Privacy Policy

1. Data controller

The controller of your personal data is [Imię i nazwisko / nazwa firmy], [ulica i numer, kod pocztowy, miejscowość], NIP (tax ID): [NIP], REGON: [REGON] (the “Controller”), who runs the Stacja Transformacja website available at www.stacja-transformacja.pl.

For any matters relating to personal data, you can contact us by email at kontakt@stacja-transformacja.pl, by phone at +48 693 868 577 or in writing at the Controller's address.

2. What data we process

• data entered in the contact form: full name, email address, phone number and – optionally – the content of your message;
• technical information related to your request: the date and time it was sent, the language version of the site and the page the form was sent from;
• data you share with us by email or during a phone call;
• technical data automatically recorded in server logs by our hosting provider, such as IP address, browser type and the date and time of your visit.

Providing your data in the form is voluntary, but we need it to be able to respond to your request.

3. Health data

Please do not include information about your health (e.g. illnesses, injuries or medication) in the contact form. We only collect such information during the consultation, when it is needed to prepare a safe training or nutrition plan – and only with your explicit consent (Article 9(2)(a) GDPR).

4. Purposes and legal bases

• responding to your request, contacting you to arrange a free consultation and presenting our offer – based on the consent you give in the form (Article 6(1)(a) GDPR) and to take steps at your request before entering into a contract (Article 6(1)(b) GDPR);
• sending an automatic confirmation that we have received your request – Article 6(1)(b) GDPR;
• concluding and performing a coaching agreement, if you decide to work with us – Article 6(1)(b) GDPR;
• complying with legal obligations, in particular tax and accounting obligations – Article 6(1)(c) GDPR;
• establishing, pursuing or defending legal claims and keeping the website secure – based on the Controller's legitimate interest (Article 6(1)(f) GDPR).

5. How long we keep your data

• contact form data – until your request has been handled and, if we do not start working together, no longer than 12 months after our last contact or until you withdraw your consent;
• client data – for the duration of our cooperation, and then until any claims become time-barred and for as long as required by tax law (generally 5 years from the end of the tax year);
• server logs – in line with our hosting provider's policy, usually no longer than a few weeks.

6. Who we share data with

Your data may be shared with providers who support us technically and process it on our behalf under data processing agreements:

• Vercel Inc. – website hosting;
• Google (Google Ireland Ltd. and Google LLC) – the Google Sheets spreadsheet where we store requests, and email;
• Resend – the service that sends emails from the contact form;
• our accountant, IT service providers and legal advisers – to the extent necessary for their services.

We do not sell your data or share it with others for marketing purposes.

7. Transfers outside the European Economic Area

Some of our providers (Vercel, Google, Resend) are based in, or use infrastructure in, the United States. Such transfers rely on the European Commission's adequacy decision (the EU–US Data Privacy Framework) for certified companies, or on standard contractual clauses approved by the European Commission. You can request a copy of these safeguards by contacting us.

8. Your rights

You have the right to:

• access your data and receive a copy of it;
• have your data corrected;
• have your data deleted;
• restrict processing;
• data portability;
• object to processing based on the Controller's legitimate interest;
• withdraw your consent at any time – without affecting the lawfulness of processing carried out before the withdrawal;
• lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl).

To exercise your rights, email us at kontakt@stacja-transformacja.pl.

9. Automated decision-making

We do not make automated decisions about you, and we do not use profiling.

10. Cookies and third-party services

The website does not use analytics or marketing cookies. It may only store a strictly necessary cookie that remembers the language version you chose – this does not require consent, as it is needed for a feature you use. You can delete or block cookies at any time in your browser settings.

The fonts used on the site are served from our own server – we do not connect to Google Fonts servers during your visit.

The video in the video section is loaded from an external service (e.g. YouTube) only after you click the play button. From that moment, that service's privacy policy also applies.

If we add analytics or marketing tools in the future, we will update this policy and, where required, ask for your consent.

11. Data security

We use appropriate technical and organisational measures to protect your data, including an encrypted connection (HTTPS) and limiting access to authorised persons only.

12. Changes to this Privacy Policy

We may update this Privacy Policy, for example when the law or the website's features change. The current version is always available on this page, with the date of the last update shown at the top.