1. Data controller
The controller of your personal data is Fundacja PACT with its registered office in Gdańsk, KRS 0001244789, NIP 5842885651, REGON 544885448.
For privacy questions or to exercise your rights, contact the Foundation at office@pact.ngo.
2. Data we process and why
PACT registrations. The form may include your name, email address, organisation or institution, position or role, selected area of collaboration and message. We use this data to receive and respond to your registration, send a confirmation and continue correspondence about collaboration.
Direct contact. When you contact the Foundation, we process the information in your message and data needed to conduct the correspondence.
PACT Pulse poll. We store your selected response with a one-way hash of a random browser identifier. This recognises an earlier vote and limits repeat responses. Results are shown only in aggregate; we do not store a name, email address or IP address with a vote.
Website operation and security. The server may process technical data transmitted during a connection, such as an IP address, request time, requested resource, browser type and error information. This is used to deliver the website, diagnose problems and protect it against abuse.
3. Legal bases
We process registration form data on the basis of the consent given when it is submitted — Article 6(1)(a) GDPR. You may withdraw consent at any time without affecting the lawfulness of earlier processing.
Correspondence, the poll, website protection, abuse prevention and the establishment, exercise or defence of legal claims rely on the Foundation’s legitimate interests — Article 6(1)(f) GDPR. These interests are efficient communication, understanding audience views and keeping the service secure.
Where the law requires us to retain information, Article 6(1)(c) GDPR applies.
4. Providing data is voluntary
Providing data is voluntary. Fields marked as required are needed to submit and handle a registration. Without them, the Foundation cannot receive the form or respond to a message. Taking part in the poll is voluntary.
5. Recipients
Data may be accessed by people authorised by the Foundation and by providers needed to operate the website and communications, especially hosting, email, system maintenance and security providers. Providers processing data for the Foundation act under appropriate agreements and only on its instructions.
Data may be disclosed to public authorities where required by law.
6. Transfers outside the EEA
Some technology providers may process data outside the European Economic Area. Where this occurs, the Foundation uses mechanisms provided by the GDPR, such as a European Commission adequacy decision or Standard Contractual Clauses, and applies required safeguards. Details of safeguards can be requested using the Foundation’s contact address.
7. How long we keep data
Registration and correspondence data is kept for the time needed to handle the matter and any resulting collaboration, followed by the period required to demonstrate proper handling or defend legal claims. Data processed solely on consent is deleted after consent is withdrawn unless another legal basis requires continued retention.
Poll data is kept while the poll is operated and analysed. Technical logs are retained as long as needed for security and diagnostics, and longer only where required by law or an incident investigation.
8. Cookies and browser storage
The website does not use marketing or analytics cookies. It stores the language choice and a random PACT Pulse poll identifier in localStorage. The identifier helps recognise an earlier vote; a hash of it is stored on the server.
localStorage data remains in the browser until the user removes it or clears website data. Blocking localStorage does not prevent browsing, but the language choice or an earlier vote may not be remembered.
9. Your rights
Within the limits of the GDPR, you have the right to access and receive a copy of your data, rectify it, erase it, restrict processing, port data and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time.
Send requests to office@pact.ngo. We may request information needed to confirm the identity of the person making the request.
You may also lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland, if you believe that processing infringes data protection law.
10. Automated decisions
The Foundation does not make decisions about website users based solely on automated processing that produce legal or similarly significant effects. Data is not used for marketing profiling.
11. Security and policy changes
The Foundation applies technical and organisational measures appropriate to the nature of the data and risk to protect it against loss, unauthorised access, alteration or disclosure.
We may update this policy when the website’s features, data processing or legal requirements change. The current version and effective date are always published here.