Privacy Policy

1. Data Controller

The controller of your personal data within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, hereinafter "GDPR") and the Polish Act of 10 May 2018 on the Protection of Personal Data (Dz.U. 2018 poz. 1000, as amended) is Vovupi, with its registered address at Kolejowa 15/17, Warszawa, Poland. You may contact the data controller by email at [email protected] or by telephone at +48 22 832 82 00.

2. Scope of This Policy

This Privacy Policy describes how Vovupi collects, processes, stores, and protects personal data of individuals who visit the website vovupi.info, use its features, submit contact inquiries, or otherwise interact with Vovupi's digital services. It applies to all data subjects located in the European Economic Area and is written in compliance with the requirements of the GDPR and applicable Polish law.

3. Categories of Personal Data Collected

Vovupi may collect the following categories of personal data:

• Identification data: name and email address provided voluntarily through the contact form.
• Communication data: the content of messages you send to us via the contact form or by email.
• Technical data: IP address, browser type and version, operating system, device type, pages visited, time and date of access, and referring URL. This data is collected automatically through server logs and, where consent is given, through analytics cookies.
• Cookie data: data collected via cookies as described in our Cookie Policy, which forms part of this document.

Vovupi does not collect sensitive personal data (special categories of data as defined in Article 9 GDPR) and does not knowingly collect data from individuals under 16 years of age.

4. Legal Bases and Purposes of Processing

Vovupi processes personal data on the following legal bases as specified in Article 6 GDPR:

• Article 6(1)(b) GDPR – processing necessary for the performance of a contract or pre-contractual steps: when you inquire about course access or services we provide.
• Article 6(1)(a) GDPR – consent: for non-essential cookies (analytics, marketing) placed on your device and for any direct marketing communications, where applicable.
• Article 6(1)(c) GDPR – compliance with a legal obligation: where we are required by Polish or EU law to retain or process data.
• Article 6(1)(f) GDPR – legitimate interests: for security monitoring, fraud prevention, and the technical operation of the website, provided such interests are not overridden by your fundamental rights.

5. Data Retention

Personal data is retained only for as long as necessary for the purpose for which it was collected. Contact inquiry data is retained for a period not exceeding two years from the date of last communication unless a longer retention period is required by law. Technical log data is retained for up to twelve months. Cookie data is retained in accordance with the retention periods specified in the Cookie Policy. Where data is retained for legal compliance purposes, the applicable statutory retention period applies.

6. Data Recipients and Transfers

Vovupi does not sell, rent, or trade personal data to third parties. Data may be shared with trusted service providers acting as data processors under written agreements that comply with Article 28 GDPR, including hosting and infrastructure providers, email service providers, and analytics platforms. Where such providers are located outside the European Economic Area, data transfers are conducted under appropriate safeguards including Standard Contractual Clauses approved by the European Commission. Vovupi may also disclose data to competent authorities where required by applicable law.

7. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights, exercisable free of charge by contacting [email protected]:

• Right of access (Article 15 GDPR): to obtain confirmation of whether your data is processed and a copy thereof.
• Right to rectification (Article 16 GDPR): to have inaccurate data corrected without undue delay.
• Right to erasure (Article 17 GDPR): to request deletion of your data where the legal basis for processing no longer applies.
• Right to restriction of processing (Article 18 GDPR): to request that processing be restricted in defined circumstances.
• Right to data portability (Article 20 GDPR): to receive data in a structured, machine-readable format where processing is based on consent or contract.
• Right to object (Article 21 GDPR): to object to processing based on legitimate interests at any time.
• Right to withdraw consent (Article 7(3) GDPR): where processing is based on consent, to withdraw it at any time without affecting the lawfulness of prior processing.

You also have the right to lodge a complaint with the Polish supervisory authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, www.uodo.gov.pl.

8. Data Security

Vovupi implements appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. These measures include encrypted data transmission (HTTPS/TLS), access controls, and regular security reviews. No method of transmission over the internet or electronic storage is completely secure; however, Vovupi applies industry-standard practices to protect data integrity and confidentiality.

9. Changes to This Policy

Vovupi may update this Privacy Policy from time to time to reflect changes in law, technology, or business practices. The updated version will be published on this page with a revised "Last Updated" date. Where changes are material, we will take reasonable steps to notify users. Continued use of the website after any such changes constitutes acknowledgment of the updated policy.

10. Contact

For any questions, requests, or concerns relating to this Privacy Policy or the processing of your personal data, please contact us at: [email protected] or by post at Kolejowa 15/17, Warszawa, Poland.