1Who is responsible for your data
The controller of personal data collected through the website bawiarenka.com.pl (the “Website”) is K&P Ventures spółka z ograniczoną odpowiedzialnością (limited liability company) with its registered office in Chełmiec, ul. Limanowska 31A, 33-395 Chełmiec, Poland, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for Kraków-Śródmieście in Kraków, 12th Commercial Division of the National Court Register, under KRS number 0001248000, tax ID (NIP) 7343672518, REGON 545011533, share capital PLN 5,000.00 (the “Controller”, “we”). We run the Bawiarenka kids' playroom in Chełmiec.
For any data protection matters, e-mail us at kontakt@bawiarenka.com.pl or write to our registered office. We have not appointed a data protection officer, as we are not required to.
2What data we collect and why
We only collect data you give us yourself, plus basic technical data needed to run and protect the Website.
| Situation | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact form | name, e-mail or phone, topic, message, date, IP address | replying to your message, preparing an offer (e.g. a birthday party) | Art. 6(1)(b) GDPR (steps prior to a contract) and Art. 6(1)(f) (our legitimate interest in handling correspondence) | up to 12 months after the conversation ends, or, if we sign a contract, for its duration and the limitation period for claims |
| Newsletter sign-up (discount pop-up, card on the home page, club in the footer) | e-mail address, website language, sign-up location, consent wording, date and IP of sign-up and confirmation | sending news about our opening, offers and events; delivering the promised discount code | Art. 6(1)(a) GDPR (your consent) in connection with Art. 398 of the Polish Electronic Communications Law | until you withdraw consent (unsubscribe) |
| Proof of consent after unsubscribing | e-mail, consent wording, dates of sign-up, confirmation and unsubscription, IP address | demonstrating that we sent the newsletter lawfully | Art. 6(1)(c) and (f) GDPR (accountability, defence against claims) | up to 3 years after unsubscribing |
| Newsletter statistics | whether an e-mail was opened and which link was clicked | learning which messages are useful and sending fewer e-mails | Art. 6(1)(f) GDPR (legitimate interest) | until you unsubscribe |
| Spam protection | IP address and time of form submission; a fingerprint (hash) of the message or address from which the content cannot be recovered; for submissions classified as spam, also the data entered in the form | blocking bots that mass-submit forms, detecting repeats and, if the filter mistakes a genuine message for spam, being able to find it and reply | Art. 6(1)(f) GDPR (our legitimate interest in keeping the Website secure) | per-IP attempt counter, 24 hours; fingerprints and submissions classified as spam, 30 days |
| Server logs | IP address, date and time, page address, browser and system type | security and troubleshooting | Art. 6(1)(f) GDPR | no longer than 3 months |
Providing data is voluntary, but without an e-mail address we cannot sign you up for the newsletter, and without contact details we cannot reply to your message.
3How the newsletter works
- Double opt-in. After you sign up we send an e-mail with a link. Your subscription is only confirmed once you click it, so nobody can sign you up without your knowledge. Unconfirmed addresses are deleted within 30 days.
- One-click unsubscribe. Every newsletter has an “Unsubscribe” link. You can also e-mail us. Unsubscribing does not affect the lawfulness of earlier mailings.
- Statistics. The newsletter contains an invisible image and links that tell us whether the message was opened and what was clicked. We do not combine this with other data or build profiles. You can avoid it by turning off automatic image loading in your e-mail app.
- Discount codes. If we promise a discount code in the newsletter, we assign it to your address so that it can be used only once and its use can be checked.
4Who we share data with
We do not sell data. We use trusted providers who process data only on our instructions under a data processing agreement (Art. 28 GDPR):
- LH.pl sp. z o.o., Poznań, Poland, website hosting, database and the mailbox we use to send e-mails;
- IT service providers, maintaining and developing the Website, only to the extent needed for that work.
Data may also be disclosed to public authorities where required by law.
The Website uses no analytics, advertising tools or external fonts, all files (including fonts) are loaded from our own server. The only exception is Google Maps on the “Directions & contact” page: when it is shown, Google Ireland Ltd. receives the visitor's IP address; Google may process data outside the EEA based on standard contractual clauses and the EU–US Data Privacy Framework. We ourselves do not transfer data outside the EEA.
5Tickets, passes and bookings
Tickets and passes are sold and bookings are handled in external systems (including Ortosoft), which the buttons on the Website link to. Data you enter there (e.g. when buying or paying) is processed under the terms and privacy policy of that system and of the payment provider. When you go to such a page, you leave our Website.
6Your rights
You have the right to:
- access your data and receive a copy,
- rectify your data,
- erasure,
- restriction of processing,
- data portability (where processing is based on consent or a contract),
- object to processing based on our legitimate interest (e.g. newsletter statistics),
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
To exercise your rights, e-mail kontakt@bawiarenka.com.pl. We will reply without undue delay and within one month at the latest.
You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).
7Children
The Website is aimed at parents and guardians. Forms may only be filled in by adults. We do not knowingly collect children's data, if you mention a child's name or age in a message (e.g. when planning a birthday), we will use it only to prepare an offer.
8Security
The Website works only over an encrypted connection (HTTPS). Data is stored on a server in Poland, and access to the admin panel is protected by a password and a login-attempt limit. We do not make automated decisions about you or profile you within the meaning of the GDPR.
9Cookies
The Website does not store tracking or advertising cookies, only strictly necessary technical entries (e.g. your choice in the cookie window). Details are in our Cookie policy.
10Changes
We update this policy when the way the Website works changes (e.g. we add a new tool). The current version is always available on this page. This version is effective from 10 October 2026. In case of discrepancies, the Polish version prevails.