Privacy Policy

I. Introduction

This document describes the privacy policy of Polonia Warszawa S.A. with its registered office in Warsaw, ul. Konwiktorska 6 lok. 102, 00-206 Warsaw, NIP: 525 259 60 06, REGON: 147440802, entered into the register of entrepreneurs maintained by the District Court for the capital city of Warsaw. The PW S.A. Privacy Policy (hereinafter referred to as the Policy) defines the principles for collecting, processing, using, and protecting data and information from users of all websites owned by PW S.A., including:

• www.kspolonia.pl,
• www.bilety.kspolonia.pl
• ww.sklep.kspolonia.pl

and services provided by PW S.A.

Please read this Policy carefully. By accessing or using a website owned by PW S.A., sending us any Personal Data, and by reviewing this Policy, you accept the terms of this Policy and acknowledge that you have read its content.

II. Terms Used in the Policy

Personal Data – means Personal Data within the meaning of the GDPR, meaning any information about an identified or identifiable natural person that directly or indirectly identifies a natural person, in particular, such as the name, email address, or telephone number of the natural person, and other data that, in combination with the above, may identify the User.

GDPR – means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), pursuant to which PW S.A. processes Users’ Personal Data.

Store – the online store operated by PW S.A., operating at sklep.kspolonia.pl. User – means a user using all websites belonging to PW S.A., in particular a customer of the PW S.A. online store, a visitor to websites belonging to PW S.A., a newsletter subscriber, a participant in a competition or other event organized by PW S.A., or a person asking a question.

Services – means services provided by PW S.A. electronically via the website, including, in particular: purchasing a ticket or season ticket, registering and maintaining a fan card, creating an account in the online store and fulfilling orders, marketing and promotional activities, in particular subscribing to the newsletter, sending inquiries via the contact form, registering for competitions and other events organized by PW S.A., registering for participation in the Academy, and training activities.

III. Providing Personal Data

By providing your Personal Data on the website www.kspolonia.pl and other websites belonging to PW S.A., the User confirms that he or she has the necessary consent to disclose personal data, which will be used by PW S.A. in the manner described in this Policy.

If the User provides any Personal Data of other individuals (in particular, Personal Data of a child registered for the Academy), the User may do so only if it does not violate applicable law or the personal rights of these individuals.

IV. Personal Data Controller

The Controller of Users’ Personal Data provided in connection with the use of PW S.A. websites, in particular in connection with purchasing tickets or passes online, sending marketing information, including newsletters, accepting registrations for conferences, competitions, events, and using other services available on the websites, is PW S.A., ul. Konwiktorska 6, lok. 102, 00-206 Warsaw, tel. +48 22 746 92 62.

In all matters related to the principles of personal data processing specified in this Policy, the User may contact us by sending a message to:
[email protected]
or to: Klub Sportowy Polonia Warszawa, ul. Konwiktorska 6, 00-206 Warsaw

V. Purposes of Personal Data Processing and Legal Basis for Processing

The Controller processes Personal Data for the following purposes:

