This policy explains what data is needed to use studniowka.eu, discuss your prom and watch videos. We keep enquiry handling separate from optional external services. You can browse our services without creating an account or providing contact details.
1. Scope and definitions.
The website presents our prom DJ, MC and technical production services. Personal data means information that identifies a person, such as a name, email address or phone number and, in certain circumstances, an IP address. Processing includes receiving, reading, storing and deleting that information.
This policy covers the website, contact form, Google Analytics 4 and enquiries about our services. It does not replace the privacy policies of independent websites linked from this site. We do not use Meta Pixel or a newsletter.
2. Data controller.
The data controller is ZAWODOWI spółka z ograniczoną odpowiedzialnością, a Polish limited liability company with its registered office in Piaseczno: ul. Jana Pawła II 25B/8, 05-500 Piaseczno, Poland. Tax identification number (NIP): 1231495410; REGON: 389174135; KRS: 0000905467. For personal data enquiries, email kontakt@zawodowi.com or write to the address above. Telephone: +48 791 333 221. Studniówka is a brand and project within the Zawodowi group.
The controller has not appointed a data protection officer. Please send any personal data protection enquiries to the controller at kontakt@zawodowi.com.
3. Data we receive.
The form asks for the contact person’s full name, phone number, email address, planned prom date and estimated guest numbers. Any additional message is optional. We do not require the school’s name or town. Later, we may ask for the venue and details needed to prepare a proposal or agreement.
Please do not send national identification numbers, identity documents, health information, payment details or student lists through the form. These are not needed for an initial discussion about your prom. If you contact us on behalf of a committee, school or another person, share only the details needed for the arrangements and make sure you are authorised to provide them.
The server also receives technical request data, such as an IP address, connection time, requested page, response code and information supplied by the browser. We do not use this information to build interest profiles.
4. Purposes and legal bases.
Enquiries and proposals.
When you enquire about a service for yourself or take steps towards entering into a contract as a prospective party, the legal basis is Article 6(1)(b) GDPR. When you contact us as a representative of a school, committee or organisation, or ask a general question, the basis is Article 6(1)(f) GDPR: our legitimate interest in handling correspondence and enquiries.
Contracts, accounting and claims.
Performing a contract is based on Article 6(1)(b) GDPR. Tax and accounting obligations are based on Article 6(1)(c) GDPR together with the relevant legislation. We process the details of contracting parties’ representatives and records needed to establish, pursue or defend claims under Article 6(1)(f) GDPR.
Website security.
Preventing spam, misuse and technical failures, and keeping the website operational, are our legitimate interests under Article 6(1)(f) GDPR. Form safeguards include validation, a honeypot field, a short-lived token and attempt limits. We do not use the external reCAPTCHA service for this purpose.
Optional videos.
The external YouTube player loads only after the user chooses to activate it. Optional access to information on a device is subject to consent under Article 399 of the Polish Electronic Communications Law. Where personal data processing relies on consent, the basis is Article 6(1)(a) GDPR. Access to our services and contact options does not depend on enabling videos.
5. Voluntary provision of data and the contact form.
Providing data is voluntary, but the marked fields are needed to submit this form and respond about your date and event size. You may also contact us directly by email or phone. The form does not save submissions in a separate WordPress entries database; it forwards them to the contact mailbox. The content may subsequently be stored in email systems and their backups.
Sending an enquiry does not subscribe you to a newsletter, give consent to marketing or reserve a date. We do not require an “I agree to GDPR” checkbox to handle an enquiry, as the legal bases are described above. The form’s response reports whether the message was passed to the mail system; it does not prove the message has been read.
6. Retention periods.
- We retain correspondence that does not lead to a contract for one year after the correspondence ends. We then delete it, unless retaining the necessary data is required by law or needed to establish, exercise or defend specific legal claims.
- Contract-related data: for the duration of the contract, then for the period required for accounting and until the applicable limitation periods for claims expire. Any extended retention is limited to the necessary records.
- Tax records: generally until the relevant tax liability limitation period expires, usually five years from the end of the year in which payment fell due, subject to events that suspend or interrupt that period.
- Form tokens: up to two hours. Anti-spam counters based on a hashed IP address: up to 15 minutes. These are held on the server, not in browser cookies.
- dhosting retains website access logs for one month. According to the hosting provider, web error logs are retained for the entire period of service operation. Retention periods for outgoing email logs and backups: [TO COMPLETE after confirmation from dhosting]. A security incident may justify preserving a limited part of the logs while it is investigated.
Deleting data from an active mailbox or system does not necessarily overwrite every backup immediately. Backups expire under the agreed retention schedule and are intended for system recovery, not continued everyday use of deleted correspondence.
7. Recipients and hosting.
Data is used by people authorised to handle enquiries and deliver services. Access may be necessary for the hosting provider, dhosting.pl sp. z o.o., the email provider and technical, accounting or legal service providers, to the extent required for their work. Where a provider processes data on our behalf, appropriate data processing arrangements are required.
The kontakt@zawodowi.com mailbox is hosted by cyber_Folks. The form hosted on dhosting sends messages to the cyber_Folks mail server through an encrypted, authenticated SMTP connection. We do not store copies of sent messages in WordPress. These providers receive the data needed to send, receive and store correspondence. Public authorities may receive data where required by law and a valid request. We do not sell personal data.
