Contact Privacy Notice

Version dated 20 September 2026.

This notice covers information submitted through the iRES contact form and subsequent correspondence relating to your enquiry.

1 Controller

The controller is Maciej Garczyński, a sole trader operating under the business name Brunavarna Maciej Garczyński, ul. Fryderyka Chopina 43, 58-371 Boguszów-Gorce, Poland, tax identification number (NIP) 7962679760, business identification number (REGON) 145161587.

Contact: biuro@ires.edu.pl, +48 789 633 051, or by post at the address above. The controller has not appointed a data protection officer.

2 Information and purposes

We process your name, email address, the organisation you provide, the subject and message, and other information you voluntarily share in connection with the matter. We use the data to reply, correspond with you and discuss possible cooperation.

Ordinary enquiries and contact with organisation representatives rely on Article 6(1)(f) GDPR: our legitimate interest in communicating with and assisting people interested in our services. If you act as an individual on your own behalf and the contact concerns steps taken at your request before entering into a contract, or performance of a contract to which you are a party, the basis is Article 6(1)(b) GDPR.

Data may also be used to comply with applicable legal duties, including handling data rights requests, under Article 6(1)(c) GDPR, and to establish, exercise or defend claims under Article 6(1)(f) GDPR. In the latter case, our interest is protecting our rights and documenting arrangements.

Form protection uses technical data, including a short-lived counter associated with a protected hash of the IP address. The basis is Article 6(1)(f) GDPR and the controller’s interest is protection against spam and abuse.

GDPR means Regulation (EU) 2016/679. Sending an enquiry does not constitute consent to a newsletter or marketing unrelated to that enquiry.

3 Recipients and transfers

Data may be accessed by authorised people handling correspondence, hosting, email and technical service providers and, where necessary, legal advisers. Competent authorities may also receive data where required by law. Processors acting on our behalf work under appropriate agreements and instructions.

If using service providers involves transferring data outside the European Economic Area, a basis under Chapter V GDPR is required, such as a European Commission adequacy decision or appropriate safeguards, including standard contractual clauses together with any required supplementary measures. You can contact the controller for information about transfers concerning your data and a copy of the safeguards used.

The website and biuro@ires.edu.pl mailbox use Zenbox hosting and email services. These services are provided by cyber_Folks S.A., ul. Wierzbięcice 1B, 61-569 Poznań, Poland. Under the provider’s data processing terms, entrusted data are processed within the EU or EEA. Correspondence is handled by the controller; authorised people providing operational support may also have access, limited to what is necessary.

4 Retention

We retain enquiries that do not lead to cooperation while handling them and for 12 months after the correspondence ends, to preserve context if discussions resume. We then delete the data unless specific information remains necessary to comply with a legal duty or establish, exercise or defend claims. In that case, further retention is limited to the necessary scope and period. Data relating to a concluded contract are retained during its performance and subsequently in accordance with applicable legal duties and periods relating to claims.

The form’s submission-limiting counter has a one-hour validity period. Messages and technical server logs have separate retention periods described in the Privacy Policy.

5 Your rights

Subject to the GDPR, you have rights of access to and a copy of your data, rectification, erasure and restriction of processing. Data portability applies where processing is automated and based on consent or a contract, within the GDPR’s scope.

You may object on grounds relating to your particular situation to processing based on legitimate interests. The controller will then assess whether compelling grounds or grounds relating to claims justify continued processing.

Send requests to biuro@ires.edu.pl. You may also complain to the President of Poland’s Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) or another competent supervisory authority under the GDPR, in particular in the country of your habitual residence, place of work or the alleged infringement. Information about the Polish authority is available at uodo.gov.pl.

6 Voluntary provision and automated decisions

Providing data is voluntary. The form requires your name, a valid email address and a message; it cannot be submitted without them. The organisation and subject fields are optional. You can also contact us directly.

Do not use the form to send health information, medical records or other special categories of personal data. We do not use submitted information to make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you.

Website visit statistics in Google Analytics 4 are a separate processing purpose and require statistics consent. Sending an enquiry does not constitute such consent. Details are provided in the Privacy Policy and Cookie Policy.