I. Introduction

Personal data protection, information security and acting solely within the scope of legal compliance have always been a priority in the activities of the Central Sports Center. As a responsible organization which is aware that information has a certain value, we would like to properly inform you about matters related to personal data processing. Bearing in mind security of your data, in this document we present key information on legal grounds for processing of personal data, ways of collecting and using them as well as rights of data subjects related thereto.

II. Central Sports Centre

Central Sports Center (hereinafter: COS) as used in this privacy policy means:

• Central Sports Centre in Warsaw, 00-449 Warsaw, 6a Lazienkowska Str;
• Central Sports Centre - Feliks Stamm Olympic Preparations Centre Cetniewo in Władysławowo, 84-120 Władysławowo, 52 Żeromskiego Street;
• Central Sports Center - Olympic Preparations Center in Giżycko, 11-500 Giżycko, 22 Moniuszki St;
• Central Sports Center - Olympic Preparations Center in Spała, Spała 97-215 Inowłódz, Al. Presidenta I. Mościckiego 6;
• Central Sports Centre - Olympic Preparations Centre in Szczyrk, 43-370 Szczyrk, 8 Plażowa Street;
• Central Sports Centre - Olympic Preparation Centre in Wałcz, 78-600 Wałcz, Al. Zdobywców Wału Pomorskiego 99;
• Central Sports Centre - Olympic Preparations Centre in Zakopane, 34-500 Zakopane, 1 Bronisława Czecha Street.

The administrator of your personal data is the Central Sports Centre with its seat at 6a Łazienkowska Street, 00-449 Warsaw.

III. When does this Privacy Policy apply?

This privacy policy applies to all cases in which the Central Sports Centre is the data controller and processes personal data. This applies both to personal data obtained directly from the data subject and to cases where we have obtained the personal data from other sources. COS fulfils its information obligations in both of the above situations, set out in Article 13 and Article 14 of the RODO respectively, in accordance with these provisions.

IV. Contact point

Acting within the scope of legal compliance and appreciating the importance of personal data protection, Central Sports Center appointed a Data Protection Officer (hereinafter referred to as DPO) in the person of Mr. Marcin Kowalczyk. Within the scope of his tasks, the Data Protection Officer takes care of protecting the rights and freedoms of persons whose personal data is processed by COS and verifies the correctness of personal data processing.

In all matters related to the protection and processing of personal data by Central Sports Center you can contact the DPO:

• via email by writing to: iod@cos.pl;
• in writing to the following address Central Sports Centre 6a Łazienkowska Street 00-449 Warsaw.
  
  

V. Scope, modalities and purposes of data processing

We wish to be transparent about the ways and legal basis for processing personal data, as well as the purposes for which we process personal data. Guided by this, in order to make our explanation of these issues as clear as possible, we provide the following summary of the personal data processing operations.

At the same time, we would like to assure you that whenever we process personal data on the basis of a legitimate interest of the controller (COS), we try to analyze and balance our interest and the potential impact on the data subject (positive as well as negative) and the rights of the data subject. We do not process personal data where we conclude that the impact on the data subject would outweigh our interests, unless we have another legitimising reason.

V.1 Processing of personal data of persons visiting websites run by the Central Sports Centre or using services provided electronically

1. General information

Individuals who visit our websites or use the services we provide electronically are in control of the personal information they provide to us, but we ensure that we limit the collection and use of your information to the minimum required to provide you with the level of service you expect.

2. Cookies

To a limited extent, we may collect personal information automatically through cookies on our websites. Cookies are small computer data files that are saved and stored on your computer, tablet or smartphone for use on websites. "Cookies" usually contain the name of the originating website, the time they are stored on your device and a unique number.

On the website, visitors will be presented with information about cookies in accordance with legal regulations until the visitor accepts/closes this information. The data on acceptance of the information will be stored in cookies on the visitor's computer.

Cookies are used for the purposes of:

• adapting the websites to your preferences and optimizing the use of the websites;
• to create statistics explaining how users use the websites, which allows to improve their design and content (only in quantitative terms);
• maintaining the user's session (after logging in), allowing the user to skip logging in on each subpage of the website, only with regard to the access of COS employees to the CMS panel.

