Privacy Policy

PRIVACY POLICY

This Privacy Policy sets out the rules for processing personal data obtained through the online store ongschool.com (hereinafter: the “Online Store”).
The owner of the Online Store and the data controller is ONG School Oleksii Nikolaiev, Tax ID No. (NIP) 1231598759, REGON 544160685 (hereinafter: the “Owner”), with its registered office in Chyliczki, 05-510, ul. Łamana.
Personal data collected by the Owner through the Online Store are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation), also known as the GDPR.
The Owner takes particular care to respect the privacy of Customers visiting the Online Store.

§ 1 Types of Data Processed, Purposes and Legal Basis

The Owner collects information concerning natural persons performing legal acts not directly related to their business activity, natural persons conducting business or professional activity in their own name, and natural persons representing legal persons or organisational units without legal personality that have legal capacity under applicable law, collectively referred to below as Customers.
Customers’ personal data are collected in the following cases:
a) registration of an account in the Online Store, in order to create and manage an individual account. Legal basis: necessity for the performance of an agreement for the provision of the Account service (Article 6(1)(b) GDPR);
b) placing an order in the Online Store, in order to perform the agreement. Legal basis: necessity for the performance of the agreement (Article 6(1)(b) GDPR);
c) subscribing to the newsletter, in order to perform an agreement for the provision of an electronically supplied service. Legal basis: consent of the data subject to perform the Newsletter service agreement (Article 6(1)(a) GDPR);
d) using the product availability notification service, in order to perform an electronically supplied service agreement. Legal basis: necessity for the performance of the product availability notification service agreement (Article 6(1)(b) GDPR);
e) using the “post a review” service, in order to perform an agreement for an electronically supplied service. Legal basis: necessity for the performance of the “post a review” service agreement (Article 6(1)(b) GDPR);
f) using the “ask about a product” service, in order to perform an agreement for an electronically supplied service. Legal basis: necessity for the performance of the “ask about a product” service agreement (Article 6(1)(b) GDPR).
When registering an account in the Online Store, the Customer provides an email address.
When registering an account in the Online Store, the Customer sets an individual password for the account. The Customer may change the password later, according to the rules described in § 5.
When placing an order in the Online Store, the Customer provides the following data:
– email address;
– address details: postal code and city, country, street and house/flat number;
– first and last name;
– telephone number.
For Entrepreneurs, the above scope of data is additionally extended to include:
– the Entrepreneur’s company name;
– Tax ID No. (NIP).
When using the Online Store website, additional information may be collected, in particular: the IP address assigned to the Customer’s computer or the external IP address of the internet service provider, domain name, browser type, access time and operating system type.
Navigation data may also be collected from Customers, including information about links and references they choose to click, or other actions taken in the Online Store. Legal basis: legitimate interest (Article 6(1)(f) GDPR), consisting of facilitating the use of electronically supplied services and improving their functionality.
For the purpose of establishing, pursuing and enforcing claims, certain personal data provided by the Customer while using the Online Store’s functions may be processed, such as first name, surname, information concerning use of services, other data necessary to prove the existence of a claim, including the amount of damage incurred. Legal basis: legitimate interest (Article 6(1)(f) GDPR), consisting of establishing, pursuing and enforcing claims, as well as defending against claims before courts and other public authorities.
Providing personal data to the Owner is voluntary in connection with agreements concluded or services provided through the Online Store website. However, failure to provide the data specified above makes it impossible to use electronically supplied services and/or conclude an agreement.

§ 2 Who Receives or Is Entrusted with Data and How Long Are They Retained?

