Privacy Policy of OgarnijPrawko.pl
Effective from 26 August 2026.
1. Data Controller
The controller of personal data is:
Emabe Mateusz Mączka
ul. Partyzantów 35
05-124 Skrzeszew
Poland
Tax ID (NIP): 9191734716
e-mail: kontakt@ogarnijprawko.pl
For matters relating to personal data protection, you can contact us at kontakt@ogarnijprawko.pl.
2. What data we process
Depending on how the Website is used, we may process, in particular:
- e-mail address and Account data,
- authentication data stored in a secure form,
- test history, results and progress,
- information about purchased access and payments,
- transaction identifiers,
- information about activated access codes,
- IP address and information about the device and browser,
- security-related data and system logs,
- data provided in correspondence,
- for OSK – entity name, Tax ID (NIP), address, contact details, Order history and information about codes,
- data necessary to issue an invoice.
We do not require data which is not necessary for a specific purpose.
3. Purposes and legal bases for processing
We process personal data:
- to create and maintain an Account and provide services – on the basis of Article 6(1)(b) GDPR,
- to process Orders, payments and access activation – on the basis of Article 6(1)(b) GDPR,
- to process OSK Orders and manage codes – on the basis of Article 6(1)(b) GDPR,
- to fulfil tax, accounting and invoicing obligations – on the basis of Article 6(1)(c) GDPR,
- to handle complaints – on the basis of Article 6(1)(b) or (c) GDPR,
- to handle enquiries and correspondence – on the basis of Article 6(1)(b) or (f) GDPR, depending on the matter,
- to ensure Website security, prevent abuse and diagnose errors – on the basis of Article 6(1)(f) GDPR,
- to establish, pursue or defend claims – on the basis of Article 6(1)(f) GDPR,
- where optional analytics or marketing tools requiring consent are used – on the basis of Article 6(1)(a) GDPR.
4. Recipients of data
Data may be disclosed to entities whose services we use to operate the Website, to the extent necessary for the relevant purpose, in particular:
- hosting and IT infrastructure providers,
- e-mail service providers,
- payment service providers,
- accounting and tax service providers,
- software, technical and security service providers,
- analytics providers – only to the extent resulting from the consents granted,
- public authorities where disclosure is required by applicable law.
Processors acting on our behalf operate under appropriate agreements and in accordance with our instructions where required by law.
5. Transfers outside the European Economic Area
If use of a given provider results in personal data being transferred outside the European Economic Area, the transfer takes place only on the basis of mechanisms provided for by the GDPR, in particular an adequacy decision or appropriate safeguards such as Standard Contractual Clauses.
6. Data retention periods
Data associated with an Account is stored for the period during which the Account is used and, after deletion, for the period necessary to comply with legal obligations and to establish, pursue or defend claims.
Data concerning transactions, invoices and settlements is stored for the period required by tax and accounting regulations.
Data concerning complaints is stored for the period necessary to handle the complaint and then for the period applicable to potential claims.
Security logs are stored for a period justified by the need to ensure security, detect abuse and resolve technical issues.
Data processed on the basis of consent is processed until consent is withdrawn or the purpose of processing ceases earlier, subject to the possibility of retaining information necessary to demonstrate the lawfulness of processing.
7. Your rights
Subject to the conditions set out in the GDPR, you have the right to:
- access your personal data,
- rectify your data,
- erase your data,
- restrict processing,
- data portability,
- object to processing based on legitimate interests,
- withdraw consent at any time where processing is based on consent,
- lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
8. Is providing data mandatory?
Providing personal data is voluntary, but in some cases it is necessary to conclude or perform an agreement.
Failure to provide data required to create an Account will make it impossible to create the Account.
Failure to provide data required to process a payment may make it impossible to purchase access.
Failure to provide data required for invoicing will make it impossible to issue an invoice using the requested details.
9. Profiling and automated decision-making
Data concerning progress and results may be processed automatically in order to present the User with results, statistics or to adjust how educational materials are displayed.
Unless the Website implements a different solution in the future, such processing does not result in decisions producing legal effects concerning the User or similarly significantly affecting the User within the meaning of Article 22 GDPR.
10. Security
We apply appropriate organisational and technical measures designed to protect data against loss, unauthorised access, alteration or disclosure.
The scope of safeguards is adjusted to the nature of the data, the manner of processing and the existing risks.
11. Cookies
Information on cookies and similar technologies is provided in a separate Cookie Policy.
12. Changes to the Privacy Policy
This Policy may be updated, in particular, due to changes in law, Website functionalities or the manner in which personal data is processed.
The date of the current version is indicated at the beginning of this document.