Apple Muzeum Polska privacy policy
This is an English translation provided for convenience. In case of any discrepancy, the Polish version prevails.
This policy describes how Fundacja Apple Muzeum Polska (Apple Museum Poland Foundation) processes the personal data of people visiting the website, buying in the shop and sending enquiries about the museum’s offer.
1. Data controller
The controller is Fundacja Apple Muzeum Polska, ul. Ogrodowa 17, 05-504 Łoś, Poland, KRS 0000750925, tax ID (NIP) 1231412370, REGON 381422763. Contact on personal data matters: e-mail applemuzeumpolska@gmail.com, phone +48 603 042 700. The Foundation has not appointed a data protection officer.
2. Purposes, legal bases and retention periods
| Purpose | Data | Legal basis (GDPR) | How long |
|---|---|---|---|
| Fulfilling the order: payment, shipping, contact about the order | name, e-mail, phone, delivery address, parcel locker code, order contents, payment status | Art. 6(1)(b) (performance of a contract) | until the order is fulfilled and settled, then as in the next two rows |
| Tax and accounting obligations | data from the sales document: name, address, tax ID (for an invoice), amount | Art. 6(1)(c) (legal obligation) | 5 years from the end of the year in which the tax obligation arose |
| Withdrawal from the contract, returns, complaints, defending and pursuing claims | order data, withdrawal statements, correspondence | Art. 6(1)(f) (legitimate interest) or (c) where required by law | until claims become time-barred |
| Replying to an enquiry about the offer (form, e-mail) | name, e-mail, phone, town, date, number of participants, message | Art. 6(1)(b) (steps taken at the person’s request before entering into a contract) or (f) | until the correspondence ends, then for 12 months |
| Website and payment security, fraud prevention | IP address, technical data, server logs | Art. 6(1)(f) | according to the providers’ settings, usually up to 30 days |
| Running social media profiles | data published by users, reactions, messages | Art. 6(1)(f) | until the content is deleted or according to the platform’s rules |
We do not currently run a newsletter or any marketing that requires consent. If this changes, this policy will be updated.
3. Recipients of data
- Stripe Payments Europe, Limited (Ireland) and Stripe group companies: payment processing. Stripe may process data as an independent controller, e.g. to prevent fraud and meet legal requirements, and as our processor. Details: Stripe privacy policy.
- Carriers: InPost and Poczta Polska. They receive the data needed to deliver the parcel.
- Accounting office and legal advisers: entities providing accounting and legal services to the Foundation.
- IT service providers: Hostinger, Cloudflare and Google (website hosting and infrastructure, e-mail).
- Public authorities, where required by law.
4. Transfers of data outside the European Economic Area
Some providers (including Stripe, Cloudflare and Google) may process data in the United States. Transfers are based on the European Commission’s adequacy decision for organisations participating in the EU-US Data Privacy Framework or on standard contractual clauses. A copy of the safeguards can be obtained by writing to the e-mail address in section 1.
5. Rights of the data subject
- Everyone has the right to access their data, to have it rectified or erased, to restrict its processing and to data portability.
- Everyone has the right to object to processing based on legitimate interest.
- Where processing is based on consent, it can be withdrawn at any time. This does not affect the lawfulness of processing before consent was withdrawn.
- Everyone has the right to lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw).
- You can exercise your rights by e-mail to the address in section 1. The Foundation replies within one month.
6. Obligation to provide data and automated decisions
Providing data is voluntary but necessary to make a purchase and to reply to an enquiry. Without it the Foundation cannot fulfil the order or reply to the enquiry. The Foundation does not make automated decisions about individuals, including profiling. Stripe may use its own fraud detection mechanisms.
7. Cookies and browser storage
The use of cookies and browser storage is described in the Cookie policy available on the website.
8. External services
Payments via buycoffee.to are handled by the operator of that service as an independent controller. The Foundation’s profiles on Instagram, YouTube, Facebook, X and LinkedIn are subject to the privacy policies of their operators.
9. Changes to the policy
The policy may change, e.g. because of changes in the law or in the tools used on the website. The current version is always available on the website.