Zapisz

Privacy policy

PRIVACY POLICY AND PRINCIPLES REGARDING COOKIES


I. GENERAL INFORMATION


Privacy of the Users of earlystage.pl website (hereinafter referred to as the “Website”) accessible at earlystage.pl is of utmost importance to us and therefore we spare no efforts to protect it. This document details the means of processing and protecting Users’ personal data in connection with their use of the Website, as well as establishes the Principles Regarding Cookies. 


This Privacy Policy and Principles Regarding Cookies are related to the “Terms and Conditions for the Electronic Provision of Services through the Website”, which is also available at earlystage.pl (hereinafter referred to as the “Terms and Conditions”).


II. DEFINITIONS


II.1.Should the following capitalized terms be used in this document, they will have the meaning given to them below, unless otherwise stipulated in the provision. Other capitalized terms, not separately defined in this Privacy Policy, will have the same meaning given to them in the Terms and Conditions.


II.2.Data Controller – ES EDUCATION BOCHIŃSKA I WSPÓLNICY Spółka komandytowa, hereinafter “Early Stage”, entered into the Register of Entrepreneurs of the National Court Register maintained by the District Court for the capital city of Warsaw, 14th Commercial Division of the National Court Register under the National Court Register (Krajowy Rejestr Sądowy, KRS) number 0000883647, ul. Plac Thomasa Woodrowa Wilsona 4/15, 01–626 Warszawa, Tax Identification Number (Numer Identyfikacji Podatkowej, NIP): 5252852107, National Official Business Register number (Rejestr Gospodarki Narodowej, REGON): 38822625500000, e-mail address: biuro@earlystage.pl. As a general rule, Early Stage processes Users’ Personal Data as the Personal Data Controller within the meaning of the Regulation; however, it might happen that in regard to certain features and services available on the Website, Early Stage processes Personal Data as the processor within the meaning of the Regulation, acting on behalf of the Franchisees or other entities cooperating with Early Stage and using the Website infrastructure (under data processing agreements). Where Early Stage acts as the processor, in this Privacy Policy and for the description of particular features and services, a separate Data Controller is identified.


II.3.Personal Data – means any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, e-mail address, telephone number, location data, an online identifier, including the device IP, version of the browser used by the User, operating system and type/name of User’s device, other information collected through cookies or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.


II.4.Privacy Policy – this document regarding privacy and cookies.


II.5.Profile – a section (a set of information on the User stored in the Data Controller’s ICT system) available on the Website, where registered Users may access certain Content and features or services of the Website, subject to the terms described in the Terms and Conditions or in separate documents related to those functionalities or services.


II.6. Regulation – the Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.


II.7.Website – a website intended for Users, maintained by the Data Controller under the address earlystage.pl, where, among others, the Content and features as well as different services are made available to Users. The Website is public and intended for Users; however, in terms of certain features and services provided via the Website, the Users are required to have specific access rights.


II.8. User – a natural person visiting the Website and using the services and features of the Website. The above-mentioned services and features may be used either by any User visiting the Website or by Users having specific access rights, including registration on the Website – depending on the type of services and features used by the User.


II.9.Franchisee – a User who is a legal or natural person and concluded a franchise contract with the Data Controller. The Franchisee may provide the Service Provider with data necessary to verify the User who is a Customer or an Employee, where such Customer or Employee uses such services and features of the Website, access to which is protected by a Login and Password or another access control tool. Also in other areas the Franchisee, using the Website’s infrastructure under their agreements with the Data Controller, may act as the data controller in respect of certain features and services. 


II.10.Customer – a User who is a natural person and concluded a language course contract with the Franchisee. 


II.11. Employee – a User who is a natural person and cooperates with the Franchisee, regardless of the form of this cooperation (an employment contract, a civil law contract, including as part of their commercial activities).


III. PURPOSES OF AND GROUNDS FOR PERSONAL DATA PROCESSING


III.1.The Data Controller collects and processes Users’ Personal Data due to its commercial activity, in accordance with the applicable law including, but not limited to in accordance with the Regulation. The Users’ Personal Data is processed by the Data Controller on different grounds and for different purposes, depending on the features or services of the Website used by the User. See below for a description of those purposes and legal grounds for data processing.