Purpose of processing	Legal basis	Scope of processing
Providing services electronically – account management (purchase and sale of match tickets)	Article 6(1)(b) of the GDPR – conclusion and performance of the contract	• Name and surname • PESEL number • Email address • Account login and password
Świadczenie usługi drogąelektroniczną – prowadzenie konta (sklep internetowy)	Art. 6 ust. 1 lit. b RODO –zawarcie i realizacja umowy	• Name and surname • Email address • Phone number • Home address • Shipping address • Billing address • Login and password to access the account • Bank account number
Ticket sales for matches	Article 6(1)(b) of the GDPR – conclusion and performance of the contract	• Name and surname • PESEL number • Email address
Product sales – running an online store (order fulfillment)	Article 6(1)(b) of the GDPR – conclusion and performance of the contract	• Name and surname • Delivery address • Email address • Phone number • Bank account number
Conducting analyses, surveys and statistical and marketing measurements (including data analysis and profiling for marketing purposes) of the Controller’s products and services and assessing satisfaction with PW SA’s products and services, including tailoring services and products to the User’s needs, analysing and improving services and products and ensuring the security of services	Article 6, paragraph 1, letter f of the GDPR – legitimate interest of the Personal Data Controller	• IP address • Information about the preferences of Users using the products and services of the Personal Data Administrator
Consideration of complaints and claims (purchase and sale of match tickets)	Article 6 paragraph 1 letter f of the GDPR – legitimate interest of the Personal Data Controller Article 6 paragraph 1 letter b of the GDPR – conclusion and performance of the contract	• Name and surname • Email address • PESEL number • Data included in the complaint description • Data contained in transactions
Handling complaints and claims (online store)	Article 6 paragraph 1 letter f of the GDPR – legitimate interest of the Personal Data Controller Article 6 paragraph 1 letter b of the GDPR – conclusion and performance of the contract	• Name and surname • Delivery address • Billing address • Email address • Phone number • Bank account number • Data included in the complaint description • Data contained in transactions
Asserting and defending rights in the event of mutual claims	Article 6, paragraph 1, letter f of the GDPR – legitimate interest of the Personal Data Controller	• Name and surname • Delivery address • Billing address • Email address • Phone number • Bank account number • Data contained in transactions
Sending marketing and promotional information about products and services, events and news, including newsletter subscriptions	Article 6, paragraph 1, letter a – consent to the processing of personal data	• Name and surname • Email address
Sending Users, to the e-mail addresses or telephone numbers provided by them, answers to previously submitted inquiries sent via the contact form, as well as for the purpose of contacting Users and responding to messages and inquiries previously sent by them	Article 6, paragraph 1, letter f of the GDPR – legitimate interest of the Personal Data Controller	• Name and surname • Email address • Phone number • Content of the inquiry
Organization and conduct of competitions and other events by PW S.A.	Article 6, paragraph 1, letter a – consent to the processing of personal data	• Name and surname • Email address • Residential address
Ensuring the safety of the organisation of matches and the efficient organisation and conduct of mass events, including the identification of fans	Article 6, paragraph 1, letter f of the GDPR – legitimate interest of the Personal Data Controller	• Name and surname • PESEL number • Image
Training activities of the Administrator and entities cooperating with him in the field of systems supporting training and coaching activities	Article 6(1)(b) of the GDPR – conclusion and performance of the contract	• Child’s name and surname • Name           and surname of the guardian • Child’s age • Email address • Phone number
Maintaining a profile, in particular for the purpose of informing Users about the Administrator’s activity, promoting the Administrator’s websites, promoting various types of events, services and products, as well as for the purpose of communicating with Users via functionalities available in social media and providing answers to short inquiries sent via messengers available on the aforementioned portals	Article 6, paragraph 1, letter f of the GDPR – legitimate interest of the Personal Data Controller	• Name and surname • Email address • Content of the inquiry

Regarding the processing of personal data for the purpose of selling products available in the PW S.A. online store, more detailed information on the processing of personal data of Users using the online store is included in Chapter XI of this Policy.

In the context of processing Personal Data for the purpose of handling inquiries, a legitimate interest is manifested in the ability to respond to the submitted inquiry and provide the User with a comprehensive response. Without processing Personal Data, particularly contact data, PW S.A. will not be able to provide a response and thus help resolve the issue raised in the inquiry. The Controller provides the option of contacting the Controller by sending an inquiry by traditional mail, email, or electronic contact forms.

In the context of consent to sending commercial information to the User, if the User asks about a specific commercial offer via the contact form, submitting the form also constitutes consent to receive the commercial offer referred to in the inquiry, through a so-called clear affirmative action. Detailed explanations can be found in this chapter of this Policy.

To the extent that Personal Data is processed for the purpose of concluding and performing a contract with PW S.A., e.g., purchasing a ticket, season ticket, or fan card, the User’s provision of data is a condition for concluding this contract. Providing data is voluntary, but necessary for the conclusion and performance of the contract. Failure to provide Personal Data will result in the contract not being concluded.

In other respects, i.e., if the provision of Personal Data is not a statutory or contractual requirement and is not a condition for concluding a contract, the provision of Personal Data is voluntary and is based on consent, e.g., consent to join the Academy or consent to receive the newsletter.

