Controller
The data controller is: BioMedical-IT Adrian Tkacz
Email: dola@creatidy.com
Phone: +48 608 464 101
When we process data
We process data when:
- you contact us by phone or email,
- you ask about a date,
- you book a service,
- you take part in a service,
- a sales document is needed,
- a deposit is paid or returned,
- safety, a complaint, damage or another service-related event needs to be documented.
What data we process
Usually, this may include:
- your name or the name used in contact,
- phone number,
- email address,
- preferred date,
- number of participants,
- contact language,
- short information about sailing experience,
- data needed for a sales document, if required,
- deposit-related data, if applicable,
- basic service, safety and weather documentation.
We do not routinely collect:
- PESEL numbers,
- document scans,
- sailing license copies,
- health data,
- payment card data.
Purposes and legal bases
We process data for:
- handling inquiries and bookings: GDPR Art. 6(1)(b),
- providing the service: GDPR Art. 6(1)(b),
- tax and accounting obligations: GDPR Art. 6(1)(c),
- safety, service documentation, deposits and possible claims: GDPR Art. 6(1)(f).
How long we keep data
- Loose inquiries without a booking: usually up to 6 months.
- Cancelled bookings without payment and without an incident: usually up to 12 months.
- Documents related to a completed service, sale, deposit and tax documentation: for the period required by tax rules; operationally, usually until the end of the 6th year after the year in which the service was provided.
- Documents related to damage, a complaint, dispute or incident: longer if needed to explain the matter or defend against claims.
Recipients
Data may be shared only where needed with:
- an accountant,
- a tax or legal adviser,
- an insurer, if an incident occurs,
- public authorities, if required by law,
- an IT or hosting provider, if technically necessary.
Data is not sold.
Website
In the current version, the website has:
- no public contact form,
- no newsletter,
- no marketing automation,
- no external analytics tools or tracking scripts.
The server may record basic technical connection data for website security and maintenance.
Customer rights
You may request:
- access to your data,
- correction of your data,
- deletion where legally possible,
- restriction of processing,
- objection where processing is based on legitimate interests,
- a complaint to the supervisory authority.
Deletion may not be possible where the data must be kept for tax or accounting obligations, or to establish, pursue or defend against claims.
No automated decision-making
We do not make automated decisions about customers and we do not use marketing profiling.