In particular, the Data Controller ensures: (i) transparency of Personal Data processing; (ii) timely provision of information to Users on the processing of Personal Data, including by referring them to this Privacy Policy, and (iii) processing Personal Data only to the extent necessary for a particular purpose and as long as necessary.


The User’s activity on the Website, including their Personal Data, is registered in system logs (a computer program which saves the information on events and operation of the information system, through which the Data Controller provides services by electronic means) and processed for the purposes related to the provision of services by the Data Controller for technical, administrative, remarketing, analytical and statistical purposes and in order to ensure safety and management of the information system. 


III.2. Processing of Personal Data of the Users viewing the Website’s Content:

III.2.a.The Personal Data processed includes, but is not limited to, the IP address or other identifiers and information collected through cookies or similar technologies.

III.2.b.Personal Data is processed: (i) to perform the Service Contract with respect to sharing the Content of the Website with the Users and (ii) for analytical and statistical purposes

III.2.c.Personal Data is processed: in the case stipulated under item (i) above – pursuant to the provisions of Article 6(1)(b) of the Regulation – processing is necessary for the performance of a contract to which the User is party to or in order to take steps at the request of the Data Subject prior to entering into a contract; in the case stipulated under item (ii) above – pursuant to the provisions of Article 6(1)(f) of the Regulation – processing is necessary for the legitimate interests pursued by the Data Controller, which entail analysis of Users’ activity and their preferences in order to improve the features used and services provided through the Website.

III.2.d.The provision of Personal Data by the User is not a statutory or contractual requirement but is the prerequisite for concluding the Service Contract; failure to provide Personal Data prevents the conclusion of an agreement between Early Stage and the User.


III.3.Processing of Users' and potential Customers’ Personal Data as part of submitting a declaration to conclude a language course contract with the Franchisee

The rules for processing Personal Data in this regard can be found HERE (in the Website section regarding this feature).


III.4.Processing of Customers' Personal Data to enable registration and access to their Profile in the Early Stage Online service and use specific features of this service 

The rules for processing of Personal Data in this regard can be found HERE (in the Website section regarding this feature).


III.5.Processing of Customers' Personal Data to enable Users to submit a declaration to conclude a camp contract

The rules for processing of Personal Data in this regard can be found HERE (in the Website section regarding this feature). By providing the Website infrastructure to carry out the enrollment mentioned above, Early Stage acts as the processor and Early Stage Spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw is a separate Personal Data Controller. 


III.6.Processing of Personal Information of Franchisees and Employees to enable them to register and access their Profiles in the Backstage service

III.6.a.As a rule, Personal Data is processed to satisfy contractual obligations of the Data Controller in terms of providing the Franchisees and Employees cooperating with the Franchisees the Content related to their commercial or professional activity. The Personal Data processed includes, but is not limited to, the name, surname, Login and Password, IP address or other identifiers and information collected through cookies or similar technologies.

III.6.b. Personal Data is processed pursuant to (i)the provisions of Article 6(1)(b) of the Regulation – processing is necessary for the performance of a contract to which the Franchisee is party to and in order to perform the Service Contract with respect to sharing the Content of the Backstage service; as well as pursuant to (ii) the provisions of Article 6(1)(f) of the Regulation – processing is necessary for the legitimate interests pursued by the Data Controller, which entail the provision of specific Content to Employees indicated by the Franchisees as persons authorized to access this Content as part of the Franchisee’s organization.

III.6.c.The provision of Personal Data by the User is not a statutory or contractual requirement but is the prerequisite for concluding the Service Contract with respect to sharing the Content of the Backstage service; failure to provide Personal Data prevents the conclusion of a contract between Early Stage and the User with respect to the above. Failure to provide Personal Data is not an obstacle to concluding the franchise contract between the Data Controller and Franchisee – the failure to provide Personal Data prevents the access to the Content of the Backstage service.