Customers’ personal data are transferred to service providers used by the Owner in operating the Online Store. Depending on contractual arrangements and circumstances, service providers receiving personal data either follow the Owner’s instructions regarding the purposes and methods of processing such data (processors) or independently determine the purposes and methods of processing (controllers).
a) Processors. The Owner uses providers that process personal data solely on the Owner’s instructions. These include, among others, hosting providers, accounting service providers, providers of marketing systems, systems for analysing Online Store traffic and systems for analysing the effectiveness of marketing campaigns.
b) Controllers. The Owner uses providers that do not act solely on the Owner’s instructions and independently determine the purposes and methods of using Customers’ personal data. They provide electronic payment and banking services.
Location. Service providers are established in Poland and other countries of the European Economic Area (EEA).
Customers’ personal data are retained:
a) where consent is the legal basis for processing, until the consent is withdrawn, and thereafter for the limitation period applicable to claims that may be raised by or against the Owner. Unless specific provisions state otherwise, the limitation period is six years, and three years for claims for periodic benefits and claims related to business activity;
b) where performance of an agreement is the legal basis for processing, for as long as necessary to perform the agreement and thereafter for the limitation period applicable to claims. Unless specific provisions state otherwise, the limitation period is six years, and three years for claims for periodic benefits and claims related to business activity.
Where a purchase is made in the Online Store, personal data may be transferred, depending on the Customer’s choice, to the following entities for delivery of the ordered goods:
a) a courier company;
b) InPost Paczkomaty Sp. z o.o., with its registered office in Kraków, providing delivery services and parcel locker system services.
If the Customer chooses payment through the PayU system, their personal data are transferred, to the extent necessary to process the payment, to PayU S.A., with its registered office in Poznań (60-166), ul. Grunwaldzka 182, entered in the register of entrepreneurs maintained by the District Court Poznań–Nowe Miasto and Wilda in Poznań, 8th Commercial Division of the National Court Register, under KRS No. 0000274399.
If the Customer chooses payment through the PayPro system, their personal data are transferred, to the extent necessary to process the payment, to PayPro S.A., with its registered office in Poznań (60-327 Poznań, ul. Kanclerska 15), entered in the register of entrepreneurs maintained by the District Court Poznań–Nowe Miasto and Wilda in Poznań, 8th Commercial Division of the National Court Register, under KRS No. 0000347935; Tax ID No. (NIP): 7792369887, REGON: 301345068.
Navigation data may be used to provide Customers with better service, analyse statistical data, adapt the Online Store to Customers’ preferences and administer the Online Store.
If the Customer subscribes to the newsletter, the Owner will send electronic messages to the Customer’s email address containing commercial information about promotions and new products available in the Online Store.
Upon request, the Owner discloses personal data to authorised public authorities, in particular organisational units of the Public Prosecutor’s Office, the Police, the President of the Personal Data Protection Office, the President of the Office of Competition and Consumer Protection, or the President of the Office of Electronic Communications.

§ 3 Cookies and IP Address Mechanism

The Online Store uses small files known as cookies. They are saved by the Owner on the end device of a person visiting the Online Store if the web browser permits this. A cookie usually contains the name of the domain from which it originates, its “expiry time” and an individual, randomly selected number identifying the file. Information collected using cookies helps tailor the Owner’s products to the individual preferences and actual needs of Online Store visitors. It also enables the preparation of general statistics on visits and products displayed in the Online Store.
The Owner uses two types of cookies:
a) Session cookies: after a browser session ends or the computer is switched off, the stored information is deleted from the device memory. Session cookies do not allow any personal data or confidential information to be obtained from Customers’ computers.
b) Persistent cookies: stored in the Customer’s end-device memory until they are deleted or expire. Persistent cookies do not allow any personal data or confidential information to be obtained from Customers’ computers.
The Owner uses first-party cookies to:
a) authenticate the Customer in the Online Store and provide a Customer session after logging in, so that the Customer does not need to re-enter their login and password on each subpage of the Online Store;
b) conduct analyses, research and audience measurement, in particular to create anonymous statistics that help understand how Customers use the Online Store website, enabling improvement of its structure and content.
The Owner uses third-party cookies to:
a) display multimedia content on Online Store websites obtained from the external website www.youtube.com (third-party cookie controller: Google Ireland Limited, Ireland);
b) display the Reliable Terms and Conditions Certificate via rzetelnyregulamin.pl (third-party cookie controller: Rzetelna Grupa sp. z o.o., Warsaw).
The cookie mechanism is safe for Customers’ computers. In particular, it is not possible for viruses, unwanted software or malicious software to enter Customers’ computers through cookies. However, Customers can restrict or disable cookies in their browsers. If this option is used, the Online Store may still be used, except for functions that by their nature require cookies.
Below are examples of how cookie settings may be changed in popular web browsers:
a) Chrome and Chrome Mobile;
b) Facebook in-app Browser;
c) Internet Explorer;
d) Microsoft Edge;
e) Mozilla Firefox;
f) Opera;
g) Safari and Safari Mobile;
h) Samsung Browser.
The Owner may collect Customers’ IP addresses. An IP address is a number assigned by an internet service provider to the computer of a person visiting the Online Store. The IP number enables internet access. In most cases, it is assigned dynamically, meaning that it changes with each internet connection. The Owner uses the IP address to diagnose technical server problems, create statistical analyses, administer and improve the Online Store, ensure security, and potentially identify unwanted automated programs that place a burden on the server while browsing Online Store content.
The Online Store contains links and references to other websites. The Owner is not responsible for the privacy policies applicable on those websites.

