only the approximate level is transmitted).
Contact via WhatsApp
The website contains “Message us on WhatsApp” links that open a conversation with the number +48 514 180 841. Using this channel is voluntary – instead, you can use the form, e-mail or phone. After clicking the link, the WhatsApp application opens with a ready, editable message containing the name of the page from which you are writing. If you write to us via WhatsApp, we process your phone number, profile name (and profile photo, if visible) and the content of the correspondence.
In addition, our hosting server automatically collects standard technical data in its logs: IP address, browser identifier (user-agent), date and time of the request, URL of the requested resource and HTTP response code.
4. Purposes, legal bases and retention periods
| Purpose of processing | Scope of data | Legal basis | Retention period |
|---|---|---|---|
| Handling an enquiry sent through the contact form (answering a question, preparing an offer, agreeing the terms of lessons) | first name and surname, e-mail, native language, language of explanations during lessons, learning goal, content of the message; in the “company” variant also company name, number of employees and industry; sending an automatic confirmation of the enquiry to the e-mail address provided | Art. 6(1)(b) GDPR – taking steps at the request of the data subject prior to entering into a contract | 12 months from the last contact, unless a contract is concluded (in that case the term of the contract + the limitation period for claims) |
| Measuring the effectiveness of the website and of the channels through which enquiries are obtained (determining from which page, section and source an enquiry came) | identifier, language and address of the page, thematic cluster, CTA (including the approximate placement test result, if the test was completed), type of enquiry, parameters utm_source, utm_medium, utm_campaign |
Art. 6(1)(f) GDPR – legitimate interest of the Controller (assessing the effectiveness of content and contact channels and better tailoring the answer to the enquiry) | as for handling an enquiry from the form – 12 months from the last contact, and if a contract is concluded, the term of the contract + the limitation period for claims |
| Protecting the form against abuse (spam, mass sending) | IP address, date and time the form was sent, timestamp of filling in the form, counter of attempts in the session | Art. 6(1)(f) GDPR – legitimate interest of the Controller (security of the form) | IP address and date and time – together with the message from the form (as for handling an enquiry); counter of attempts – until the end of the session |
| Handling an enquiry sent via WhatsApp (answering a question, preparing an offer, agreeing the terms of lessons, ongoing contact) | phone number, profile name (and profile photo, if visible), content of the correspondence | Art. 6(1)(b) GDPR – taking steps at the request of the data subject prior to entering into a contract or performance of a contract; otherwise Art. 6(1)(f) GDPR – legitimate interest of the Controller (replying to correspondence addressed to it) | as for the form – 12 months from the last contact, unless a contract is concluded (in that case the term of the contract + the limitation period for claims) |
| Server logs (ensuring the security of the website, diagnostics, protection against abuse) | IP address, user-agent, date and time, URL, HTTP code | Art. 6(1)(f) GDPR – legitimate interest of the Controller (system security) | 90 days |
| Establishing, pursuing or defending claims | data from the form, correspondence, invoice data | Art. 6(1)(f) GDPR – legitimate interest of the Controller (protection of rights) | 6 years (in accordance with Art. 118 of the Polish Civil Code) |
| Fulfilling accounting and tax obligations (invoices, records) | identification data of the counterparty, invoice data | Art. 6(1)(c) GDPR – legal obligation of the Controller (Polish Tax Ordinance, VAT Act, Accounting Act) | 5 years from the end of the calendar year in which the tax obligation arose |
5. Recipients of data
The contact form is handled by the Controller’s own server script running on the same hosting as the website – data is not transferred to an external form service. Your data may be entrusted or disclosed to the following categories of recipients:
- the hosting provider of pol-langua.pl (based in the EEA, acting under a data processing agreement – DPA);
- the provider of the e-mail service / SMTP server handling the inbox langua@pol-langua.pl (e.g. the operator nazwa.pl; based in the EEA, under a data processing agreement – DPA);
- the Controller’s accounting office (for invoice data, under a DPA);
- public authorities (e.g. courts, public prosecutors, tax offices, the Police) – only on the basis of applicable law and a written request.
If you contact us via WhatsApp, your data (phone number, profile name, content of messages) is also processed by WhatsApp Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland) – as a separate controller, under the terms set out in WhatsApp’s terms of service and privacy policy, accepted when creating an account in that service. The Controller has no influence on how WhatsApp processes data within its service. These rules are available at www.whatsapp.com/legal/privacy-policy-eea.
We do not sell your data. We do not transfer it to third parties for marketing purposes.
6. Your rights
Under the GDPR you have the following rights:
- the right of access to data (Art. 15 GDPR);
- the right to rectification of data (Art. 16 GDPR);
- the right to erasure of data – the “right to be forgotten” (Art. 17 GDPR);
- the right to restriction of processing (Art. 18 GDPR);
- the right to data portability (Art. 20 GDPR);
- the right to object to processing based on legitimate interest (Art. 21 GDPR);
- the right to withdraw consent at any time – if processing is based on consent (withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal).
To exercise the above rights, contact the Controller at langua@pol-langua.pl. We will reply without undue delay, and in any event within one month.
You also have the right to lodge a complaint with the supervisory authority, which in Poland is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych):
- address: ul. Stawki 2, 00-193 Warszawa
- e-mail: kancelaria@uodo.gov.pl
- phone: 22 531 03 00
- website: www.uodo.gov.pl
7. Data security
We apply appropriate technical and organisational measures to protect your data, in particular:
- encryption of connections to the website with the HTTPS/TLS protocol;
- access to the contact inbox restricted to authorised persons only;
- strong passwords and, where possible, two-factor authentication;
- regular backups of operational data;
- data processing agreements (DPA) with IT service providers.
