Online Sales Privacy Policy of the Tatra Educational Park

I. General provisions

This Privacy Policy sets out the rules for processing personal data in connection with the online sale of tickets, vouchers and other products and services offered by the Tatra Educational Park through the sales widget available on the website www.tpe.edu.pl.

The controller of personal data is:

  • PARK ODSKOCZNIA SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
  • ul. Józefa Piłsudskiego 38
  • 34-500 Zakopane, Poland
  • KRS (National Court Register): 0000294481
  • NIP (Tax ID): 7361663808

operating under the brand "Tatrzański Park Edukacyjny" (Tatra Educational Park), hereinafter referred to as the "Controller" or "TPE".

The Controller can be contacted by e-mail at kontakt@tpe.edu.pl or by phone at 797 378 887.

Online sales are carried out using an e-commerce widget provided and operated by Berg Regions Sp. z o.o., which processes personal data as a processor acting on behalf of the Controller.

Online payments are processed via the external payment operator Autopay.

II. Scope of processed data

In connection with online sales, data provided by the customer during purchase may be processed, in particular:

  • first and last name,
  • e-mail address,
  • phone number, if required to handle the order,
  • order details, including ticket type, purchase date, visit date, transaction amount and transaction identifier,
  • data necessary to handle the online payment,
  • data provided in correspondence regarding the order, a complaint or an inquiry.

The Controller does not process data to a greater extent than is necessary to handle the sale, fulfil the order, contact the customer, carry out settlements, and handle any complaints.

III. Purposes of data processing

Personal data is processed for the purpose of:

  • accepting and handling the order,
  • selling tickets, vouchers or other TPE products and services,
  • generating a purchase confirmation, ticket, QR code or PDF document,
  • handling online payments,
  • contacting the customer regarding the order,
  • handling complaints, comments and inquiries,
  • keeping accounting and tax records,
  • pursuing or defending against potential claims,
  • ensuring the proper functioning of the online sales system.

IV. Legal grounds for data processing

Personal data is processed on the basis of:

  • the necessity to perform a contract or to take steps prior to entering into a contract — regarding the handling of the purchase of a ticket, voucher or other service,
  • a legal obligation imposed on the Controller — regarding accounting and tax settlements,
  • the Controller's legitimate interest — regarding the handling of correspondence, complaints, securing claims, and ensuring the proper functioning of online sales,
  • the consent of the data subject — where such consent has been given in a given case.

Providing the data is voluntary but necessary to make an online purchase and to receive a ticket or purchase confirmation.

V. Recipients of data

Personal data may be disclosed to entities supporting the Controller in handling online sales, in particular:

  • Berg Regions Sp. z o.o. — as the entity operating the sales widget,
  • the online payment operator Autopay — to the extent necessary to process payments,
  • providers of hosting, IT and technical services,
  • entities handling accounting, settlements, legal or administrative assistance,
  • public authorities, where an obligation to disclose data arises from the law.

Personal data is not sold to third parties.

VI. Data retention period

Data related to an online purchase is stored for the period necessary to fulfil the order, handle the ticket, carry out settlements and handle any complaints.

Data related to accounting and tax documents is stored for the period required by law.

Data related to complaints, inquiries or claims may be stored until the matter is closed and for the limitation period of any claims.

Data processed on the basis of consent is stored until the consent is withdrawn, unless another legal basis for further processing exists.

VII. Rights of data subjects

The data subject has the right to:

  • access their data,
  • rectify their data,
  • erase their data,
  • restrict the processing of their data,
  • data portability,
  • object to the processing of their data,
  • withdraw consent, where the data is processed on the basis of consent,
  • lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

To exercise the above rights, please contact the Controller at kontakt@tpe.edu.pl.

VIII. Cookies and technical data

The website and the sales widget may use cookies or similar technologies necessary for the proper functioning of the site, the shopping cart, payments and the purchase process.

Cookies may also be used for statistical or technical purposes, or to improve the operation of the site, where such tools are used.

Users may independently change their cookie settings in their web browser, including blocking cookies from being saved or deleting previously saved cookies.

Restricting the use of cookies may affect the functioning of certain features of the site or the online sales system.

IX. Online payments

If online payment is chosen, the customer may be redirected to a payment system operated by an external payment operator.

Data necessary to process the payment is processed to the extent required to carry out the transaction, confirm it and settle it.

The Controller does not store customers' full payment card data or their online banking login credentials.

X. Data security

The Controller applies appropriate organizational and technical measures aimed at protecting personal data.

Technical maintenance of the online sales system is carried out by an external system provider, which is obliged to apply appropriate safeguards and process data in accordance with the data processing agreement concluded with the Controller.

XI. Final provisions

In matters not regulated by this Privacy Policy, the applicable provisions of law shall apply, in particular the provisions of the GDPR.

The Controller reserves the right to amend the Privacy Policy, in particular in the event of changes to the law, the way the website or the online sales system operates, or the scope of services provided.

The current version of the Privacy Policy is available on the website www.tpe.edu.pl.

This Privacy Policy has been in effect since April 15, 2021, with the update regarding online sales in effect from the launch date of the online sales system.