The website uses the following types of cookies: "session", "permanent" and "external".

"Session" cookies are temporary files that are stored on the user's computer, tablet or smartphone until the user logs out, leaves the website or closes the web browser and are used to support services that require authentication within a website.

"Permanent" cookies are stored on your computer, tablet or smartphone for the time specified in the parameters of the cookies or until they are deleted by the user and are used to remember the settings selected by the user and personalize the interface.

"External" cookies (so-called third party cookies) make it possible to collect information about the use of websites and provide users with advertising content, optimally adapted to the interests of individual users.

Personal data collected using cookies are encrypted to prevent access by unwanted and unauthorized persons. They are collected solely for the purpose of performing certain functions for the user.

In many cases, web browsing software (web browser) allows the storage of cookies on the User's end device by default. Users of the COS website can change their cookie settings at any time. These settings can be changed in particular in such a way as to block the automatic handling of cookies in the settings of the Internet browser or inform on their placement in the device of the Website User each time. Detailed information on the possibility and methods of using cookies are available in software settings (web browser).

3. Online application and forms

Our website offers you various ways to get in touch with us using a contact form. When using the forms, it is necessary for you to provide us with your personal data. This data is only processed within the framework and for the purpose for which it was provided and with your express consent. Your consent with regard to the contact forms is expressed by your deliberate action (so-called concluding consent), i.e. by submitting the form and providing your personal data.

4. Using Social Plugins

On the website https://cos.pl/ we use so-called Social Plugins ("Plugins") of the social network Facebook, owned by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook"). The plugins are branded with the Facebook logo and the addition "Facebook Social Plug-in" An overview of our Facebook plugins and their design can be found here: developers.facebook.com/plugins. If you view one of our pages containing such a plug-in, your browser will create a direct connection to the Facebook servers. This transfers personal data to Facebook (currently IP address, date and time, page displayed/name of URL displayed and cookie ID). The data processing takes place, to our knowledge, in the USA. Facebook may link this data with other data it holds about you. However, COS, as the website administrator, has no knowledge of the exact data processing by Facebook. Further information on the processing of your data by Facebook can be found in Facebook's provisions on personal data http://www.facebook.com/about/privacy/).

On https://cos.pl/, we also use the Social Plugins of the social network Twitter owned by Twitter Inc. and Snapchat owned by Snap Inc.

V.2 Processing of personal data of persons contacting the Central Sports Centre in order to obtain information about the offer or to share comments regarding services, as well as contacting in order to conclude a contract

We collect the following personal information from individuals who contact us for information about our offerings or to share comments about our services, and who contact us to enter into a contract: name, email address. Specifically, these individuals may send us a contract form via the website. Such messages include a preset username and email address, and any additional information the user wishes to include in the message.

We request that you do not provide information containing special categories of personal data as listed in Article 9(1) of the RODO (information about race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, information concerning physical or mental health, genetic data, biometric data, information about sex life or sexual orientation and criminal history) via the websites. If you provide such information for any reason, it will constitute your express consent to our collection and use of such information in the manner set forth herein or as set forth where such information is disclosed.

V.3 Processing of personal data of customers and potential customers

Central Sports Center processes personal data of its customers and potential customers. This data may also include the data of contact persons on the part of the clients and potential clients (their employees). This type of personal data is processed in the IT systems used by COS, including the CRM system.

Through the contact form on the COS website we may acquire the following data: name and surname, name of sports associations and clubs, name of the company, number of persons coming with the given entity or group of persons, dates of arrival and departure, e-mail address, telephone number and other data provided by the user in the message.

V.4 Processing of data of visitors to the business profile

Central Sports Center and Facebook are joint administrators of the data of Users who have liked the COS fanpage, available at: https://www.facebook.com/centralnyosrodeksportuPL. Accordingly, COS, as Administrators of the fanpage, may obtain anonymous statistical data regarding visitors to the website using a function made available by Facebook. This data is collected through cookies, each of which contains a unique user code (they are active for two years and stored by Facebook on the hard drive of the computer or any other media of visitors to the fanpage). The user code, which can be linked to the connection data of users registered on Facebook, is retrieved and processed when the fanpage is opened. Although this data is anonymous, COS may request Facebook to process it to the extent:

• Demographic data (including trends in age, gender, marital status, and occupational status),
• Lifestyle information and interests,
• geographic data to determine where to run special promotions or events, how to best target your information offerings.

