Privacy Policy

Who is the controller of your personal data?

The data controller within the meaning of Article 4(7) GDPR is Gopesi, operating at Redłowska 50A, Gdynia, Poland. You may contact us regarding any data protection matter at: [email protected] or by post at the address above. We do not have a designated Data Protection Officer, as we do not fall within the categories of organisations for which this appointment is mandatory under Article 37 GDPR, given the nature and scale of our processing activities. However, queries addressed to the email above are handled by the person responsible for data compliance within our organisation.

What personal data do we collect, and from which sources?

We collect personal data directly from you when you voluntarily provide it through the contact form on this website. The categories of data collected via the contact form include: your full name, email address, telephone number, and the content of your message. We do not collect sensitive personal data (special categories under Article 9 GDPR) through this website. We do not purchase or obtain personal data from third-party data brokers. Separately, our website may automatically collect certain technical data when you visit — such as your IP address, browser type, operating system, referring URL, and pages visited — through server logs or analytics tools, subject to your cookie preferences. The technical data described above is not used to identify you individually unless required for security purposes.

Why do we use your data, and on what legal basis?

The personal data submitted through the contact form is processed for the purpose of responding to your enquiry. The legal basis for this processing is Article 6(1)(b) GDPR — processing necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract — and/or Article 6(1)(f) GDPR — processing necessary for the purposes of the legitimate interests pursued by Gopesi, specifically our interest in communicating with individuals who contact us with questions about our educational content.

Technical and analytical data collected through cookies is processed on the basis of your consent (Article 6(1)(a) GDPR), as obtained through our cookie consent mechanism. You may withdraw consent for non-essential cookies at any time via the cookie settings accessible on this site.

We do not use your personal data for automated decision-making or profiling within the meaning of Article 22 GDPR.

How long do we keep your data?

Personal data submitted via the contact form is retained for a period of no longer than 24 months from the date of your last contact with us, unless a longer retention period is required by applicable law or is necessary to resolve any dispute arising from your enquiry. Technical log data is typically retained for a shorter period consistent with operational security needs, generally not exceeding 90 days. After the applicable retention period, data is securely deleted or anonymised.

Do we share your data with other parties?

We do not sell your personal data. We may share your data with third-party service providers who process data on our behalf as data processors within the meaning of Article 4(8) GDPR. These may include our email hosting provider and website hosting infrastructure provider. Any such processors are bound by data processing agreements that require them to protect your data and process it only on our documented instructions, in accordance with Article 28 GDPR.

If our hosting or email infrastructure is located outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses adopted pursuant to Article 46(2)(c) GDPR, or an adequacy decision applicable to the destination country.

We may disclose your data if required to do so by law, court order, or competent public authority, including the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO).

What rights do you have over your personal data?

Under the GDPR, you have the following rights with respect to your personal data held by us:

Right of access (Article 15 GDPR): You may request confirmation of whether we process data about you and obtain a copy of that data.

Right to rectification (Article 16 GDPR): You may request correction of inaccurate or incomplete data.

Right to erasure (Article 17 GDPR): You may request deletion of your data in certain circumstances, including where the data is no longer necessary for the purpose for which it was collected.

Right to restriction of processing (Article 18 GDPR): You may request that we restrict processing of your data in certain circumstances.

Right to data portability (Article 20 GDPR): Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, commonly used, machine-readable format.

Right to object (Article 21 GDPR): Where processing is based on legitimate interests, you may object to processing on grounds relating to your particular situation.

Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at [email protected]. We will respond within the timeframes required by the GDPR (generally within one month, extendable by two further months in complex cases). You also have the right to lodge a complaint with the supervisory authority — in Poland, this is the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl.

How do we protect your data?

We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction, consistent with Article 32 GDPR. These measures include use of HTTPS encryption for data in transit and access controls limiting who within our organisation can access contact form submissions. No method of electronic transmission or storage is entirely secure, but we apply reasonable and proportionate safeguards consistent with the nature of the data processed.

Does this site use cookies?

Yes. This website uses cookies and similar tracking technologies. For detailed information about which cookies we use, their purpose, and how to manage your preferences, please refer to our Cookie Policy. Your consent to non-essential cookies is obtained through our cookie consent mechanism and can be modified at any time.

Can this policy change?

We may update this Privacy Policy from time to time to reflect changes in our processing activities, applicable law, or regulatory guidance. The most current version will always be available at gopesi.info/privacy.html with the date of the most recent update indicated at the top. For significant changes, we will take reasonable steps to notify visitors, such as placing a notice on the website. We encourage you to review this policy periodically.