III.7.Processing of Users’ Personal Data to provide them with access to Grammar Rhymes Content

The rules for processing of Personal Data in this regard can be found HERE (in the Website section regarding this feature). By sharing the Website infrastructure for this feature, Early Stage acts as the processor and Early Stage Spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw is a separate Personal Data Controller.


III.8.Processing of Users' Personal Data to enable them to register for webinars or training programs

III.8.a.The Personal Data processed includes the name and e-mail address or other identifiers and information collected through cookies or similar technologies.

III.8.b.Personal Data is processed: (i) to perform the Service Contract with respect to enabling registration for or participation in a selected webinar or training program online (ii) for analytical and statistical purposes. 

III.8.c.Personal Data is processed: in the case stipulated under item (i) above – pursuant to the provisions of Article 6(1)(b) of the Regulation – processing is necessary for the performance of a contract to which the User is party to or in order to take steps at the request of the Data Subject prior to entering into a contract; in the case stipulated under item (ii) above – pursuant to the provisions of Article 6(1)(f) of the Regulation – processing is necessary for the legitimate interests pursued by the Data Controller, which entail analysis of Users’ activity and their preferences in order to improve the features used and services provided through the Website.

III.8.d.The provision of Personal Data by the User is not a statutory or contractual requirement but is the prerequisite for concluding the Service Contract; failure to provide Personal Data prevents the conclusion of an agreement between Early Stage and the User.


III.9.Processing of Customers' Personal Data to enable them to access the “Parent Panel” feature

III.9.a.The Personal Data processed includes, but is not limited to, the IP address or other identifiers and information collected through cookies or similar technologies. The Customer obtains access to the “Parent Panel” and its Content with the universal passwords and login provided by the Franchisee. The “Parent Panel” does not include Customer-specific Content; in order to access this Content, the Customer does not create a Profile.

III.9.b.Personal Data is processed to perform the Service Contract with respect to sharing the Content of the “Parent Panel” Website with the Customers.

III.9.c.Personal Data is processed pursuant to the provisions of Article 6(1)(b) of the Regulation – processing is necessary for the performance of a contract to which the Customer is party to or in order to take steps at the request of the Data Subject prior to entering into a contract.

III.9.d.The provision of Personal Data by the Customer is not a statutory or contractual requirement but is the prerequisite for concluding the Service Contract with respect to sharing the Content of the “Parent Panel”; failure to provide Personal Data prevents the conclusion of a contract between Early Stage and the User with respect to the above and the use of the Content.


III.10.PProcessing of Personal Data of Franchisees and Employees to enable Franchisees to access the “Franchisee Panel” feature

III.10.a.As a rule, Personal Data is processed to satisfy contractual obligations of the Data Controller in terms of providing the Franchisees and Employees cooperating with the Franchisees the Content related to their commercial or professional activity. The Personal Data processed includes, but is not limited to, the name, surname, Login and Password, IP address or other identifiers and information collected through cookies or similar technologies.

III.10.b. Personal Data is processed pursuant to (i) the provisions of Article 6(1)(b) of the Regulation – processing is necessary for the performance of a contract to which the Franchisee is party to and in order to perform the Service Contract with respect to sharing the Content of the Franchisee Panel, as well as pursuant to (ii) the provisions of Article 6(1)(f) of the Regulation – processing is necessary for the legitimate interests pursued by the Data Controller, which entail the provision of specific Content to Employees indicated by the Franchisees as persons authorized to access this Content as part of the Franchisee’s organization.

III.10.c.The provision of Personal Data by the User is not a statutory or contractual requirement but is the prerequisite for concluding the Service Contract with respect to sharing the Content of the Franchisee Panel; failure to provide Personal Data prevents the conclusion of a contract between Early Stage and the User with respect to the above. Failure to provide Personal Data is not an obstacle to concluding the franchise contract between the Data Controller and Franchisee – the failure to provide Personal Data prevents the access to the Content of the Franchisee Panel.


III.11.Processing of Customers' Personal Data to enable them to access the “Project Platform”, “Music App”, “Lola and Leo App” or “Bear Band” feature

III.11.a.The Personal Data processed includes, but is not limited to the Login and Password, IP address or other identifiers and information collected through cookies or similar technologies. In order to access the Content of the “Project Platform” service, the Customer creates a Profile and registers using the Login and Password, which means that their Personal Data provided during registration and necessary to administer and use the Profile is processed by the Data Controller.

