Privacy Policy

1. Data Controller

The data controller for this website is Fundacja Pracownia Zjawisk Audiowizualnych, seated in Wrocław (54-205), Poland, at ul. Legnicka 65B, registered in the register of associations, other social and professional organisations, foundations and independent public healthcare institutions of the National Court Register (KRS) under number KRS 0001265495, NIP (Tax ID) 8943294479, REGON 545690014.

Contact the controller regarding personal data protection: [email protected].

2. Purposes and Legal Bases of Processing

We process personal data in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) for the following purposes:

1. Handling correspondence and enquiries:

   • Scope: Name, email address, and any personal information provided within correspondence sent to us.
   • Legal basis: Article 6(1)(f) GDPR (legitimate interest of the controller in responding to received communications and maintaining ongoing correspondence).
   • Retention: Stored for the duration necessary to handle the matter, and subsequently for any applicable statutory limitation period or statutory record-keeping period.

2. Newsletter distribution:

   • Scope: Email address.
   • Legal basis: Article 6(1)(a) GDPR (voluntary consent given by submitting your email in the signup form and confirming subscription via double opt-in).
   • Retention: Processed until consent is withdrawn (unsubscribing). You can withdraw your consent at any time by clicking the “Unsubscribe” link in the footer of any newsletter email or by contacting us at [email protected].

3. Security, integrity, and hosting infrastructure:

   • Scope: Technical log information including IP address, access timestamp, browser type, and operating system collected by server and CDN network logs.
   • Legal basis: Article 6(1)(f) GDPR (legitimate interest in protecting against DDoS attacks, network abuse, and ensuring website uptime).
   • Retention: Kept for temporary operational and security review periods per infrastructure provider policies.

3. Data Recipients and Transfers Outside the EEA

To operate the site reliably, we work with trusted external service providers (data processors):

1. Newsletter service provider – Kit (ConvertKit LLC):

   • Newsletter list management and automated mail delivery are provided by ConvertKit LLC (750 W Bannock St #761, Boise, ID 83701, USA).
   • Data transfer to the United States takes place under the European Commission’s EU-US Data Privacy Framework or Standard Contractual Clauses (SCC) approved by the European Commission.

2. Hosting and CDN provider – Cloudflare, Inc.:

   • The website is deployed and delivered across the global network of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Data transfers occur pursuant to the EU-US Data Privacy Framework and Standard Contractual Clauses.

Personal data is never sold or shared with third parties for commercial or marketing purposes.

4. Local Storage and Cookies

1. LocalStorage:

   • This site uses browser localStorage solely for a single, strictly functional purpose: remembering your visual theme choice (light or dark mode) under the key pza-theme.
   • This item contains no personal or identifying data and is never transmitted to our servers.

2. Cookies and analytics:

   • Currently, this site does not deploy third-party advertising or tracking cookies.
   • If external analytics (such as Google Analytics) or measurement tools are deployed in the future, they will operate strictly on the basis of prior explicit user consent gathered via a compliant consent mechanism.

5. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

• Right of access and to obtain a copy of your personal data (Article 15 GDPR).
• Right to rectification of inaccurate or incomplete data (Article 16 GDPR).
• Right to erasure (“right to be forgotten”, Article 17 GDPR).
• Right to restriction of processing (Article 18 GDPR).
• Right to data portability (Article 20 GDPR).
• Right to object to processing based on Article 6(1)(f) GDPR (Article 21 GDPR).
• Right to withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal (applicable to newsletter signups).

To exercise these rights, please contact us at: [email protected].

You also have the right to lodge a complaint with a supervisory authority, in particular the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) in Poland, ul. Stawki 2, 00-193 Warsaw.

6. Automated Decision-Making and Profiling

Your personal data is not subject to automated decision-making or profiling within the meaning of Article 22(1) and (4) of the GDPR.

7. Changes to this Policy

This Privacy Policy is effective as of its publication date. We reserve the right to update this policy if required by amendments to legal regulations or changes in our services.