8. Transfer of data outside the European Economic Area (EEA)
The Controller does not transfer personal data outside the European Economic Area (EEA). Data from the contact form is processed on servers in the EEA – the hosting of pol-langua.pl and the provider of the e-mail service / SMTP server are located in Poland / the European Union.
The exception is contact via WhatsApp, which you use voluntarily. According to WhatsApp, data of users of this service may be transferred outside the EEA, including to the United States, within the Meta group, on the terms and with the safeguards described in WhatsApp’s privacy policy. If you do not want your data to reach this service, contact us via the form, e-mail or phone.
9. Profiling and automated decisions
We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR.
10. Minors
Pol-Langua’s services are intended for adults. If you use our offer on behalf of a minor (e.g. by enrolling a child in lessons), the consent and action of a legal guardian are required. We do not knowingly collect personal data of children under 16 years of age without the consent of a parent or legal guardian.
11. Changes to the privacy policy
This policy may be updated to reflect legal or technical changes or changes in the services provided. The current version is always available at pol-langua.pl/pobrane/polityka-pl.html. The date of the last update is shown at the beginning of the document.
12. Contact
If you have any questions about the processing of personal data, write to langua@pol-langua.pl or call +48 514 180 841 (also WhatsApp); for company matters – +48 508 196 803.
13. Policy on cookies and local data – general provisions
This section constitutes the cookie policy within the meaning of Art. 399 of the Polish Act of 12 July 2024 – Electronic Communications Law (Prawo komunikacji elektronicznej, Dz.U. 2024 item 1221), in force since 10 November 2024, which replaced the former Art. 173 of the Telecommunications Law.
Cookies are small text files saved by a web browser on your terminal device. Besides cookies, there are other techniques for storing data in the browser, in particular the localStorage mechanism (the browser’s local storage). This policy describes all such data stored locally by pol-langua.pl.
14. What local data pol-langua.pl uses
While you browse, pol-langua.pl does not save any HTTP cookies. The language version of the website results solely from its address (e.g. /, /en/, /ru/) – the website does not remember the selected language in your browser. We use only one entry in the browser’s localStorage mechanism and – only at the moment the contact form is sent – one technical session cookie:
| Key | Purpose | Type | Lifetime |
|---|---|---|---|
cookie_ok (localStorage) |
Remembering that the user has read the information banner about cookies / local data, so that the banner is not displayed again | strictly necessary | until cleared by the user |
PHPSESSID (session cookie) |
Set by the script handling the contact form only at the moment the form is sent; used to limit the number of submissions within a short time (spam protection). It contains only a random session identifier | strictly necessary (security of the service) | until the browser is closed (session cookie) |
We do not use cookies or other tracking mechanisms of a marketing, advertising or analytical nature. In particular, we do not use Google Analytics, Google Tag Manager, Facebook Pixel (Meta Pixel), Hotjar or any other tools for profiling or analysing traffic.
15. Third-party cookies
pol-langua.pl does not embed third-party scripts or content that could set their own cookies. In particular, we do not use:
- Google maps (Google Maps embed),
- YouTube videos (embed),
- Google Fonts loaded from Google’s CDN (we use system or self-hosted fonts),
- social plugins (like buttons, share buttons).
The website contains only static links to Pol-Langua’s profiles on Facebook and Instagram and “Message us on WhatsApp” links. The website does not load any scripts or elements of these services. Clicking such a link takes you to Facebook or Instagram (Meta Platforms Ireland Ltd.) or to the WhatsApp service (WhatsApp Ireland Limited), where the privacy rules of those entities apply.
16. Legal basis – why we do not ask for consent
Pursuant to Art. 399(4)(2) of the Electronic Communications Law, the user’s consent is not required for information stored in or obtained from the terminal device if it is strictly necessary to provide a service by electronic means explicitly requested by the user.
Both mechanisms described above (the cookie_ok entry and the PHPSESSID session cookie) are strictly necessary for the website to work correctly in line with your choices (hiding the banner after you have read it, securely sending the form you ask to send) and serve no marketing, profiling or analytical purposes. That is why we do not display a classic “accept / reject” consent banner, but only brief information about data stored locally.
The parameters utm_source, utm_medium and utm_campaign described in section 3 are not saved in your browser – the website script reads them from the page address only in order to attach them to the form, if you decide to send it.
17. Managing local data in your browser
You can clear saved local data (cookies and localStorage) at any time from your browser:
- Google Chrome: Settings -> Privacy and security -> Third-party cookies / Site data -> See all site data and permissions -> search for “pol-langua.pl” -> Delete.
- Mozilla Firefox: Settings -> Privacy & Security -> Cookies and Site Data -> Manage Data -> search for “pol-langua.pl” -> Remove Selected.
- Safari (macOS): Safari -> Settings -> Privacy -> Manage Website Data -> search for “pol-langua.pl” -> Remove.
- Microsoft Edge: Settings -> Cookies and site permissions -> Manage and delete cookies and site data -> See all cookies and site data -> search for “pol-langua.pl” -> Delete.
You can also use the developer tools (F12 or Ctrl+Shift+I) -> the “Application” / “Storage” tab -> “Local Storage” -> select pol-langua.pl -> delete the cookie_ok entry (you will find the PHPSESSID session cookie in the same tab, under “Cookies”).
Please note that clearing this data will cause the website to display the information banner again.