III.11.b.Personal Data is processed to perform the Service Contract with respect to sharing the Content of the “Project Platform” Website, “Music App”, “Lola and Leo App” or the “Bear Band” feature with the Customers.

III.11.c.Personal Data is processed pursuant to the provisions of Article 6(1)(b) of the Regulation – processing is necessary for the performance of a contract to which the Customer is party to or in order to take steps at the request of the Data Subject prior to entering into a contract.

III.11.d.The provision of Personal Data by the Customer is not a statutory or contractual requirement but is the prerequisite for concluding the Service Contract with respect to sharing the Content of the “Project Platform” Website, “Music App”, “Lola and Leo App” or “Bear Band” feature, as well as using the Content and Profile (of the “Project Platform” Website, “Music App”, “Lola and Leo App” or “Bear Band” feature, respectively).


III.12.Processing of Users' Personal Data to enable them to access other Content requiring registration, logging (including those enabling access to the Profile) or use another access tool

III.12.a.The Personal Data that may be processed includes, but is not limited to the Login and Password, IP address or other identifiers and information collected through cookies or similar technologies. In order to access the Content, the Customer may register using a Login and Password, create a Profile or perform other activities required to access the Content. The Personal Data provided during registration, logging or using another access tool is necessary to use the Content and/or access the Profile and is processed by the Data Controller.

III.12.b.Personal Data is processed to perform the Service Contract with respect to sharing specific Content (using the Profile),access to which requires registration, logging or using another access tool. 

III.12.c.Personal Data is processed pursuant to the provisions of Article 6(1)(b) of the Regulation – processing is necessary for the performance of a contract to which the User is party to or in order to take steps at the request of the Data Subject prior to entering into a contract.

III.12.d.The provision of Personal Data by the User is not a statutory or contractual requirement but is the prerequisite for concluding the Service Contract with respect to sharing specific Content and using the Content and/or Profile.


III.13.Processing of Users' Personal Data to redirect them to other websites 

III.13.a.The Personal Data that may be processed includes, but is not limited to, the IP address or other identifiers and information collected through cookies or similar technologies and processed by the Data Controller until the User moves to another website. The rules for operating and processing Personal Data on these websites are specified in documents available on these websites and are not the responsibility of the Data Controller, unless the Data Controller administers these websites.

III.13.b.Personal Data is processed to perform the Service Contract with respect to sharing the Content of the Website with the Users. 

III.13.c.Personal Data is processed pursuant to the provisions of Article 6(1)(b) of the Regulation – processing is necessary for the performance of a contract to which the User is party to or in order to take steps at the request of the Data Subject prior to entering into a contract.

III.13.d.The provision of Personal Data by the User is not a statutory or contractual requirement but is the prerequisite for concluding the Service Contract; failure to provide Personal Data prevents the conclusion of an agreement between Early Stage and the User.


III.14.Processing of the Personal Data of Users contacting the Data Controller via the electronic contact form available on the Website

III.14.a.As a general rule, personal data is provided directly by the User by completing the form and this data usually includes their full name, e-mail address and other data provided by the User, and Early Stage only requires Personal Data that is necessary to contact the User and answer their query. However, the User may provide other data to facilitate contacting them or answering their query.

III.14.b.Personal Data is processed to identify the sender, continue communication and resolve the matter about which the User contacts the Data Controller using the form. 

III.14.c.Personal Data is processed pursuant to the provisions of Article 6(1)(b) of the Regulation (mandatory data) – processing is necessary for the performance of the Service Contract using the form and pursuant to the provisions of Article 6(1)(f) of the Regulation (voluntary data) – processing is necessary for the legitimate interests pursued by the Data Controller, which entail communication and correspondence in connection with their business activities.

III.14.d.The provision of Personal Data by the User is not a statutory or contractual requirement but with respect to the personal data required by the Data Controller is the prerequisite for concluding the Service Contract; failure to provide Personal Data indicated in the form as mandatory prevents the User from contacting Early Stage and prevents Early Stage from responding to the matter raised by the User.