VI. Sharing of Personal Data

Personal data may be transferred to third parties cooperating with PW S.A., including service providers providing services to PW S.A., in particular IT services, including website maintenance and operation services, IT system providers, service providers providing services related to the maintenance and operation of systems used for distributing match tickets and making online purchases, for the purpose of processing online payments, video surveillance service providers, ticket distribution services, marketing services (advertising agencies, mass mailing companies, etc.), including photography and video recording services, accounting, legal, auditing, consulting, advisory, insurance, security, document destruction, and archiving services, banks, and companies affiliated with PW S.A. All entities to which PW S.A. transfers Personal Data are verified by the Controller in terms of data protection security and are obligated, under an appropriate agreement concluded with the Controller, to use Personal Data only and exclusively for the purposes designated by the Controller. Personal Data is shared by entrusting them for processing. For this purpose, PW S.A. concludes appropriate personal data processing agreements with the above-mentioned entities, meeting the requirements of Article 28, Section 3 of the GDPR.

Every User has the right to access information about the entity to which the Personal Data has been shared under the terms specified in Chapter VII of this Policy. The exercise of the User’s rights is identical to the principles regarding the processing of Personal Data by PW S.A. specified in Chapter VII of this Policy.

PW S.A. is also entitled to share User Personal Data with entities authorized under applicable law, i.e., public authorities, including courts and law enforcement agencies, upon their justified request or for the purpose of defending or pursuing claims, or if such an obligation arises expressly from the provisions of law. The recipients of the data of individuals participating in matches organized by PW S.A. also include entities authorized to receive such data under legal provisions, in particular the Act on the Organization of Mass Events, such as the Polish Football Association, the entity managing the competitions in which PW S.A. participates, and the Police. The recipients of the data of Academy participants also include entities such as the Polish Football Association, and this data is transferred based on concluded Academy membership agreements.

As a rule, Personal Data will not be transferred outside the European Economic Area (“EEA”) or to international organizations. If necessary, Personal Data will be transferred outside the EEA or to international organizations, ensuring an adequate level of protection. The Administrator will inform the User of any intention to transfer Personal Data.

VII. User Rights

Pursuant to Chapter III, Articles 15-22 of the GDPR, Users have the following rights in connection with the processing of their Personal Data by PW S.A.:

1. The right to access your Personal Data,
2. The right to rectify processed data,
3. The right to erasure (“the right to be forgotten”),
4. The right to restrict data processing,
5. The right to data portability,
6. The right to object to further data processing,
7. The right not to be subject to decisions based solely on automated processing, including profiling,
8. The right to withdraw consent to the processing of Personal Data,
9. The right to file a complaint about improper processing of Personal Data with the Office for Personal Data Protection.

Each of the above rights is exercised upon the User’s request, sent to: [email protected]. PW S.A. will review the submitted request and send a response within one month of receiving the request, indicating the outcome of the request, i.e., the specific actions taken and the estimated time to complete the entire request if certain actions require a longer completion time.

Under the right indicated in point 8) above, the User may at any time withdraw consent to the further processing of Personal Data for purposes that require consent, provided that the withdrawal of consent does not affect the lawful use of Personal Data for activities based on consent prior to its withdrawal. To withdraw consent, simply send an email or traditional mail to the contact details provided in this Policy.

Under the right to access Personal Data, the User is entitled to obtain a copy of the following information:

1. The purposes of processing Personal Data;
2. The categories of Personal Data, i.e., what data we process, e.g., name, surname, telephone number;
3. Information about the recipients or categories of recipients of the data, i.e., to whom (person, company, institution) the Personal Data may be transferred;
4. Information about the right to request that PW S.A. rectify, erase, or restrict the processing of your data, and to object to certain data processing;
5. Information about the possibility of filing a complaint with the President of the Personal Data Protection Office;
6. Information about the source of the data, if the data was not obtained directly from the User, i.e., the name of the person, company, or institution that provided the Personal Data;
7. Information about the use of profiling, i.e., the principles under which it is undertaken and the possible consequences of profiling for the User.

PW S.A. also informs that each subsequent copy of Personal Data is subject to a fee resulting from the costs incurred in creating another copy of Personal Data. PW S.A. will notify the User of the costs after assessing the scope of information provided in the request.

PW S.A. reserves the right to respond to a request to exercise any of the User’s rights later than the deadline specified above (up to two months) due to the number of requests or the complex nature of the submitted request. By complex nature, we mean the need to collate data from multiple IT systems or the need to consult with more than one person from one or more departments to obtain the information requested. In both of the above situations, PW S.A. undertakes to inform the User of this fact, providing a justification for each request.

