Privacy Policy

Version dated 20 September 2026.

1 Controller and contact details

The controller of personal data processed in connection with ires.edu.pl and contact with iRES is Maciej Garczyński, a sole trader operating under the business name Brunavarna Maciej Garczyński, ul. Fryderyka Chopina 43, 58-371 Boguszów-Gorce, Poland, tax identification number (NIP) 7962679760, business identification number (REGON) 145161587.

For personal data matters, contact biuro@ires.edu.pl, telephone +48 789 633 051, or write to the address above. The controller has not appointed a data protection officer.

This policy concerns website visitors and people contacting iRES. If delivering training requires additional personal data, the relevant information will be provided separately before those data are collected.

2 Information we receive

When you use the form or write to us, we receive the information you provide, in particular your name, email address, organisation, subject and message. During correspondence or a conversation, you may also provide a telephone number and other information needed to handle the matter.

Website use may involve processing technical information such as your IP address, connection date and time, requested page, browser and operating system information, and the request outcome. Such information may appear in server logs and website safeguards. The contact-form abuse protection uses a short-lived counter associated with a protected hash of the IP address.

We generally receive data directly from you. If you contact us on behalf of an organisation, we also process information about your role where needed for the correspondence. Please do not send information about others that is unnecessary for handling the matter.

3 Purposes and legal bases

We process data for the following purposes:

• Answering questions and corresponding with you, including organisation representatives: Article 6(1)(f) GDPR. Our legitimate interest is handling enquiries, communicating and discussing cooperation with interested individuals and organisations.
• Taking steps at your request before entering into a contract, or performing a contract to which you are a party as an individual: Article 6(1)(b) GDPR. Contact with a client’s employees or other representatives relies on Article 6(1)(f) GDPR as described above.
• Operating and securing the website, diagnosing errors and limiting spam and abuse: Article 6(1)(f) GDPR. Our interest is maintaining reliable and secure communication and protecting the website and its users.
• Handling complaints and complying with applicable legal duties, such as responding to data rights requests: Article 6(1)(c) GDPR in conjunction with the relevant statutory duty. Other website reports are handled on the basis of our legitimate interest under Article 6(1)(f) GDPR.
• Establishing, exercising or defending legal claims where necessary: Article 6(1)(f) GDPR. Our interest is protecting our rights and documenting relevant arrangements.
• Operating optional consent-based features, where they involve personal data: Article 6(1)(a) GDPR. The Cookie Policy explains information stored on your device, including remembering that the animation has played.

GDPR means Regulation (EU) 2016/679. Handling an ordinary enquiry does not require separate consent to data processing. Sending an enquiry does not constitute consent to a newsletter or unrelated marketing.

4 Providing information

Providing information is voluntary. The form requires your name, a valid email address and a message so that we can handle and answer your enquiry. The organisation and subject fields are optional. Without contact details, we may be unable to reply.

The form is not intended for health information, medical records or other special categories of personal data. If such information is necessary when arranging training, the method of sharing it and the legal basis must be agreed separately.

5 Data recipients

Data may be accessed by authorised people handling enquiries and the website, and by providers of hosting, email, system maintenance and security, to the extent required for their tasks. Where necessary, recipients may also include legal advisers and, when a contract is performed, accounting service providers.

Processors acting on our behalf work under appropriate agreements and instructions. Data may also be provided to competent authorities where required by law. We do not sell information provided in enquiries.

Our Google Analytics provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Measurement data are processed with the involvement of Google and its subprocessors, including Google LLC in the United States.

The website and biuro@ires.edu.pl mailbox use Zenbox hosting and email services. These services are provided by cyber_Folks S.A., ul. Wierzbięcice 1B, 61-569 Poznań, Poland. Under the provider’s data processing terms, entrusted data are processed within the EU or EEA. Correspondence is handled by the controller; authorised people providing operational support may also have access, limited to what is necessary.

