# 1: Who is the controller of your personal data?

The administrator of your personal data is B-Active Association, ul. Różana 16, 32-640 Zator, NIP: 5492450012, KRS: 0000717874, registered in the District Court Kraków-Śródmieście in Kraków, 12th Economic Division of the National Court Register.

# 2: Who can you contact regarding the processing of your personal data?

As part of the implementation of data protection in our organization, we have decided not to appoint a data protection officer due to the fact that it is not mandatory in our situation. In matters relating to data protection and privacy in general, you can contact kontakt@b-active.pl

# 3: What information do we have about you?

Depending on the purpose, we may process the following information about you:

  • Name and surname,
  • e-mail address,
  • phone number,
  • data contained in correspondence sent to us,
  • details of the events we organise in which you participate including your start number and result,
  • IP address,
  • activity in relation to messages sent as part of the newsletter,
  • information about the operating system and the web browser you are using,
  • reviewed subpages,
  • time spent on the site,
  • transitions between individual subpages,
  • clicks on individual links,
  • The source from which you access our site,
  • the age range you are in,
  • your gender,
  • your approximate location limited to towns,
  • Your interests determined by your online activities.

We have described the scope of data processing precisely for each purpose of processing. Information in this regard can be found later in this policy.

# 4: How do we obtain your personal information?

Most of the time, you give this to us yourself. This happens when:

  • you register for the XCM CST 7R GDYNIA cycling marathon,
  • you sign up for the newsletter,
  • you contact us.

In addition, some information about you may be automatically collected by the tools we use:

  • the website and newsletter system processes note your IP address,
  • Google Analytics collects a range of information about how you use our site,
  • Cloudflare collects a range of information about how you use our site, protects the server from external attacks, collects data for statistical analysis.

# 5: Is your data safe?

We care about the security of your personal information. We have analysed the risks involved in the various stages of processing your data and then implemented appropriate security and data protection measures. We constantly monitor the condition of our technical infrastructure, train our staff, look at the procedures used and introduce necessary improvements. If you have any questions about your personal data, we are at your disposal at kontakt@b-active.pl

# 6: For what purposes do we process your personal data?

These goals are more than one. They are listed below, followed by a more detailed explanation. We have also assigned the appropriate legal grounds for processing to the individual objectives.

  • handling event registration – Article 6(1)(b) of the RODO,
  • handling of complaints – Article 6(1)(f) of the RODO,
  • dispatch of newsletters – Article 6(1)(a) of the RODO,
  • handling of correspondence – Article 6(1)(f) of the RODO,
  • creation of an archive for the possible need to defend, establish or assert claims, as well as for the identification of a returning customer – Article 6(1)(f) RODO,
  • internal marketing – Article 6(1)(f) of the RODO,
  • analysis, statistics and optimisation – Article 6(1)(f) RODO.

# 7: How long will we keep your personal information?

Data retention periods are indicated separately for each purpose of processing. You will find this information within the details dedicated to each separate processing purpose.

# 8: Who are the recipients of your personal data?

We would venture to say that modern business cannot do without third party services. We also use such services. Some of these services involve the processing of your personal data. Third party service providers who are involved in the processing of your personal data are:

  • the hosting provider that stores the data on the server,
  • a cloud service provider where backups that may contain your personal information are stored,
  • the mailing system provider, where your data are stored if you are a newsletter subscriber,
  • a law firm that can access the data if it is necessary to provide legal assistance to us,
  • the entity providing registration services for events organized by us,
  • a maintenance service provider who gains access to the data if the technical work carried out concerns areas where personal data are located,
  • other subcontractors who gain access to the data if the scope of their activities requires such access.

In addition, if necessary, your personal data may be made available to entities, authorities or institutions entitled to obtain access to data under the law, such as police services, security, courts, prosecutors.

Furthermore, we use tools that collect a range of information about you in relation to your use of our site. This includes, in particular, the following information:

  • information about the operating system and the web browser you are using,
  • reviewed subpages,
  • time spent on the site,
  • transitions between individual subpages,
  • clicks on individual links,
  • the source from which you access our site,
  • the age range you are in,
  • your gender,
  • your approximate location limited to towns.
  • your interests as determined by your online activities.