At the same time, the data of people who have liked the fanpage (both Facebook, Twitter and Snapchat) can be processed in a non-anonymized form in the case:

• communication with COS through Messenger available on Facebook;
• Comment on posts shared on the fanpage;
• to participate in various promotional actions, contests - in this case, the processing will be carried out on the basis of the User's unambiguous consent.

Under no circumstances will the data of persons who liked the fanpage of the Central Sports Center be used for purposes other than those for which they were transmitted. Their processing will be carried out only on the fanpage and in accordance with the general rules of using the portal.

Personal data can be transferred outside Poland, European Union and European Economic Area in terms of the operation of the social networking portal.

Additional information with regard to electronic correspondence

If you wish to write us an e-mail, please note that unencrypted e-mails that are sent over the Internet are not sufficiently protected against unauthorized access by third parties.

IV.5 Processing of data of job applicants

The data of job candidates are collected for the purposes of ongoing recruitment and undertaking actions prior to concluding a contract. The Company may also process data if a job candidate has given his/her consent to the processing of his/her data for the purposes of future recruitment, among others.

If the processing is based on consent to participate in future recruitment procedures, the personal data will be processed maximum until the consent is withdrawn.

V. Legal basis for processing

1. The processing of the personal data of visitors to a website operated by COS or who make comments on COS's business profile on social networks is based on different legal bases for processing depending on the category of personal data we process and the purpose of the processing. We process the personal data of visitors to our websites on the basis of the legitimate interest of the controller (Article 6(1)(f) RODO) or on the basis of consent where such consent has been requested by the data subject (Article 6(1)(a) RODO). We process the data of persons who fill in a contact form because it is necessary for the purpose of performing a contract or taking steps to conclude a contract, at the request of the person providing their data (Article 6(1)(b) RODO), on the basis of consent (Article 6(1)(a) RODO) through the explicit action of the person sending the form, or on the basis of the legitimate interest of the controller which is to answer the question asked (Article 6(1)(f) RODO). Data of persons visiting our fanpage are processed in accordance with the rules of use of Facebook, Twitter, Snapchat, based on User's consent (Article 6(1)(a) RODO).

In the case of promotional campaigns carried out on social networking sites, which consist in the User sending a photo of a given subject, the User agrees to the processing of his/her personal data in the form of the image recorded on the photo, name and surname and mailing address in the case of winning a material prize (in order to send the prize) is expressed by the User by transferring/sharing the photo and transferring the said data. In the case of the submission of a photo, which also shows the image of third parties, the User also confirms that he/she has the right to use, including share, the image of these persons.

We are sometimes required by law to process certain personal information for tax and accounting purposes.

2. The processing of personal data of persons contacting COS for the purpose of obtaining information about an offer or sharing comments regarding services, as well as those contacting for the purpose of concluding a contract is based on the consent given by the user directing the above request to COS (Article 6(1)(a) RODO) or for the purpose of performing a contract (fulfilling a request) made by the person (Article 6(1)(b) RODO). We may also process the data provided on the basis of a legitimate purpose of the controller (Article 6(1)(f) RODO).

3. The processing of personal data of individuals who are customers of COS is based on:

• the legitimate interest of COS as a data controller (e.g. for the creation of a database, analytical activities, including activities relating to the analysis of the use of products, direct marketing of its own products, securing documentation for the purpose of defending against possible claims or for the assertion of claims);
• consents (including, but not limited to, consent for email marketing or telemarketing);
• performance of the concluded agreement;
• obligations under the law (e.g., tax law or accounting regulations).

4. The processing of personal data of individuals who are potential customers of COS is based on:

• the legitimate interests of COS as a data controller (especially with regard to the creation of a database, direct marketing of its own products);
• consent (including, in particular, consent to email marketing or telemarketing).