PW S.A. informs the User that it may refuse to exercise any of the User’s rights specified in Articles 15–22 of the GDPR if the User submits requests repeatedly and excessively, without any justification. In each case, PW S.A. will justify the refusal to exercise the right indicated in the request. By “continuous and excessive” we mean sending subsequent requests with a similar request to the first one, despite having been considered and informed of its fulfillment. For example, the User submits a request for access to information, PW S.A. fulfills the request, i.e. sends a summary of the information held, and the User submits the same request again without explaining the reason for the repeated request for information.

VIII. Processing of Personal Data for Marketing Purposes

By creating an account, submitting an inquiry, registering for a contest, or other event organized by PW S.A., the User may consent to the processing of Personal Data for the purpose of sending marketing information about PW S.A.’s products and services by clearly checking the checkbox. Consent may be withdrawn at any time, subject to the provisions of Chapter VII, paragraph 3 of this Policy.

The User also consents to receiving the newsletter by providing their email address on the newsletter subscription form, or by checking the “I consent” checkbox when completing the contact form. Providing their email address on the newsletter subscription form constitutes a clear affirmative action to the processing of Personal Data within the meaning of Article 4, Section 11 of the GDPR regarding the definition of consent and the related Recital 32 of the GDPR, which explains what a clear affirmative action is. According to the aforementioned recital, a clear affirmative action is a communication from the User to PW S.A. that they consent to the use of the email address provided in the form for PW S.A. to send newsletters containing information promoting PW S.A. This is one of the permissible ways – in addition to checking a checkbox – for expressing consent to the use of the provided email address for the aforementioned purpose.

Consent to the sending of unsolicited commercial information to Users pursuant to Article 10 of the Act on the Provision of Electronic Services and Article 172, Section 1 of the Telecommunications Law is expressed independently and separately by Users by checking a dedicated checkbox next to the consent text.

In order to download certain documents posted on PW S.A. websites, it may be necessary to complete a form and provide Personal Data. The data provided will be processed based on consent (Article 6, Section 1, Item a of the GDPR) expressed through a clear affirmative action. However, if the User wishes to receive other marketing information, they may choose whether or not to select the dedicated checkbox. Failure to select the checkbox indicates to PW S.A. that the User is not interested in receiving information and will therefore not be included in mailing lists.

IX. Personal Data Processing and Profiling

As PW S.A., we would like to inform you that as part of processing online purchases and orders, as well as when creating and sending marketing information, we may compile Users’ Personal Data in order to tailor offers, marketing materials, and newsletters to specific Users. Therefore, PW S.A. engages in profiling, understood as a form of automated processing of Personal Data involving the use of certain User data.

The data collected includes: information from social media profiles, location and data provided by Users using forms on the PW S.A. website. This allows us to:

1. A more informed and better tailored selection of PW S.A. offers that meet the requirements of Users who are PW S.A. customers;
2. Adapting the marketing and advertising materials sent to Users’ interests and needs.

One of the tools used for profiling is Google Analytics, which analyzes website traffic. This tool can link data provided to PW S.A. by the User during order fulfillment or in connection with receiving a newsletter with data available online, provided by the User themselves. Linking data allows PW S.A. to create a User profile for:

1. Precisely tailoring offers to meet the requirements and needs of Users who are clients of PW S.A.,
2. targeting marketing content consistent with the User’s preferences and interests,
3. sending information about planned competitions or other events organized by PW S.A. that address topics related to the User’s competencies or interests.

The above-mentioned purposes of using the tool and the related consequences constitute the legitimate interests of PW S.A. as the controller of Personal Data (Article 6, Section 1, Item f of the GDPR). These interests are understood to mean that the Personal Data obtained through the tool enable decision-making that reduces PW S.A.’s operating costs related to sales and promotional activities, increases the attractiveness of PW S.A. as a reliable entity that focuses on the quality of services provided and User satisfaction, while also respecting Users by sending desired information consistent with preferences and interests.

PW S.A. ensures that the information and data obtained through the tool are used solely for the above-mentioned purposes and are not shared with other entities specializing in preparing profiles. The User may object to profiling at any time, in accordance with Chapter VII, Items 6-7 of this Policy, with the reservation that this will result in the inability to send marketing and commercial information or receive new commercial offers tailored to the User’s profile. Submitting an objection means that further profiling using the indicated tool will cease. However, it does not suspend the processing of Personal Data if another legal basis exists, such as consent.