Because this information is collected by the third-party tools we use, the information is also processed by the tool providers within the constraints of their terms of use and privacy policies. Generally, this information is used to provide, improve and manage our services, develop new services, measure the effectiveness of advertising, protect against fraud and abuse, and personalize the content and advertising displayed on individual services, sites and applications.

We have tried to describe the details in this regard later in this policy as part of the tool-specific explanations.

# 9: Do we transfer your data to third countries or international organisations?

Yes, some of the processing of your personal data may involve the transfer of your personal data to third countries.

We transfer your personal data to third countries in connection with the use of tools that store personal data on servers located in third countries, in particular the USA. Providers of these tools guarantee a sufficient level of protection of personal data through appropriate compliance mechanisms provided for by the RODO, in particular by subscribing to the Privacy Shield program or using standard contractual clauses.

The storage of personal data on servers located in third countries occurs within the following tools:

  • mailChimp mailing system, whose provider is Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA – regarding your name, email address, IP address and statistical information related to your response to messages sent by us,
  • Google services as part of the G-Suite, whose provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – to the extent of all data processed by Google services, including those data contained in files subject to synchronization with Google Drive. 

Both Rocket Science Group LLC and Google Ireland Limited ensure a sufficient level of protection of personal data by applying the compliance mechanisms provided for by RODO, in particular by joining the Privacy Shield program. Below are links leading to confirmations of participation in the Privacy Shield program, where you can read information about the processing of personal data by these entities.

  • Google: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI,
  • MailChimp: https://www.privacyshield.gov/participant?id=a2zt0000000TO6hAAG.

We would also like to remind you here that we use external tools that may collect anonymous information about you. We have mentioned this several times within this policy, including in response to the previous question. The providers of these tools often use servers located around the world, particularly in the United States of America (USA), to store the information they collect.

# 10: Do we use profiling? Do we make automated decisions based on your personal information?

We do not make decisions about you based solely on automated processing, including profiling, which would produce legal effects or similarly significantly affect you.

Yes, we do use tools that may take certain actions depending on the information collected by the tracking mechanisms, but we believe that these actions do not have a material impact on you because they do not differentiate your situation as a customer, do not affect the terms of the contract you may enter into with us, etc.

By using certain tools, we may, for example, target you with personalized advertising based on your past activities on our site or suggest events of interest to you.

We do not collate the information indicated above with your personal information held in our databases. This information is anonymous and does not allow us to identify you. This information is stored on the servers of the providers of the individual tools, and these servers can usually be located around the world.

# 11: What rights do you have in relation to the processing of your personal data?

The RODO grants you the following potential rights in relation to the processing of your personal data:

  • the right to access your data and to receive a copy of it,
  • the right to rectify (amend) your data,
  • the right to erasure (if you believe there is no basis for us to process your data, you can request that we erase it),
  • the right to restrict processing (you can request that we restrict processing to only storing the data or carrying out activities agreed with you, if in your opinion we have incorrect data or are processing it unfairly),
  • the right to object to processing (you have the right to object to processing on the basis of a legitimate interest; you should indicate the particular situation which, in your opinion, justifies us stopping the processing covered by the objection; we will stop processing your data for these purposes unless we demonstrate that the grounds for our processing override your rights or that your data are necessary for us to establish, assert or defend our claims),
  • the right to data portability (you have the right to receive from us in a structured, commonly used machine-readable format the personal data you have provided to us under the contract or your consent; you can have these data sent directly to another entity),
  • the right to withdraw consent to the processing of personal data, if you have previously given such consent, the right to lodge a complaint to the supervisory authority (if you find that we process data unlawfully, you can lodge a complaint to the President of the Office for Personal Data Protection or other competent supervisory authority). 

The rules related to the exercise of the aforementioned rights have been described in detail in Arts. 16 - 21 RODO. We encourage you to familiarise yourself with these regulations. For our part, we consider it necessary to clarify to you that the rights indicated above are not absolute and will not be available to you in relation to all processing activities of your personal data.

We would like to emphasize that one of the above-mentioned rights is always available to you – if you believe that we have violated data protection regulations while processing your personal data, you can lodge a complaint to the supervisory authority (President of the Office for Personal Data Protection).

