Privacy Policy

The Administrator
The administrator of personal data within the meaning of the General Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (“GDPR”) is Agencja Reklamowa Storm, entered into the registry of businesses, with its registered seat in Warsaw (postal code: 04-129), ul. Sulejkowska 25/12, tax identification number (NIP): 125-00394- 23 (“Administrator”).
When registering, the user should consent to the placement of his / her personal data in the Administrator’s database and for their processing for the purposes of contract performance (consent is done by checking the appropriate box during registration). Providing personal data by the user is voluntary, but the lack of consent to their processing prevents participation in the event.
The Administrator each time defines the data that is necessary to provide services electronically. The Administrator may process the following personal data the catalogue of which may change depending on the type of services provided: surname and first names; address of residence or stay; mailing address; e-mail address; landline or mobile number; sex; date of birth.

Data recipients
Your personal data may be made available to our business partners, i.e. companies with whom we cooperate, including: presenting, describing and combining their products or services.
In addition, your data may be passed on to our subcontractors (processing entities), e.g. accounting and legal firms, service providers, marketing agencies, data processors for collection of receivables, shipping companies, where such entities process data on the basis of an appropriate agreement with the Administrator.

The purpose of data processing and its legal basis your data can be processed:
For the purposes of the conclusion and performance of the contract (participation in the run) and provision of services in accordance with the contract: organization of the run, publication of data on start lists and lists of results, handling the payment system, transmission of organizational information on the run and accompanying events, administration of notifications of registered persons and contact with participants, consideration of complaints and complaints (basis for processing: necessity of data processing to conclude and execute the contract, and in some cases also legitimate interest of the controller).
For marketing purposes of the Administrator (legal basis: consent granted, and in some cases justified by the controller’s interest, marketing of own products and services using electronic communication means, due to other applicable regulations, in particular the Telecommunications Law and the Act on the Provision of Electronic Services, only takes place based on your consents).
For marketing purposes, including analytical purposes of third parties, including the Administrator’s partners (legal basis: consent granted, in the event of failure to provide personal data are not processed for this purpose).
For archival (proof) purposes of the legal need to prove facts (legal basis: necessity of processing for the legitimate interest of the controller).
Arrangements, investigations or defences against claims (legal basis: necessity of processing for the legitimate interest of the controller).

Data storage period
Regardless of the processing basis, according to which we process your personal data, we will keep it until the claims under the contract are time-barred or until the obligation to store data resulting from the law, in particular the obligation to keep accounting documents regarding the contract, expires. Where we process personal data based on the justified interests of the Administrator, personal data will not be processed for a particular purpose if you object to such processing.

Rights of the person to whom the data relates
You have the right to access your data and the right to request rectification, deletion and processing restrictions. If the basis for the processing of your personal data is the legitimate interest of the Administrator, you can object to the processing of your personal data. In particular, you have the right to object to the processing for the purposes of direct marketing.
To the extent that the basis for the processing of your personal data is consent, you have the right to withdraw your consent. Withdrawal of consent does not affect the lawfulness of the processing which was made on the basis of consent before its withdrawal.
To the extent that your data is processed in order to conclude and perform the contract or processed on the basis of consent, you also have the right to transfer your personal data.
It is also the right to lodge a complaint with the supervisory body (the President of the Office for Personal Data Protection) dealing with the protection of personal data, when you believe that the processing of your personal data violates the provisions of the GDPR.

Organizational measures taken to secure personal data

Each person having access to data has been acquainted with the principles of secure data processing resulting from this Policy and the Management Instructions.
Initial and periodic training is conducted for persons authorized to process personal data.
Only authorized persons have access to computers on which personal data are processed.
Access to personal data being processed is only available to persons who have been issued with personal authorizations to process them to the relevant extent.
Persons having access to personal data are obliged, under this Policy, to keep personal data and information on how to protect it secretly.
The obligaton to keep personal data confidential and how to secure it is also done through the receipt of the written declarations from persons authorized to process personal data.
A register of persons authorized to process personal data is kept.