When the Customer contacts the Franchisee using the electronic contact form available on the Website, Early Stage shares the Website infrastructure only with respect to this feature and acts as the processor, while the said Franchisee is a separate Personal Data Controller. The rules for processing of Personal Data in this regard can be found HERE (in the Website section regarding this feature).


III.15.Processing of the Personal Data of Users posting comments on the Website

III.15.a.As a general rule, personal data is provided directly by the User by completing the comments field and usually includes their full name, e-mail address and other data provided by the User, and Early Stage only requires Personal Data that is necessary to send a comment and identify its author.

III.15.b.Personal Data is processed to post a comment and identify the author of the comment, and possibly for further communication regarding the comment. 

III.15.c.Personal Data is processed pursuant to the provisions of Article 6(1)(b) of the Regulation (mandatory data) – processing is necessary for the performance of the Service Contract with respect to enabling the User to post a comment on the Website and pursuant to the provisions of Article 6(1)(f) of the Regulation (voluntary data) – processing is necessary for the legitimate interests pursued by the Data Controller, which entail communication and correspondence in connection with their business activities.

III.15.d.The provision of Personal Data by the User is not a statutory or contractual requirement but with respect to the personal data required by the Data Controller is the prerequisite for concluding the Service Contract; failure to provide Personal Data indicated as mandatory in the option “leave a comment”/“comment” prevents the User from posting a comment on the Website.


III.16.Processing of Users' Personal Data to provide them with information on the Data Controller, Franchisee or other information that may be provided by the Data Controller to Users on the basis of their authorizations (e.g. regarding marketing)

III.16.a.Activities, including marketing activities, that the Data Controller may perform, may include: 

  1. contextual advertising (displaying marketing content that is not User-specific) and therefore the Data Controller may process User’s Personal Data for that marketing purpose and based on its legitimate interest in promoting the Data Controller’s services and goods (legal basis – Article 6(1)(f) of the Regulation);
  2. behavioral advertising (displaying marketing content corresponding to the User’s interests) and therefore the Data Controller may process User’s Personal Data (including personal data collected through cookies and similar technologies) for marketing purposes; this includes also profiling of the Users. Data processing is based on the legitimate interest of the controller (promoting Data Controller’s services and goods),provided that the User consented to using cookies for that purpose;
  3. sending e-mail notifications about offers or content to Users who provided their e-mail address for that purpose, including under the rules stipulated in the Terms and Conditions; such information or content may include commercial information (newsletter service) and therefore the Data Controller may process User’s Personal Data (e-mail address of the User) for the following purposes and based on:

- to provide the newsletter service, as it is necessary to perform the Agreement on Electronic Provision of Services (legal basis – Article 6(1)(b) of the Regulation);

-  to provide Users with marketing content based on the Data Controller’s legitimate interest in promoting its services and goods (legal basis – Article 6(1)(f) of the Regulation) or under a separate consent provided by the User (legal basis – Article 6(1)(a) of the Regulation);

-for analytical and statistical purposes (analyzing Users’ activity on the Website) based on the Data Controller’s legitimate interest in seeking to improve the features and services available and provided through the Website (legal basis – Article 6(1)(f) of the Regulation);

- to perform other activities related to direct marketing of goods and services (sending commercial information by electronic means and telemarketing activities) based on the Data Controller’s legitimate interest in promoting its services and goods (legal basis – Article 6(1)(f) of the Regulation) or under a separate consent provided by the User (direct marketing; legal basis – Article 6(1)(a) of the Regulation). 

III.16.b. The provision of Personal Data by the User is not a statutory or contractual requirement. The provision of Personal Data is voluntary, but necessary for the provision of the newsletter service or sending other communications to the User.


III.17.Processing of the Personal Data of Users posting their data in the Data Controller’s public profiles on social media (Facebook, Instagram, YouTube, LinkedIn, TikTok)

III.17.a. Personal Data is provided directly by the User who visits the Early Stage public profiles in social media and this data usually includes different types of comments or an Internet identifier such as IP address.

