Privacy policy

Effective 10 September 2026 · Version 1.2 · Applies to sbos.pl

This document explains what personal data we collect through sbos.pl, why we collect it, who processes it on our behalf and what rights you have. We have tried to write it plainly — without jargon, and without describing things that do not apply to us.

01Who is the controller of your data

The controller of your personal data — the entity that decides why and how it is processed — is:

We have not appointed a data protection officer. For any matter concerning personal data, write directly to info@sbos.pl.

We process data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and the Polish Personal Data Protection Act of 10 May 2018.

02What data we process and why

The site collects data in three situations — and only these three:

In addition, we store one cookie recording your cookie choices — described in §8 and in full in our cookie policy.

03Is providing data mandatory

Providing data is entirely voluntary. You can browse the whole site without filling in anything. If you do want to apply, we need an e-mail address and — for an organisation — the organisation name and a contact person, or, if you apply as a private individual, your full name. Without them we cannot review the application or reply to you. All other form fields are optional.

04Who we entrust data to

We do not sell or share your data with anyone for commercial purposes. We do use technical service providers who process data solely on our instructions, under data processing agreements concluded in accordance with Art. 28 GDPR:

Data may also be disclosed to public authorities where required by law. Beyond that, access is limited to authorised members and associates of the Association, strictly to the extent needed to handle applications.

05Transfers outside the EEA

Vercel and Resend are established in the United States, which means your data may be processed outside the European Economic Area. Such transfers rely on the safeguards set out in Chapter V GDPR — Standard Contractual Clauses approved by the European Commission and, to the extent applicable, the European Commission's adequacy decision under the EU–U.S. Data Privacy Framework.

You may obtain a copy of the safeguards applied by writing to info@sbos.pl.

06How long we keep data

• Applications that did not lead to cooperation — up to 24 months from the last contact, after which they are deleted.
• Applications that led to membership — for the duration of membership and thereafter for the period required by accounting law and limitation periods for claims.
• E-mail correspondence — for as long as needed to conclude the matter, and no longer than 24 months from the last message.
• Server logs — short-term, per our hosting provider's policy; used only for diagnostics and never combined with form data.
• The cookie recording your cookie choices — 12 months, after which we ask again.

If you withdraw consent, we delete data processed on that basis without undue delay — unless we must retain it to establish, exercise or defend legal claims.

07Your rights

In connection with the processing of your data you have the right to:

• access your data and obtain a copy of it;
• rectification of inaccurate data and completion of incomplete data;
• erasure (the “right to be forgotten”);
• restriction of processing;
• data portability — receiving your data in a structured, machine-readable format;
• object to processing based on our legitimate interest;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, write to info@sbos.pl. We respond without undue delay and at the latest within one month of receiving your request.

08Cookies

The site stores a single cookie in your browser — sbos-consent — recording your consent choices, so that we do not have to ask on every visit. It contains nothing that could identify you.

The functional and analytics categories are off by default and are enabled only if you consent. The full description is in our cookie policy.

Change cookie settings

09Data security

• All traffic is transmitted over an encrypted HTTPS (TLS) connection.
• The form is protected against automated spam, and input is validated and escaped server-side.
• API keys for external services are held server-side only and never reach the browser.
• Fonts and JavaScript libraries are served from our own origin, so merely viewing a page does not disclose your IP address to external content delivery networks.
• Access to applications is limited to authorised persons.

10No profiling or automated decisions

We do not profile visitors and we make no decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you (Art. 22 GDPR).

11Links to other sites

The site links to external resources — among them the knowledge base at wiedza.sbos.pl and PDF copies of legal acts stored in our hosting provider's file storage service. Once you follow such a link, the privacy rules of the destination apply. We are not responsible for the content or privacy practices of external sites.

12Changes to this policy

We may update this policy if the way the site works changes, or if the law changes. The current version is always available at this address, with its effective date and version number stated at the top. We will notify you of material changes — such as adding a new cookie category — by asking for your consent again.

13Contact

For any data protection matter, write to info@sbos.pl or use the contact details in §1.

This is an English translation provided for convenience. In case of any discrepancy, the Polish version prevails.