6 Retention

We retain enquiries that do not lead to cooperation while handling them and for 12 months after the correspondence ends, to preserve context if discussions resume. We then delete the data unless specific information remains necessary to comply with a legal duty or establish, exercise or defend claims. In that case, further retention is limited to the necessary scope and period. Data relating to a concluded contract are retained during its performance and subsequently in accordance with applicable legal duties and periods relating to claims.

Technical information is kept for the time needed for ongoing diagnostics and security. Information about a particular incident may be retained until it has been investigated and for the time needed to protect claims. The form’s submission-limiting counter has a one-hour validity period; this is not the retention period for messages or all server logs.

Cookie and browser-storage periods are described in the Cookie Policy and the website’s privacy settings.

In Google Analytics 4, event data retention is set to 2 months and user data retention to 14 months. Resetting user data retention on new activity is enabled, so subsequent visits may extend that period. These settings do not limit the availability of most standard reports based on aggregate data. They are separate from browser cookie lifetimes.

Zenbox’s standard backups cover website files, databases and email mailboxes. The provider creates them every 6 hours and keeps them for 7 days. Data deleted from the active mailbox or website may remain in backups until the end of this cycle. Backups are used for recovery following a failure, rather than routine correspondence.

7 Your rights

Subject to the GDPR, you may request access to and a copy of your data, rectification, erasure or restriction of processing. Data portability applies to data processed by automated means on the basis of consent or a contract, within the scope provided by the GDPR.

Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. We will then assess whether compelling legitimate grounds or grounds relating to legal claims justify continued processing.

You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You can change choices concerning optional technologies in the cookie settings.

Send data rights requests to biuro@ires.edu.pl. Where we have reasonable doubts, we may request information necessary to verify your identity. We respond without undue delay, generally within one month. If the GDPR allows an extension because of the complexity or number of requests, we will explain the reasons within that period.

You may complain to the President of Poland’s Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) or, where the GDPR provides, another competent supervisory authority, in particular in the country of your habitual residence, place of work or the alleged infringement. Information about the Polish authority is available at uodo.gov.pl.

8 Processing outside the EEA

Using technical service providers may involve access to data from outside the European Economic Area. Any such transfer must have a basis under Chapter V GDPR, such as a European Commission adequacy decision or appropriate safeguards, including standard contractual clauses together with any required supplementary measures.

You can contact the controller for information about transfers concerning your data, their basis and how to obtain a copy of the safeguards used.

Analytics data may be transferred to the United States. Google identifies the EU–US Data Privacy Framework as a basis for transfers to certified Google LLC; its processing terms also provide for standard contractual clauses where applicable. Google’s transfer frameworks and safeguards are described at https://policies.google.com/privacy/frameworks and its processing terms at https://business.safety.google/adsprocessorterms/.

9 Analytics and automated decisions

The website uses Google Analytics 4 to measure visits, traffic sources and interest in our training offer, and to improve the website. Measurement covers both language versions. The legal basis for processing personal data for statistics is consent under Article 6(1)(a) GDPR. Analytics starts only after consent to the statistics category; refusal does not restrict access to the website.

Measurement may include identifiers stored in cookies, page addresses and titles, referral sources, session timing and activity, approximate location, and device, browser and operating system information. We measure page views, scrolls, outbound clicks and file downloads. Google uses the IP address when receiving data, including to derive approximate location, but according to its GA4 documentation does not log or store IP addresses in Analytics. This does not mean that all other measurement data are anonymous.

We do not send message contents, names or email addresses entered in the contact form to Analytics. We do not use this configuration for remarketing; the website does not use advertising pixels or a newsletter.

You can withdraw consent through the privacy settings available on the website. Withdrawal stops further consent-based measurement but does not automatically erase all previously collected data. You can contact the controller to request erasure, subject to the GDPR.

We do not make decisions about people contacting iRES based solely on automated processing that produce legal or similarly significant effects. We do not use profiling for such decisions.

10 Updates

This policy may change following changes to website operation, services used, the controller’s details or the law. Each version is dated. Information about a new processing purpose will be provided before processing for that purpose begins, in accordance with the GDPR.