III.17.b.Personal Data is processed for statistical and analytical purposes, to support the Data Controller in running a given profile but also to enable the User to actively use such a profile.  

III.17.c.Personal Data is processed pursuant to the provisions of Article 6(1)(f) of the Regulation – processing is necessary for the legitimate interests pursued by the Data Controller which entail supporting its commercial activity, its brand, including the promotion of Data Controller’s products and services. The data may be also processed to conduct User satisfaction surveys and determine the quality of Data Controller’s services. The legal basis for processing is the legitimate interest in obtaining relevant information to improve the quality of the Data Controller’s products and services (Article 6(1)(f) of the Regulation).

III.17.d.The provision of Personal Data by the User is not a statutory or contractual requirement nor is it the prerequisite for concluding a contract; however, failure to provide Personal Data prevents the User from using certain features available in the Data Controller’s profiles in social media.

III.17.e. Users may obtain further information on the processing of Personal Data in the Data Controller’s profiles in the individual social media. Information provided in this paragraph III.17 does not apply to the processing of Personal Data by the administrators of the said services (social media) – the User may find that information in privacy documents provided by those entities in the said services.

III.17.f.Facebook Inc. with its registered office in the USA and Facebook Limited with its registered office in Ireland and/or YouTube LLC with its registered office in the USA, LinkedIn Ireland Unlimited Company with its registered office in Ireland or TikTok Inc with its registered office in the USA may transfer Personal Data to a third country (USA). Such a transfer is possible, as the privacy policies or other personal data protection rules of the abovementioned data recipients invoke standard data protection clauses adopted by the European Commission. Information on personal data processing rules applicable to the abovementioned portals is available in the personal data protection documents that can be found on their websites.


III.18. Processing Personal Data of Users using social media plug-ins placed on the Website (Facebook, Instagram, YouTube, LinkedIn)

III.18.a. Personal Data is provided directly by the User who uses social media plug-ins and this data usually includes an Internet identifier such as IP address or User’s browser identifier.

III.18.b.Personal Data is processed for statistical and analytical purposes, to support the maintenance of the Website and Early Stage promotion, as well as to enable the User to actively use the Website.

III.18.c.Personal Data is processed pursuant to the provisions of Article 6(1)(f) of the Regulation – processing is necessary for the legitimate interests pursued by the Data Controller which entail supporting the commercial activity of Early Stage, including its promotion.

III.18.d.The provision of Personal Data by the User is not a statutory or contractual requirement nor is it the prerequisite for concluding a contract; however, failure to provide Personal Data prevents the User from using the social media plug-in feature.

III.18.e. Information provided in this paragraph III.18 do not apply to the processing of Personal Data by the administrators of the said services (social media) – the User may find that information in privacy documents provided by those entities in the said services. The Data Controller recommends to review the terms of use and privacy policies of such websites before using them. In providing the social media plug-in feature, the Data Controller’s activity is limited only to the collection of personal data and disclosing it by means of transmission to the owner of a given social media portal. Therefore, Early Stage acts as the Personal Data Controller only in respect to the collection and transfer of the data to a given social media portal and in this respect the User may execute their rights described in section VI of this Privacy Policy against Early Stage.

III.18.f.Facebook Inc. with its registered office in the USA and Facebook Limited with its registered office in Ireland and/or YouTube LLC with its registered office in the USA or LinkedIn Ireland Unlimited Company with its registered office in Ireland may transfer Personal Data to a third country (USA). Such a transfer is possible, as the privacy policies or other personal data protection rules of the abovementioned data recipients invoke standard data protection clauses adopted by the European Commission. Information on personal data processing rules applicable to the abovementioned portals is available in the personal data protection documents that can be found on their websites.


III.19.Processing Data of Users who contact the Controller, in particular via e-mail, mail or by phone, for issues other than the use of the Website

III.19.a.As a general rule, personal data is provided directly by the User and this data usually includes the full name, e-mail address, other contact details, other data provided by the User, and – in case of telephone contact – the Controller also automatically acquires a telephone number, from which the call is made.   