You can also always ask us to provide you with information on what data we hold about you and for what purposes we process them. Just send an email to kontakt@b-active.pl. However, we have made every effort to ensure that the information you are interested in is comprehensively set out in this privacy policy. You can also use the e-mail address given above if you have any questions regarding the processing of your personal data. 

# 12: Do we use cookies and what exactly are they?

Our website, like almost all other websites, uses cookies.

Cookies are small pieces of text information stored on your terminal device (e.g. computer, tablet, smartphone), which can be read by our ICT system (our own cookies) or by third party ICT systems (third party cookies). Certain information can be recorded and stored in cookies, to which information and communication systems can then obtain

access for specific purposes.

Some of the cookies we use are deleted when the browser session ends, i.e. when you close your browser (so-called session cookies). Other cookies are stored on your terminal device and allow us to recognize your browser the next time you visit the site (persistent cookies).

If you would like to find out more about cookies as such you can, for example, read this: https://pl.wikipedia.org/wiki/HTTP_cookie.

# 13: On what basis do we use cookies?

We use cookies on the basis of your consent, except if the cookies are necessary for the proper provision of electronic services to you.

As far as your consent to cookies is concerned, we accept the option that you give such consent through the settings of your web browser or additional software that supports the management of cookies. We assume that you agree to all cookies used by us that are not blocked by your browser or the additional software you use.

Please note that disabling or restricting cookies may prevent you from using some of the features available on our website and may cause difficulties in using our website, as well as many other websites that use cookies. For example, if you block social media plug-in cookies, the buttons, widgets and social features implemented on our site may

be unavailable to you.

# 14: Can you disable cookies?

Yes, you can manage your cookie settings within your web browser. You can block all or selected cookies. You can also block cookies from specific sites. You can also delete previously saved cookies and other site and plug-in data at any time.

Web browsers also offer the ability to use an incognito mode. You can use this if you don't want information about pages visited and downloaded files to be stored in your browsing and download history. Cookies created in incognito mode are deleted when you close all incognito mode windows. 

There are also browser plug-ins available to control cookies, such as Ghostery (https://www.ghostery.com). The option to control cookies may also be provided by additional software, in particular anti-virus packages, etc. 

In addition, there are tools available on the Internet that allow you to control certain types of cookies, in particular to collectively manage your behavioural advertising settings (e.g. www.youronlinechoices.com/, www.networkadvertising.org/choices). 

Please note that disabling or restricting cookies may prevent you from using some of the features available on our website and may cause difficulties in using our website, as well as many other websites that use cookies. For example, if you block social media plug-in cookies, the buttons, widgets and social features implemented on our site may

be unavailable to you.

# 15: For what purposes do we use our own cookies?

Our own cookies are used to ensure the proper functioning of particular mechanisms of the website. Our own cookies also store information about the cookie settings you have made through the cookie management mechanism.

# 16: What third party cookies are used?

The following third party cookies operate within our website:

  • Google Analytics,
  • Google Tag Manager,
  • Google AdWords,
  • Facebook Custom Audiences,
  • Hotjar,
  • YouTube.

Details of individual third-party cookies are described

below.

Google Analytics - details

We use the Google Analytics tool provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. We do this on the basis of our legitimate interest in generating statistics and analysing them in order to optimise our websites.

In order to use Google Analytics, we have implemented a special Google Analytics tracking code in the code of our website. The tracking code uses cookies from Google LLC regarding the Google Analytics service. You can block the Google Analytics tracking code at any time by installing a browser add-on provided by Google:

https://tools.google.com/dlpage/gaoptout.

Google Analytics automatically collects information about your use of our website. The information collected in this way is usually transmitted to and stored on Google's servers, which may be located around the world. 

We emphasize that we do not collect any data within Google Analytics that would allow us to identify you. Accordingly, the data collected in the context of Google Analytics does not have the nature of personal data for us. The information we have access to within Google Analytics is, in particular:

  • information about the operating system and the web browser you are using,
  • subpages that you view within our site,
  • time spent on our website and on its subpages,
  • transitions between individual subpages,
  • the source from which you access our site.

In addition, we use the following Advertising Features within Google Analytics:

  • demographic and interest reports,
  • remarketing,
  • ad reporting features.