X. Organization and Conduct of Competitions and Other Events

PW S.A. processes Users’ Personal Data in connection with the organization and conduct of competitions and other events organized by PW S.A. By registering for a competition or event (using a special form or by submitting an application to a dedicated email address), the User consents to the processing of their Personal Data for the purposes of carrying out all activities related to the competition or event being organized. The legal basis for data processing is consent (Article 6, Section 1, Item a) of the GDPR), expressed in the form of a clear affirmative action. The User may withdraw consent at any time, within the limits of their rights, in accordance with Chapter VII, Section 8 of the Policy, which will result in the inability to further participate in the competition or event. Detailed rules for organizing a competition or event are described in the rules of the specific competition or event.

XI. Processing of personal data when running an online store

1. All terms and expressions used in this chapter (Seller, Sales Agreement, Order Form, etc.) refer to the online store’s terms and conditions (link).
2. Providing personal data in the mandatory fields of the Registration Form, Order Form, Review Form, Subscription Form, and Contact Form is voluntary, but necessary to create and maintain an Account, place and complete an Order, comment on and rate Products, subscribe to the Newsletter, and send messages to the Seller via the Contact Form.
3. The Controller processes Personal Data if it is necessary to use the Store’s website and its functionalities, which is also the primary purpose of processing Personal Data.
4. The specific purpose, scope, and categories of recipients of personal data processed by the Seller will result from the actions taken by Data Subjects in using the Store and its functionalities, as well as other actions directly related to operating the Store.
5. The specific purposes of processing personal data indicated in the Registration Form are:
   • Performance of the Electronic Services Agreement consisting in creating and maintaining an Account via the Registration Form under the terms specified in the Terms and Conditions – in such case, the basis for personal data processing is the necessity of processing personal data for the conclusion and performance of the agreement (Article 6, paragraph 1, letter b of the GDPR), and, with respect to personal data provided optionally, consent (Article 6, paragraph 1, letter a of the GDPR);
   • Archiving documents, maintaining statistics and analyses, and establishing and pursuing potential claims or defending against claims related to the conclusion and performance of the Electronic Services Agreement consisting in creating and maintaining an Account via the Registration Form under the terms specified in the Terms and Conditions – in such case, the basis for personal data processing is the necessity of processing data for the pursuit of the Seller’s legitimate interests in the form of archiving documents, maintaining statistics and analyses, and establishing, pursuing potential claims or defending against them (Article 6, paragraph 1, letter f of the GDPR).
6. The specific purposes of processing personal data indicated in the Order Form are:
   • Placing and fulfilling an Order and performing a Sales Agreement – ​​in this case, the basis for personal data processing is the necessity to process personal data for the conclusion and performance of an Electronic Services Agreement, which involves enabling Customers to place Orders via the Order Form and to conclude and perform a Sales Agreement under the terms and conditions specified in the Terms and Conditions (Article 6, paragraph 1, letter b of the GDPR), and, with respect to personal data provided optionally, consent (Article 6, paragraph 1, letter a of the GDPR);
   • Making settlements, including tax settlements, and maintaining accounting records – in this case, the basis for personal data processing is the necessity to fulfill the Seller’s legal obligations arising from the provisions of law (Article 6, paragraph 1, letter c of the GDPR);
   • Returning Goods and settling the Order in the event of the Consumer’s withdrawal from the Sales Agreement – ​​in this case, the basis for personal data processing is the necessity to fulfill the Seller’s legal obligations arising from the provisions of law (Article 6, paragraph 1, letter c of the GDPR);
   • archiving documents, keeping statistics and analyses, and determining and pursuing possible claims or defending against claims related to the conclusion and performance of the Electronic Services Agreement consisting in enabling Customers to place Orders via the Order Form and the conclusion and performance of the Sales Agreement on the terms specified in the Regulations – in such case, the basis for the processing of personal data is the necessity to process data to pursue the legitimate interests of the Seller in the form of archiving documents, keeping statistics and analyses, and determining and pursuing possible claims or defending against them (Article 6, paragraph 1, letter f of the GDPR).
7. The specific purposes of processing personal data indicated in the Review Form are:
   • Performance of the Electronic Services Agreement, which involves enabling Customers to comment on and rate Goods via the Review Form, in accordance with the terms and conditions set out in the Terms and Conditions – in such case, the basis for personal data processing is the necessity of processing personal data for the conclusion and performance of the agreement (Article 6, paragraph 1, letter b of the GDPR), and, with respect to personal data provided optionally, consent (Article 6, paragraph 1, letter a of the GDPR);
   • Archiving documents, maintaining statistics and analyses, and establishing and pursuing potential claims or defending against claims related to the conclusion and performance of the Electronic Services Agreement, which involves enabling Customers to comment on and rate Goods via the Review Form – in such case, the basis for personal data processing is the necessity of processing data for the pursuit of the Seller’s legitimate interests in the form of archiving documents, maintaining statistics and analyses, and establishing, pursuing potential claims or defending against them (Article 6, paragraph 1, letter f of the GDPR).