III.19.b. Personal Data included in the correspondence from the User to the Controller is processed only for the purposes of communication and addressing the issue raised in the correspondence/communication. 

III.19.c.Personal Data is processed under Article 6(1)(f) of the Regulation – processing is necessary for the legitimate interests pursued by the Controller, entailing responding to correspondence sent to them in connection with their business activities. Data may be processed on the grounds indicated under the other paragraphs in this section if the User contacts the Controller for issues referred to in these paragraphs. 

III.19.d. The provisions of Personal Data by the User is not a statutory or contractual requirement nor is it the prerequisite for concluding a contract; however, failure to provide Personal Data prevents the User from contacting the Controller and Controller from responding to the correspondence sent by the User.


III.20.Processing Users’ Personal Data on other grounds: The Controller may process User’s Personal Data based on the consent granted by the User, in each case within the scope, for the purposes, on the terms and for the period specified in the consent.


III.21.For each case of Personal Data processing described in this section, the Controller may process additional Personal Data in connection with the establishment, exercise or defense of potential claims of the Controller under Article 6(1)(f) of the Regulation – processing is necessary for the legitimate interests pursued by the Controller, entailing the exercise and defense of claims.


III.22.The Controller does not process Personal Data of children under Article 6(1)(f) of the Regulation. 

IV. COOKIES


IV.1.Cookies are IT data, including especially text files stored in the Website User’s end device, intended for using the Website, e.g. by remembering the User’s visits to the Website and their activities. Cookies usually include the name of the website from which they originate, storage time on the end device and a unique number. Cookies collect information to facilitate the use of a website.


Cookies are used on the Website for the purposes of:


  1. creating anonymous statistics to help us understand the way Users use websites, which will allow us to improve their structure and contents. To this end, we use such cookies as Google Analytics cookies; however, Google does not use the collected Users’ data to identify them nor does it combine this information to enable identification. More information on the scope and rules for data collection by Google are available at the address: https://www.google.com/intl/pl/policies/privacy/partners,
  2. maintaining the session of the Website User (after logging into the Profile),precluding the need for the User to enter a login and password in each subpage of the Website; these cookies are intended to identify a logged-in User.


IV.2.Two main types of cookies are used on the Website: session cookies and persistent cookies. Session cookies are temporary files stored in the User’s end device until they log out, leave the website or turn off the software (Internet browser). Persistent cookies are stored in the User’s end device for the period specified in cookie parameters or until they are deleted by the User.


The Controller uses the following cookies:

  1. “necessary” cookies that enable the use of Website services, e.g. authentication cookies used for Website services requiring authentication;
  2. secure cookies, e.g. cookies used to detect authentication misuse on the Website;
  3. “performance” cookies that enable collection of information about the way in which users use the Website;
  4. “functional” cookies that enable “remembering” preferred User’s settings;
  5. “analytical” cookies intended for analyzing and improving the Website’s functionality;
  6. “advertising” cookies that enable remembering User’s activities on the Website and selecting appropriate advertisements.


IV.3.The use of cookies for the purpose of collecting data, including accessing data saved on the User’s device, is subject to User’s consent. Such consent may be revoked at any time. Consent is not required only for cookies that are necessary to provide the telecommunication service (data transmission for the purpose of displaying content).


In many cases, the software used for browsing websites (Internet browser) allows the storage of cookies in the User’s end device by default. Website Users may at any time their change cookie settings or revoke their relevant consent. These Internet browser settings may be changed especially in a manner that blocks the automatic acceptance of cookies or to inform about any cookies that are being stored in the Website User’s device. Further details about the possibilities and methods in terms of cookie management are available in the software (Internet browser) settings:

a)Internet Explorer: https://support.microsoft.com/pl-pl/help/17442/windows-internetexplorer-delete-manage-cookies 

b) Mozilla Firefox: https://support.mozilla.org/pl/kb/ciasteczka 

c)  Google Chrome: https://support.google.com/chrome/bin/answer.py?hl=pl&answer=95647 

d)  Opera: https://help.opera.com/Windows/12.10/pl/cookies.html 

e)  Safari: https://support.apple.com/kb/PH5042?locale=en-GB


Limiting the use of cookies may impact certain features available on the Website’s individual pages.