We also do not collect personal information as part of the Advertising Functions. Information

that we have access to includes, in particular:

  • the age range you are in,
  • your gender,
  • your approximate location limited to towns,
  • your interests determined by your online activities.

Google Analytics and Google Analytics 360 services have been certified by the independent security standard ISO 27001. ISO 27001 is one of the most widely recognized standards in the world and certifies compliance with the relevant requirements of the systems that support Google Analytics and Google Analytics 360.

If you are interested in details related to the use by Google of data from websites and applications that use Google services, we encourage you to read the link with this information:: https://policies.google.com/technologies/partner-sites.

Google Tag Manager – details

We use Google Tag Manager, a tool provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, to manage tags, which are small pieces of code that allow us to control users' traffic and behaviour, gather information about the effectiveness of ads, and take actions to improve our site. Google Tag Manager does not collect any personally identifiable information about you, however, this tool triggers other tags that may in turn collect data.

Google AdWords – details

We use remarketing features available within the Google AdWords system operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. We do this based on our legitimate interest in marketing our own products or services. 

When you visit our website, a remarketing cookie from Google is automatically left on your device to collect information about your activity on our website. With the information collected in this way, we are able to show you advertisements within the Google network based on your behaviour on our site. For example, if you view a product, that information will be recorded by a remarketing cookie so that we can target you with ads for that product or any other product we deem appropriate. This advertisement will be displayed to you within the Google network when you use the Internet, browse other websites, etc. 

Please note that we do not collect any personally identifiable information about you when you use Google Ads. The possible compilation of data in such a way that it becomes personal data may be carried out on Google's part, but we are no longer responsible for this as Google carries out these activities on the basis of the contract concluded with you as a user of Google services.

We, using Google AdWords, are only able to define the audience groups that we would like our ads to reach. Based on this, Google decides when and how to present you with our ad.

Further processing of the information only takes place if you have consented to Google associating your browsing history with your account and using the information from your Google account to personalize the ads that are displayed on the websites. In this situation, Google will use your data to create and define lists of target groups for remarketing on different devices. For this purpose, Google combines temporarily collected information with other data you have to create target groups.

If you do not want to receive personalized ads, you can manage your ad settings directly from Google: https://adssettings.google.com/.

If you are interested in details related to Google's use of data from sites and applications that use Google services, we encourage you to read the information at this link: https://policies.google.com/technologies/partner-sites.

Facebook Custom Audiences – details

As part of the Facebook Ads system provided by Facebook Inc., 1601 S. California Ave., Palo Alto, CA 94304, USA, we use the Custom Audience Groups feature to target specific user groups with targeted advertising messages. We do this based on our legitimate interest in marketing our own products or services.

In order to target you with advertising that is personalized to your behaviour on our site, we have implemented the Facebook Pixel within our site, which automatically collects information about your use of our site. The information collected in this way is usually transmitted to Facebook servers, which may be located anywhere in the world, especially in the United States of America (USA).

The information collected within Facebook Pixel is anonymous, i.e. it does not allow us to identify you. Depending on your activity on our sites, you may be targeted at a particular audience, but we do not identify individual members of those groups in any way.

However, we would like to inform you that Facebook may combine the information collected with other information about you collected through your use of Facebook and use it for its own purposes, including marketing. Such actions by Facebook are no longer up to us, and you can look for information about them directly in Facebook's privacy policy: https://www.facebook.com/privacy/explanation. You can also manage your privacy settings from within your Facebook account. Here you will find useful information in this regard: https://www.facebook.com/ads/settings.

Hotjar – details

We use the Hotjar tool to better understand your needs and to optimise our website for your experience of using it, which is our legitimate interest. The tool is provided by an external entity i.e. Hotjar Limited, Level 2, St Julian's Business Centre, 3, Elia Zammit Street, St Julian's STJ 1000, Malta.

Hotjar registers every visitor to our site and allows us to play a video of their movement around our site, as well as generate so-called heat maps. Within the Hotjar tool, we do not have access to information that allows us to identify you because Hotjar does not record the process of filling out forms. The information we have access to within Hotjar is, in particular:

  • information about the operating system and the web browser you are using,
  • the pages you view within our website,
  • time spent on our website and its subpages,
  • transition between different sub-pages within our service,
  • the source from which you are accessing our service,
  • the places you click with the mouse.

