Privacy policy

Updated: 21 October 2026.

Controller and contact

The controller is Towarzystwo im. Edyty Stein (Edith Stein Society), ul. Nowowiejska 38, 50-315 Wrocław, Poland. For privacy matters and requests concerning your rights, contact biuro@edytastein.org.pl or the postal address above. The Society has not appointed a data protection officer.

Contact and website security

We process contact details and messages to handle correspondence. The legal basis is our legitimate interest in responding to enquiries (Article 6(1)(f) GDPR), or Article 6(1)(b) GDPR for entering into or performing a contract. Providing details is voluntary, but we cannot reply without contact information. Ordinary correspondence is retained for 28 days after the matter is closed.

The server receives technical data including IP address, request time, page address and browser information. Operating and securing the website and diagnosing errors are our legitimate interests (Article 6(1)(f) GDPR). cyber_Folks retains file, database and email backups under 4×4 rotation: the four latest daily and four latest weekly backups. Weekly backups run approximately every seven days and are replaced by subsequent backups; the nominal 28 days is not a maximum retention period. Deleted data may remain in backups until replacement. Previous deletions are reapplied after restoration. The provider has not supplied us with definitive retention periods for WWW, error, email and security logs; information about data processing is available from biuro@edytastein.org.pl.

Event registrations

We collect name, email, telephone number, town and age. The Society requires these details to organise the event, handle registration and contact participants; age also determines eligibility for events with age restrictions. Processing serves registration and participation at the participant’s request (Article 6(1)(b) GDPR). The form cannot be completed without the required details. Registration does not subscribe you to the newsletter.

Registration data is retained for 12 months from submission. The administrator deletes website records and email copies. Guardians register minors; under the adopted organisational procedure, registration by the guardian is sufficient. A guardian attending an event is an ordinary participant. Co-organisers vary by event; participants are informed of recipients and the scope before their data is shared. We do not make solely automated decisions about participants that have legal or similarly significant effects.

Where organising a particular event requires it, necessary data is shared with its co-organisers. Their identity, role and the scope of sharing must be communicated to participants before disclosure. Separate records subject to statutory obligations are retained for the applicable statutory periods. Data needed for specific claims may be retained until the relevant limitation period expires, under Article 6(1)(f) GDPR.

MailerLite provides the optional newsletter service. We use your name and email to send information about our activities and events on the basis of consent (Article 6(1)(a) GDPR), until you withdraw it. Unsubscribe using the link in a message or contact the office. Limited unsubscribe information is retained for 28 days from unsubscribing. The administrator manually deletes unsubscribe information after the agreed 28 days. Newsletter registration requires confirmation via an email link (double opt-in). We track newsletter opens and link clicks.

Consent to marketing cookies enables the MailerLite form to load but does not subscribe you to the newsletter. Unsubscribing and withdrawing cookie consent are separate actions.

Cookies and external services

Optional resources remain disabled before a choice and after rejection. You may accept all, reject them or select categories. Reopen your choice using “Cookie settings” in the footer. Optional resources do not run without JavaScript.

Necessary: our nero_consent cookie records categories, version, time and method of choice for 180 days; it contains no name or email. Administrator login uses technical WordPress cookies.
Functional: Adobe fonts and Google Maps, where a map is provided. With consent, the provider receives connection data such as an IP address. Without consent, fallback fonts and a text address are available.
Analytics: Google Analytics and identifiers including _ga and _ga_* measure website use after consent.
Marketing: YouTube embeds and MailerLite forms and resources may transmit identifiers and activity information to providers after consent.

Google Analytics is used solely for statistics; advertising links are disabled. Retention settings show 2 months for event data and 14 months for user data. New user activity resets the user retention period, so retention may exceed 14 months from the first visit. These settings do not determine cookie lifetimes and do not affect most reports based on aggregated data.

Google Signals is disabled. The _ga and _ga_* cookies have a default lifetime of two years, renewed on subsequent visits. Your browser may limit their actual lifetime.

Optional processing relies on consent (Article 6(1)(a) GDPR), also covering optional access to your device. Withdrawal stops subsequent resource activation and deletes recognised first-party analytics cookies. It does not reverse previous transfers or delete cookies on providers’ domains; you can also manage these in your browser. Withdrawal does not affect the lawfulness of earlier processing. An ordinary external link takes you to a separate service. Images are delivered from our hosting, without the ShortPixel CDN.

Recipients and transfers outside the EEA

Data may be accessed by authorised Society personnel, cyber_Folks hosting and email services, technical support providers and, as required for an event, its co-organisers. With consent to the relevant categories, Google (Analytics, YouTube and any map), Adobe Fonts and MailerLite also receive connection and activity data. External services may process data for their own purposes described in their policies. Google and Adobe describe processing outside the EEA, including in the USA. Google identifies the EU–US Data Privacy Framework for covered US transfers and Standard Contractual Clauses in other applicable cases; Adobe describes safeguards including Standard Contractual Clauses and adequacy decisions. MailerLite states that subscriber data of customers served by its Irish entity is stored in the EU; scope depends on account terms. Contact our office for information about recipients and safeguards relating to your data.

Provider policies: Google, Adobe Fonts, MailerLite.

Your rights

Subject to GDPR conditions, you may request access, rectification, erasure, restriction and portability of data processed automatically on the basis of consent or contract. You may object to processing based on legitimate interests and withdraw consent. Contact the office; we may request information necessary to verify your identity. You may complain to the President of Poland’s Personal Data Protection Office: uodo.gov.pl.

Google — data transfers · Adobe — data transfers · MailerLite — DPA