8. The specific purposes of processing personal data indicated in the Subscription Form are:
   • Performance of the Electronic Services Agreement, which involves enabling Customers to subscribe to the Newsletter via the Subscription Form under the terms and conditions specified in the Terms and Conditions – in such case, the basis for personal data processing is the necessity of processing personal data for the conclusion and performance of the agreement (Article 6, paragraph 1, letter b of the GDPR), and, with respect to personal data provided optionally, consent (Article 6, paragraph 1, letter a of the GDPR);
   • Marketing the Seller’s goods and services and providing other commercial information, as well as disseminating information about promotions, events, and news related to the Seller’s activities – in such case, the basis for personal data processing is the necessity of processing data to pursue the Seller’s legitimate interests in the form of marketing its goods and services, providing other commercial information, and disseminating information about the Seller’s activities (Article 6, paragraph 1, letter f of the GDPR);
   • archiving documents, keeping statistics and analyses, and establishing and pursuing possible claims or defending against claims related to the conclusion and performance of the Electronic Services Agreement consisting in subscribing to the Newsletter via the Subscription Form – in such a case, the basis for personal data processing is the necessity of data processing to pursue the legitimate interests of the Seller in the form of archiving documents, keeping statistics and analyses, and establishing and pursuing possible claims or defending against them (Article 6, paragraph 1, letter f of the GDPR).
9. The specific purposes of processing personal data indicated in the Contact Form are:
   • performance of the Electronic Services Agreement consisting in enabling Customers to send messages to the Seller via the Contact Form under the terms and conditions specified in the Regulations – in such case the basis for the processing of personal data is the necessity to process personal data for the conclusion and performance of the agreement (Article 6, paragraph 1, letter b of the GDPR), and in the scope of personal data provided optionally, the expressed consent (Article 6, paragraph 1, letter a of the GDPR);
   • archiving documents, keeping statistics and analyses, and determining and pursuing possible claims or defending against claims related to the conclusion and performance of the Electronic Services Agreement consisting in enabling Customers to send messages to the Seller via the Contact Form – in such case, the basis for personal data processing is the necessity to process data to pursue the legitimate interests of the Seller in the form of archiving documents, keeping statistics and analyses, and determining and pursuing possible claims or defending against them (Article 6, paragraph 1, letter f of the GDPR).
10. Other specific purposes of personal data processing are:
    • Fulfilling the Seller’s legal obligations related to Data Subjects’ matters, such as reporting disruptions in the Store’s operation or filing a complaint – in such cases, the basis for personal data processing is the necessity to fulfill the Seller’s legal obligations arising from legal provisions (Article 6, paragraph 1, letter c of the GDPR);
    • Contacting Data Subjects in connection with messages and inquiries sent to the Seller – in such cases, the basis for personal data processing is the necessity to process data to pursue the Seller’s legitimate interests in handling messages and inquiries sent by Data Subjects (Article 6, paragraph 1, letter f of the GDPR).
11. Personal data will be processed for the period necessary to achieve the purposes for which they are processed, in particular:
    • For the period during which a relationship justifying such processing exists, in particular for as long as the Account is maintained or for the period necessary to fulfill the Order, as well as to resolve complaints or other types of complaints and requests;
    • for the limitation period for claims against the Seller or the Seller’s claims against the Data Subject arising from legal provisions or the limitation period for tax obligations related to economic events to which the Data Subject was a party, as well as for the duration of mediation, court, arbitration, and similar proceedings related to such claims;
    • for the period necessary to respond to complaints or other types of complaints and requests, generally for a period no longer than 30 days, provided that this period may be extended by the limitation period for claims against the Data Subject or the Seller arising from legal provisions, if processing of such data is necessary to establish or pursue claims, as well as to defend against such claims, and for the periods of related mediation, court, arbitration, and similar proceedings;
    • for the period resulting from regulations imposing certain legal obligations on the Seller;
    • Until the Data Subject objects at any time for reasons relating to their particular situation to the processing of their personal data based on the Seller’s legitimate interest, unless the Seller demonstrates compelling legitimate grounds for processing the personal data that override the interests, rights, and freedoms of the Data Subject or grounds for establishing, pursuing, or defending legal claims;
    • Until consent is withdrawn in the case of personal data processed based on the Data Subject’s consent.
12. Data may be made available by the Seller to the following entities:
    • providers of services provided to the Seller in the scope of maintaining and operating the Store’s website;
    • providers of IT systems used in the creation and maintenance of Accounts or placing Orders;
    • entities processing online payments, in particular entities operating the PayU service;
    • entities providing transportation, freight, postal, forwarding, and logistics services, in particular entities operating the Apaczka logistics service website;
    • entities providing accounting, legal, advisory, auditing, and consulting services; f. public authorities, including courts, at their justified request or if such an obligation arises from legal provisions, or for the purpose of defending or pursuing claims.