§ 4 Rights of Data Subjects

Right to withdraw consent – legal basis: Article 7(3) GDPR.
a) The Customer has the right to withdraw any consent granted to the Owner;
b) Withdrawal takes effect from the moment consent is withdrawn;
c) Withdrawal does not affect processing carried out lawfully by the Owner before withdrawal;
d) Withdrawal of consent does not entail negative consequences for the Customer, but it may prevent further use of services or functions that the Owner may legally provide only with consent.
Right to object to data processing – legal basis: Article 21 GDPR.
a) The Customer has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data, including profiling, where the Owner processes the data based on legitimate interest, such as marketing the Owner’s products and services, compiling statistics on the use of particular Online Store functions, facilitating use of the Online Store, and conducting satisfaction surveys;
b) Opting out by email from receiving marketing communications concerning products or services constitutes the Customer’s objection to the processing of their personal data, including profiling, for those purposes;
c) If the Customer’s objection is justified and the Owner has no other legal basis for processing personal data, the Customer’s personal data to which the objection relates will be deleted.
Right to erasure (“right to be forgotten”) – legal basis: Article 17 GDPR.
a) The Customer has the right to request the deletion of all or some personal data;
b) The Customer has the right to request deletion where:
– the data are no longer necessary for the purposes for which they were collected or processed;
– the Customer has withdrawn consent on which the processing was based;
– the Customer has objected to the use of their data for marketing purposes;
– the data are processed unlawfully;
– the data must be erased to comply with a legal obligation under EU or Member State law to which the Owner is subject;
– the data were collected in connection with the offering of information society services.
c) Despite a request for erasure due to an objection or withdrawal of consent, the Owner may retain certain personal data where processing is necessary for the establishment, exercise or defence of legal claims or to comply with a legal obligation under EU or Member State law. This applies in particular to first name, surname and email address retained for handling complaints and claims related to the Owner’s services, and additionally to residential/correspondence address and order number retained for handling complaints and claims related to concluded agreements or supplied services.
Right to restriction of processing – legal basis: Article 18 GDPR.
a) The Customer has the right to request restriction of processing of their personal data. Submitting such a request, until it is considered, prevents the use of certain functions or services involving the processing of data covered by the request. The Owner will also not send any communications, including marketing communications.
b) The Customer has the right to request restriction where:
– the Customer contests the accuracy of their personal data, for a period enabling the Owner to verify the accuracy, not exceeding 7 days;
– processing is unlawful and the Customer requests restriction instead of erasure;
– the data are no longer necessary for the purposes for which they were collected or used, but the Customer requires them to establish, exercise or defend claims;
– the Customer has objected to the use of their data, pending verification whether the Customer’s interests, rights and freedoms override the interests pursued by the Controller.
Right of access – legal basis: Article 15 GDPR. The Customer has the right to obtain confirmation from the Controller as to whether personal data are processed and, where that is the case, to access those data, receive information about the processing and obtain a copy of their personal data.
Right to rectification – legal basis: Article 16 GDPR. The Customer has the right to request the immediate rectification of inaccurate personal data and the completion of incomplete data, including by submitting an additional statement to the email address indicated in § 6 of this Privacy Policy.
Right to data portability – legal basis: Article 20 GDPR. The Customer has the right to receive personal data provided to the Controller and transmit them to another controller. The Customer may also request direct transmission where technically feasible. In such a case, the Controller will provide the data in a CSV file, a commonly used machine-readable format.
Where the Customer exercises any of the above rights, the Owner will comply with or refuse the request without undue delay and no later than one month after receiving it. Due to the complexity or number of requests, this period may be extended by a further two months, provided the Customer is informed within one month of receipt of the request of the extension and reasons for it.
The Customer may submit complaints, queries and requests concerning the processing of personal data and the exercise of their rights to the Controller.
The Customer may request a copy of the standard contractual clauses from the Owner by making a request in the manner indicated in § 6 of this Privacy Policy.
The Customer has the right to lodge a complaint with the President of the Personal Data Protection Office concerning infringement of their personal data protection rights or other rights granted under the GDPR.

§ 5 Security Management – Password

The Owner provides Customers with a secure, encrypted connection when personal data are transmitted and when logging in to a Customer Account on the Website.
If a Customer with an Online Store account loses their access password in any way, the Online Store allows a new password to be generated. The Owner does not send password reminders. Passwords are stored in encrypted form, making them unreadable. To generate a new password, enter the email address in the “Forgot your password?” form available next to the Online Store account login form. The Customer will receive an email, sent to the email address provided during registration or saved in the latest account-profile update, with a redirect to a dedicated form on the Online Store website where a new password can be set.
The Owner never sends correspondence, including electronic correspondence, requesting login credentials, in particular the Customer Account password.

§ 6 Changes to the Privacy Policy

This Privacy Policy may be amended. The Owner will inform Customers 7 days in advance.
Questions concerning the Privacy Policy should be sent to: info@ongschool.com
Date of last modification: 9 April 2025.