Cookies stored in the Service User’s end device may also be used by advertisers and partners cooperating with the Controller, including Google Analytics.


V. PERSONAL DATA PROCESSING PERIOD


V.1.The period of processing personal data by the Controller depends on the type of service provided through the Website and the purpose for processing Data. As a general rule, data is processed for the period of providing service by electronic means on the basis of the Terms and Conditions until consent is revoked (if Personal Data is processed on the basis of consent),for the period specified in the consent or until an effective objection to the Personal Data processing is raised (where the legal basis for Personal Data processing is legitimate interest of the Controller and direct marketing). 

The period for Personal Data processing may be extended if processing is necessary for the establishment, exercise or defense or potential claims, and after that period – to the extent required by law. At the end of the processing period, Personal Data is irreversibly deleted or anonymized.


The above provision and the provisions of paragraphs VI and VII above apply to the processing of Personal Data by the Controller acting as a personal data controller as defined by the Regulation. Personal Data is processed by the Controller on behalf of the Franchisee or another entity in accordance with the information contained in information clauses provided by the above entities, including, but not limited to during the process of the Customer concluding a language course contract.   


VI. USER RIGHTS


VI.1.The User has the right to:

  1. withdraw their consent for Personal Data processing, provided that the processing takes place on the basis on consent; the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal;
  2. request the Data Controller to grant them access to their Personal Data and request their rectification, removal (“the right to be forgotten”) or restriction of their processing as well as transfer data to another controller;
  3. to lodge a complaint with the supervisory authority responsible for verifying whether personal data processing is compliant with the law, i.e. the President of the Personal Data Protection Office.


VI.2.The User also has the right to object to personal data processing for marketing purposes, if processing takes place on the basis of legitimate interest of the Controller and – for reasons related to the particular situation of the User – in other cases, where the legal basis for data processing is legitimate interest of the Controller (e.g. for analytical and statistical purposes).


VII.3.The abovementioned rights, except for lodging a complaint with a supervisory authority, may be exercised by sending a request to the e-mail address: d.osobowe@earlystage.pl or in another way selected by the User.


VII. DATA TRANSFERS


VII.1.In connection with the provision of services through the Website, Personal Data will be disclosed to third parties, including, but not limited to vendors responsible for managing IT systems and entities related to the Controller, including companies from their capital group, in accordance with data processing agreements concluded with such entities. The Controller also informs that in connection with the transfer of Personal Data to countries outside the European Economic Area, personal data may be processed with the use of third party services (processors). Such transfer takes place if the privacy policies or other personal data protection rules of the processor are based on the grounds specified in the Regulation, including, but not limited to standard data protection clauses adopted by the European Commission or binding corporate rules approved by a competent supervisory authority. 


The Controller requires these Personal Data processors to ensure that the level of protection of privacy and personal data processed by these entities is compliant with the law.


VII.2.The Controller has the right to disclose certain information of the User to competent authorities or third parties that request such information, at all times in accordance with applicable laws.


VII.3.If the User grants the relevant consent, their data may also be disclosed to other entities for their own purposes, including marketing purposes.


VIII. SECURITY OF PERSONAL DATA


VIII.1.The Controller carries out an ongoing risk analysis to ensure that Personal Data is processed securely.  Personal Data may only be accessed by authorized persons and only to the extent necessary for the purpose of processing and activities performed by these persons. All operations on Personal Data are documented appropriately and performed only by authorized persons.


IX. FINAL PROVISIONS


IX.1.Each User may contact the Controller using the contact information specified in paragraph II.2 above. A response will be sent to the e-mail address from which the request/query/demand was sent and in case of requests/queries/demands sent by mail – a response will be sent by regular mail to the address specified by the requestor, provided that the contents of the letter do not indicate the desire to receive feedback by e-mail (in such a case, an e-mail address should be provided).


IX.2.The Controller will be reviewing this Privacy Policy on an ongoing basis and, if needed, will be modifying and updating it.