XII. Period of processing of Personal Data

Personal data is processed and stored by the Controller for the period necessary to achieve the purposes for which the personal data is processed. Detailed information can be found in the table below.

Purpose of processing	Storage period	Legal basis
Providing services electronically – account management (purchase and sale of match tickets)	Until you cancel your account – send a request to delete it	Article 6(1)(b) of the GDPR – conclusion and performance of the contract
Providing services electronically – maintaining an account (online store)	Until you cancel your account – send a request to delete it	Article 6(1)(b) of the GDPR – conclusion and performance of the contract
Ticket sales, match passes	The ticket sales period for a match and the time of the match. In the case of season tickets – the duration of the football season.	Article 6(1)(b) of the GDPR – conclusion and performance of the contract
Product sales – running an online store (order fulfillment)	Period of obligation to store transaction documentation (bills, receipts, invoices) – 5 years	Article 6 paragraph 1 letter b GDPR – conclusion and performance of the contract Article 6 paragraph 1 letter c GDPR – obligations arising from legal provisions
Conducting analyses, surveys and statistical and marketing measurements (including data analysis and profiling for marketing purposes) of the Controller’s products and services and assessing satisfaction with PW S.A.’s products and services, including tailoring services and products to the User’s needs, analysing and improving services and products and ensuring the security of services	Until you object to the further processing of Personal Data for the purpose of achieving the purpose.	Article 6, paragraph 1, letter f of the GDPR – legitimate interest of the Personal Data Controller
Consideration of complaints and claims (purchase and sale of match tickets)	The period for consideration and consideration of complaints is up to 30 days.	Article 6 paragraph 1 letter f of the GDPR – legitimate interest of the Personal Data Controller Article 6 paragraph 1 letter b of the GDPR – conclusion and performance of the contract
Handling complaints and claims (online store)	Details in Chapter XI of the Policy	Article 6 paragraph 1 letter f of the GDPR – legitimate interest of the Personal Data Controller Article 6 paragraph 1 letter b of the GDPR – conclusion and performance of the contract
Asserting and defending rights in the event of mutual claims	Statute of limitations for claims (3–6 years)	Article 6, paragraph 1, letter f of the GDPR – legitimate interest of the Personal Data Controller
Sending marketing and promotional information about products and services, events and news, including newsletter subscriptions	Until consent is withdrawn.	Article 6, paragraph 1, letter a – consent to the processing of personal data
Sending Users, to the e-mail addresses or telephone numbers provided by them, answers to previously submitted inquiries sent via the contact form, as well as for the purpose of contacting Users and responding to messages and inquiries previously sent by them	Time for consideration and response to the question asked – up to 30 days.	Article 6, paragraph 1, letter f of the GDPR – legitimate interest of the Personal Data Controller
Organization and conduct of competitions and other events by PW S.A.	Competition duration, events.	Article 6, paragraph 1, letter a – consent to the processing of personal data
Ensuring the safety of the organisation of matches and the efficient organisation and conduct of mass events, including the identification of fans	Duration of the match or mass event.	Article 6 paragraph 1 letter f of the GDPR – legitimate interest of the Personal Data Controller Article 6 paragraph 1 letter c of the GDPR – obligations arising from legal provisions
Training activities of the Administrator and entities cooperating with him in the field of systems supporting training and coaching activities	The duration of the contract for conducting training and coaching	Article 6(1)(b) of the GDPR – conclusion and performance of the contract
Maintaining a profile, in particular for the purpose of informing Users about the Administrator’s activity, promoting the Administrator’s websites, promoting various types of events, services and products, as well as for the purpose of communicating with Users via functionalities available in social media and providing answers to short inquiries sent via messengers available on the aforementioned portals	Until you object to the further processing of Personal Data for the purpose of achieving the purpose.	Article 6, paragraph 1, letter f of the GDPR – legitimate interest of the Personal Data Controller

