Privacy Policy

1. General Information

This Privacy Policy sets out the rules for processing and protecting the personal data of people who use the Vertykalna website, including those who purchase services, sign themselves or their child up for classes, contact Vertykalna, or use the forms available on the website.

The Controller exercises due care to ensure that personal data is processed in accordance with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR").

2. Personal Data Controller

The controller of your personal data is:

Szkoła Akrobatyki Vertykalna Sp. z o.o., operating under the name Vertykalna,

• address: ul. Międzyleska 84, Wrocław
• Tax ID (NIP): 8993065640
• e-mail: biuro.vertykalna@gmail.com,
• phone: 733 714 444

For matters concerning the processing of personal data and the exercise of rights under the GDPR, you can contact the Controller using the contact details above.

3. Scope of Processed Data

Depending on how the services are used, the Controller may process in particular:

• first and last name,
• e-mail address,
• phone number,
• home address or billing address, if required,
• data necessary to issue an invoice, including company name, address and tax ID,
• data concerning purchased services, classes, passes or other benefits,
• data of the class participant, including a child's data provided by their parent or legal guardian,
• information necessary to organise and safely conduct classes,
• payment and transaction data,
• the content of correspondence with the Controller,
• technical data related to the use of the website, such as IP address,
• information about the device, browser and cookies.

The Controller processes only the data necessary to achieve specific purposes.

4. Purposes and Legal Bases for Processing

Personal data may be processed for the following purposes:

a) Conclusion and performance of a contract

Data is processed in order to:

• accept sign-ups for classes,
• deliver purchased services,
• handle orders and reservations,
• communicate regarding the delivery of the service,
• handle payments.

The legal basis is Art. 6(1)(b) GDPR – processing is necessary for the conclusion or performance of a contract.

b) Accounting and legal obligations

Data may be processed for the purpose of keeping accounting and tax records, issuing invoices and fulfilling other obligations arising from the law.

The legal basis is Art. 6(1)(c) GDPR – compliance with a legal obligation to which the Controller is subject.

c) Contact with customers

Data provided during contact by phone, e-mail or via the contact form may be processed in order to respond, conduct correspondence and handle the request.

Depending on the nature of the contact, the basis for processing is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR, i.e. the Controller's legitimate interest in communicating with and serving customers.

d) Establishing, exercising and defending claims

Data may be stored and used to the extent necessary to establish, exercise or defend against potential claims.

The legal basis is Art. 6(1)(f) GDPR – the Controller's legitimate interest.

e) Marketing

If the user has given the relevant consent, their contact details may be used to send marketing and commercial information.

The legal basis for processing is Art. 6(1)(a) GDPR – the consent of the data subject, taking into account the applicable provisions on electronic communications.

Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

5. Children's Data and Health Information

In connection with providing sports and educational services, the Controller may process children's data provided by their parents or legal guardians.

To the extent necessary to ensure the safety of a class participant, the Controller may also receive information about their health, e.g. allergies, injuries, contraindications or other circumstances relevant to safe participation in classes.

Health data constitutes a special category of personal data and is processed only where an appropriate legal basis under Art. 9 GDPR exists, in particular on the basis of the explicit consent of the data subject or – in the case of a child – their parent or legal guardian, where such consent is the appropriate basis for processing.

The Controller limits the scope of such information to the data actually needed to ensure the participant's safety and the proper conduct of classes.

6. Electronic Payments

When making a purchase through the website, the user may use the available electronic payment methods.

In connection with processing a payment, the data necessary to carry out and settle the transaction may be transferred to the entity operating the given payment method.

Once payments via the Przelewy24 system are enabled, payments may be handled by PayPro S.A., in accordance with the terms and privacy policy of that operator.

As a rule, the Controller does not receive the full details of the user's payment instrument, such as the full payment card number. The data required to authorise a payment is processed by the relevant payment service provider.