1. Data processing period

The period for which we may process personal data depends on the legal basis constituting the legal premise for the processing of personal data by the Central Sports Centre. Accordingly, we inform you that if COS processes personal data on the basis of:

• consent, the processing period continues until the data subject withdraws that consent or the purpose of the processing ends;
• legitimate interest of the controller, the processing period lasts until the expiry of the aforementioned interest (e.g. the statute of limitations for civil law claims) or until the data subject objects to further processing - in situations where such an objection is legitimate under the law;applicable laws, the processing periods for this purpose shall be determined by those laws.

In the absence of specific legal or contractual requirements, the basic data retention period for records and other documentary evidence produced in the course of contract performance is a maximum of 10 years.

• Recipients of the data

We pass your personal data to other entities on the basis of legal requirements or in connection with realization of the purpose for which they were passed on to us. At the same time, we declare that we use only the services of entities verified, known on the market and guaranteeing the security of your data. Contracts under which we entrust the processing of personal data include provisions on the protection measures required by us to ensure the confidentiality, integrity and availability of the data transmitted.

We may transfer your personal data to companies or other trustworthy business partners who provide services on our behalf and to entities with which we cooperate. In addition, data may be transferred to providers of services such as debt collection, tax, legal, accounting services. Your personal information is transferred to these entities and other third parties only if necessary to perform the services you have requested or authorized, to protect your and our rights, property, or safety, or if we are required to do so under applicable statutes, court rules, or regulations of other authorities, or if disclosure of your personal information is otherwise necessary to support a legal or criminal determination or legal process.

Accordingly, we indicate that the recipients of the personal data that COS processes as a controller may be:

• entities that process personal data pursuant to personal data processing entrustment agreements (so-called processors);
• entities providing hosting services;
• subcontractors and suppliers who provide software delivery services, software maintenance services or hardware that we use;
• debt collection companies;
• auditors and chartered accountants, legal advisors, tax advisors;
• law enforcement agencies, regulators and other public administrations.

Your personal data will not be transferred to data processors located outside the European Economic Area (EEA).

1. Rights related to the processing of personal data

Individuals have certain rights regarding their personal data, and the Central Sports Centre, as the data controller, is responsible for exercising those rights in accordance with applicable laws. If you have any questions or requests regarding the scope and exercise of your rights, or to contact us specifically to exercise a specific data protection right, please contact our Data Protection Officer.

The request can be made via email box or by post. We will process your request promptly. Therefore, it is necessary to provide the contact details to which you would like to receive a response. If your request takes more than one month to process, you will be informed of the extension by a separate letter/message. Such extension is possible due to the complexity of the request or the number of requests submitted.

If the request does not clearly identify you or is unclear, the Data Protection Officer will ask you to complete it within one month of receipt of the request.

If the application is submitted in electronic form, further correspondence will also be conducted in this form, if it proves possible and no other communication channel is indicated. We would like to point out that this form also minimizes the negative impact on the environment.

The processing of the request is free of charge. However, if the request is unreasonable or frequently repeated, the Administrator may impose a reasonable fee, taking into account the reasonable administrative costs of recognizing the request, communicating or carrying out the requested operations, or refuse to recognize the request.

We reserve the right to exercise the following rights upon positive verification of the identity of the person requesting the action.

You have the following rights related to the processing of personal data:

• The right to withdraw consent to processing at any time where we process your personal data on the basis of consent;
• The right of access to personal information;
• The right to request rectification of personal data;
• The right to request erasure of personal data;
• The right to request restriction of the processing of personal data;
• The right to object to processing on the grounds of your particular situation - where we process data on the basis of our legitimate interest;
• The right to portability of your personal data, i.e. the right to receive personal data from us, in a structured, commonly used, machine-readable computer format. You may transfer this data to another controller or request that we transfer it on your behalf to another controller. However, we will only do this if such transmission is technically possible. The right to data portability only applies to those data that we process under contract or on the basis of your consent;
• The right to lodge a complaint to the supervisory authority dealing with personal data protection, i.e. the President of the Office for Personal Data Protection.