8. Cookies, browser storage and Google Analytics 4.
Images, fonts, video thumbnails and local videos are served by our website. Your browser may cache these files to speed up future visits. WordPress may use necessary cookies when you sign in to the administration panel.
Google Analytics 4 starts only after you choose “Accept all” or enable Analytics and save your preferences under “Customise”. Before consent and after refusal, we do not load the Analytics tag or send it measurement signals. Refusal does not restrict access to the website, videos or contact form. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, processing data under Google’s data processing terms.
Analytics helps us understand traffic sources, popular pages and contact activity. Processing is based on consent under Article 6(1)(a) GDPR; storing and accessing information on your device is based on Article 399 of Poland’s Electronic Communications Law. Google receives technical data, including browser and device information, approximate location, the page visited, visit time and a pseudonymous browser identifier. Connecting to Google discloses your IP address; according to GA4 documentation, IP addresses of EEA users are not stored in Analytics. This does not mean that all analytics data is anonymous.
We measure page views, phone and email link clicks, video opening and confirmed submission of an enquiry to the mail system. We do not send names, email addresses, phone numbers or form contents to Analytics. Page URLs sent for measurement exclude query parameters and fragments after #. Automatic form interaction measurement, Google Signals and ad personalisation are disabled. We do not link the service to Google Ads or record sessions. Visits by signed-in WordPress users are excluded from measurement.
After consent, Analytics stores _ga and _ga_WT4RLVW8YM cookies to recognise the browser and measure sessions. Their lifetime is set to a maximum of 180 days, without renewal on every page view. Your acceptance or refusal is stored in localStorage under studniowka_analytics_consent_v1 without an automatic expiry, solely to remember your decision. The banner does not reappear on return visits in the same browser. Clearing site data, another browser, a new private session or a material change in processing purposes may require a new choice. Detailed GA4 event and user data is retained for 2 months, without resetting retention on new activity. This limit does not apply to standard aggregated reports.
You can open “Privacy settings” in the footer and choose “Reject optional cookies” or switch off Analytics and save your settings at any time. Withdrawal stops further measurement, removes accessible Analytics cookies on our domain and reloads the page. It does not affect the lawfulness of earlier processing. You can also delete data in your browser settings. If browser storage is blocked, your choice may not persist between visits.
How Google uses data from partner websites.
9. YouTube and your choice.
Before a video starts, you see a local thumbnail and a button to activate YouTube. Scrolling to the video does not load the YouTube player. The “Play YouTube video” button connects to youtube-nocookie.com. Privacy-enhanced mode limits some player behaviour, but does not mean Google receives no data.
Once enabled, Google may receive your IP address, device information and details of the video, and may use its own storage technologies under its service rules. Google Ireland Limited provides the service to users in the European Economic Area. “Turn off video” removes the player from the current page. You can then choose not to enable it again; deleting data previously stored by the service may require browser or Google account settings. Withdrawing consent does not affect processing that has already taken place.
For details, see Google’s privacy policy. You choose separately each time you activate a player; we do not save a lasting consent preference on your device.
10. Transfers outside the EEA.
We do not send contact form contents to advertising services. Enabling YouTube or consenting to Google Analytics may involve processing outside the EEA, including in the United States. Depending on the recipient and the provider’s current arrangements, transfers may rely on an adequacy decision or standard contractual clauses and supplementary safeguards. You can request information about the applicable mechanism and copies of safeguards from the provider or through us. Polish hosting alone does not mean that no international transfers occur.
11. Your rights.
Subject to the GDPR, you have rights of access and a copy of your data, rectification, erasure, restriction and data portability. Portability concerns data you provided that is processed automatically on the basis of consent or a contract. The right to erasure does not override statutory record-retention obligations.
You may object, on grounds relating to your particular situation, to processing based on legitimate interests. We will then assess whether there are overriding legitimate grounds or a need relating to legal claims. Where processing relies on consent, you may withdraw it at any time.
Send your request to the contact address in the “Data controller” section. We normally respond within one month. For complex requests, this may be extended by a further two months; we will explain the extension and its reasons. We may request information needed to confirm your identity, without asking for excessive details. Requests are generally free of charge, subject to the exceptions in the GDPR.
12. Complaints to the supervisory authority.
If you believe processing infringes data protection law, you can complain to the President of the Polish Personal Data Protection Office (PUODO). Current complaint procedures and contact details are available at uodo.gov.pl. Contacting us first may help resolve the matter, but is not a condition of your right to complain.
13. Profiling, security and minors.
We do not make decisions about users based solely on automated processing that produce legal or similarly significant effects. Anti-spam filters protect the form rather than assess prospective customers. If the form does not work for you, email and telephone contact remain available.
Protecting data requires access controls, software updates, secure email access, backups and encrypted HTTPS connections on the published website. We do not request passwords or payment details through the form. Minors can browse our services; arrangements leading to a contract should be made with an appropriately authorised organiser or representative.
14. Legislation and updates.
We take account of Regulation (EU) 2016/679 (GDPR), the Polish Personal Data Protection Act of 10 May 2018, the Act on Providing Services by Electronic Means of 18 July 2002, and the Electronic Communications Law of 12 July 2024, particularly its provisions on information stored on user devices. A reference only to former Article 173 of the Telecommunications Law does not describe the current cookie rules.
Last updated: 5 October 2026. Changes to tools, providers or processing purposes require an update to this document and, where necessary, renewed consent. Items marked “TO BE COMPLETED” or “TO BE VERIFIED” still require clarification.