7. Recipients of Personal Data

Personal data may be transferred to entities supporting the Controller in running its business, in particular:

• hosting and IT infrastructure providers,
• software and IT system providers,
• entities maintaining the website,
• providers of sign-up, reservation or sales systems, if used,
• electronic payment operators,
• entities providing accounting services,
• entities providing legal or advisory services,
• e-mail and communication service providers,
• public authorities, where the obligation to transfer data arises from the law.

Entities processing data on behalf of the Controller may process it only to the extent and for the purpose necessary to perform the services entrusted to them.

8. Data Retention Period

Personal data is stored for no longer than is necessary to achieve the purpose for which it was collected.

In particular:

• data related to the performance of a contract – for the duration of the contract, and then for the period necessary to establish or defend against claims,
• accounting and tax records – for the period required by applicable law,
• data processed on the basis of consent – until consent is withdrawn or the purpose of processing ceases,
• data used for marketing – until consent is withdrawn or an effective objection is raised, depending on the basis for processing,
• data related to correspondence – for the period necessary to handle the matter, and then – where justified – for the limitation period of potential claims,
• health data – only for as long as its processing is necessary and an appropriate legal basis exists.

After the relevant period has elapsed, data is deleted or anonymised, unless its further storage is required by law.

9. Rights of Data Subjects

A person whose data is processed has – in the cases specified by the GDPR – the right to:

• access their personal data,
• obtain a copy of their data,
• rectify inaccurate data,
• complete incomplete data,
• erase data ("right to be forgotten"),
• restrict processing,
• data portability,
• object to processing based on the Controller's legitimate interest,
• withdraw consent at any time, where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

To exercise your rights, you can contact the Controller at: biuro.vertykalna@gmail.com

10. Right to Lodge a Complaint

If a data subject believes that their personal data is being processed unlawfully, they have the right to lodge a complaint with the supervisory authority competent for personal data protection.

In Poland, the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

11. Voluntary Provision of Data

Providing personal data is, as a rule, voluntary.

In the case of data necessary to conclude or perform a contract, make a purchase, sign a participant up for classes or issue an accounting document, failure to provide the required data may make it impossible to deliver the given service.

Providing data used for marketing purposes is voluntary and is not a condition of purchasing or using the Controller's services.

12. Automated Decision-Making and Profiling

The Controller does not use personal data to make decisions about users based solely on automated processing which would produce legal effects concerning them or similarly significantly affect them, unless the user is separately informed of such processing.

13. Transfer of Data Outside the European Economic Area

Some IT or technology service providers used by the Controller may process data using infrastructure located outside the European Economic Area.

Where such a transfer takes place, the Controller ensures that the mechanisms required by the GDPR and appropriate for the given data transfer are applied.

14. Cookies

The website uses cookies and similar technologies.

Cookies may be used in particular to:

• ensure the website works correctly,
• remember user settings,
• ensure the security of the website and the purchase process,
• keep statistics and analyse how the website is used – if such tools are used,
• carry out marketing activities – if the user has given the required consent.

Cookies that are not necessary for the website to work correctly are used in accordance with the user's settings and consents, where obtaining them is required by applicable law.

The user can manage cookies via the settings available on the website and the settings of their web browser.

Detailed information on the use of cookies can be found in the Cookie Policy available on the website of the Vertykalna Sports and Education Center.

15. Data Security

The Controller applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration or unauthorised disclosure.

Access to personal data is granted only to persons and entities for whom it is necessary to perform their assigned duties or services.

16. Changes to the Privacy Policy

The Privacy Policy may be updated, in particular in the event of:

• changes in the law,
• changes in how the website operates,
• the introduction of new services,
• a change of service providers,
• the introduction of new payment methods or IT tools.

The current version of the Privacy Policy is published on the Controller's website.

17. Contact

For matters related to personal data protection, you can contact the Controller:

Szkoła Akrobatyki Vertykalna Sp. z o.o.

ul. Międzyleska 84, Wrocław

E-mail: biuro.vertykalna@gmail.com

Phone: 733 714 444

Tax ID (NIP): 8993065640

Last updated: 3 September 2026