In order to use Hotjar, we have implemented a special Hotjar tracking code in the code of our site. The tracking code uses cookies from Hotjar Limited. The information collected by cookies is stored by Hotjar in a pseudonymous user profile. Neither Hotjar nor we use this information to identify you.

You can object to Hotjar's creation of your user profile, Hotjar's storage of information about your use of our site and Hotjar's use of cookies here: https://www.hotjar.com/legal/compliance/opt-out.

If you are interested in details related to the processing of data within Hotjar, we encourage you to read Hotjar's privacy policy:

https://www.hotjar.com/legal/policies/privacy.

YouTube – details

We embed YouTube widgets on our sites, allowing you to play YouTube videos directly from our sites. YouTube is operated by Google LLC. 

Videos are embedded on the page in privacy mode. Based on information provided by YouTube, this means that no cookies are stored on your device, nor does Google collect any information about you until you play the video.

When you play a video, YouTube saves cookies on your device and receives information that you played the video from a specific website, even if you don't have a Google Account or aren't currently signed in. If you have logged into your Google account, this service provider will be able to directly associate your visit to our website with your account. The purpose and scope of data collection and their further processing and use by Google, as well as the possibility of contacting you and your rights in this respect and the possibility of making settings to protect your privacy are described in Google's privacy policy.

If you don't want Google to attribute the data collected during video playback directly to your profile, you'll need to sign out of your account before playing the video. You can also completely prevent plugins from loading on your site by using the appropriate extensions for your browser, such as script blocking. 

Google uses the information collected by the cookie about the YouTube videos embedded on our websites to ensure correct and safe functioning of the widget, to analyse and optimize the YouTube services, as well as for personalization and advertising purposes.

Remember that by playing videos available on YouTube, you are using services provided electronically by Google LLC. Google LLC is an independent, third-party provider of electronic services to you. For details on YouTube's terms of use, including privacy, you can refer to the documents provided directly by YouTube:

regulations: https://www.youtube.com/t/terms, privacy policy: https://policies.google.com/privacy.

# 17: Do we track your behaviour on our site?

Yes, we use Google Analytics, Google AdWords, Hotjar and Facebook Custom Audiences tools that involve collecting information about your activities on our site. These tools are described in detail under the question on third-party cookies, so we will not repeat that information here.

# 18: Are we targeting you with targeted ads?

Yes, we use Facebook Ads and Google Ads where we can target ads to specific groups defined by various criteria such as age, gender, interests, occupation, work and activities previously undertaken on our site. These tools are described in detail under the question on third-party cookies, so we will not repeat that information here.

# 19: How can you manage your privacy?

The answer to this question is found in many places in this privacy policy when describing particular tools, behavioural advertising, cookie consent, etc. However, we have compiled this information once again in one place for your convenience. Below you will find a list of options for managing your privacy.

  • the cookie settings within your web browser, 
  • browser plug-ins supporting cookie management, e.g. Ghostery,
  • additional software to manage cookies,
  • incognito mode in your web browser,
  • behavioural advertising settings, e.g. youronlinechoices.com,
  • Google Analytics Opt-out: https://tools.google.com/dlpage/gaoptout,
  • Google Ads Settings: https://adssettings.google.com/,
  • Facebook Ads Settings: https://www.facebook.com/ads/settings,
  • HotJar Opt-out: https://www.hotjar.com/legal/compliance/opt-out

# 20: What are server logs?

Using the site involves sending requests to the server that hosts the site. Every query directed to the server is recorded in the server logs.

These logs include, among other things, your IP address, the date and time of the server, information about your web browser and the operating system you are using. Logs are saved and stored on the server.

The data recorded in the server logs are not associated with specific users of the site and are not used by us to identify you.

Server logs constitute only auxiliary material used to administer the website, and their content is not disclosed to anyone except persons authorized to administer the server.

# 21: Is there anything else you should know?

As you can see, the topics of processing personal data, the use of cookies and managing privacy in general are quite complex. We have made every effort to ensure that this document provides you with as much knowledge as possible on the issues that are important to you. If anything is unclear to you, you want to know more, or you just want to talk about your privacy, please email us at kontakt@b-active.pl