It is not always possible to determine a specific storage period for Personal Data. Therefore, the Controller has specified data storage criteria, which is also permissible under the GDPR.

If Personal Data is processed for the Controller to fulfill its obligations under applicable law, Personal Data is stored and processed for the period specified in applicable law. The data processing period may be extended if processing is necessary to establish, pursue, or defend against potential claims, as well as at the request of competent public authorities, and after this period – only if and to the extent required by law.

After the processing period, Personal Data is irreversibly deleted or irreversibly anonymized.

XIII. Security Principles

PW S.A. has implemented appropriate security measures (organizational and technical) to protect Personal Data against loss, misuse, unlawful processing, or modification. The Controller undertakes to protect all information disclosed by Users in accordance with security and confidentiality standards. Access to Users’ Personal Data has been strictly limited to prevent this information from falling into the hands of unauthorized persons. The Controller conducts ongoing risk analysis to ensure that Personal Data is processed in a lawful and secure manner, ensuring, above all, limited access to Data only to authorized persons and only to the extent necessary for the performance of their duties. The Controller ensures that all operations on Personal Data are recorded and performed only by authorized employees and associates of the Controller.

PW S.A. is authorized to share data with entities authorized under applicable law. The Controller shall take all necessary measures to ensure that its subcontractors and other cooperating entities also guarantee the application of appropriate security measures whenever they process Personal Data on behalf of the Controller.

XIV. Cookies

PW S.A. declares that we use cookies on the website www.kspolonia.pl and other websites belonging to PW S.A. By using this website, you consent to the placement of cookies on your device, as explained below. Cookies used on the website www.kspolonia.pl and other websites belonging to PW S.A. may be set by our website or by a third-party website cooperating with PW S.A. Cookies are used, among other things, for the following purposes:

1. Adapting the content of websites to User preferences and optimizing the use of websites; in particular, these files allow for the recognition of the website user’s device and the proper display of the website, tailored to their individual needs, as well as remembering the history of pages visited on the website and maintaining the User’s session on the website,
2. Creating statistics and analyses that help understand how Website Users use websites, which allows for the improvement of their structure and content,
3. Providing Users with advertising content more tailored to their interests.

Types of cookies used by PW S.A.:

1. “Necessary” cookies, enabling the use of services available on the website, e.g., enabling the use of sessions;
2. “Functional” cookies, enabling the “remembering” of settings selected by the User and personalizing the User interface, e.g., in terms of the selected mobile/desktop version, the last phrases entered by the User, the appearance of the website, etc.;
3. “Analytical” cookies, enabling the monitoring of User activity on the website.

By using the PW S.A. website, the user consents to the installation of cookies. The user may block the storage of cookies by changing the browser settings accordingly. Disabling cookies may affect the operation of the website, and in particular may limit the functionality of the services provided. Failure to change browser settings constitutes acceptance of the use of cookies.

XIV. Change of Policy

Due to technological developments and advances, as well as changing legal regulations, the principles set forth in this Policy are subject to change. Users will be notified of any changes to these principles by posting the new content of this document on the website: www.kspolonia.pl, preceded by an appropriate communication to Users informing them of the changes and their effective date.

In matters not regulated by this Policy, the provisions of the regulations available at www.kspolonia.pl and applicable law shall apply.

The invalidity of any provision of this Policy shall not affect the validity of the remaining provisions or this document as a whole. In such a case, the Administrator shall replace the invalid provision within the scope of the purpose of this document.