Privacy Policy
Prepared and reviewed by the Foundation; final sign-off by qualified legal counsel is pending. The Polish version prevails in case of discrepancy.
1. Data controller
The controller is Fundacja na rzecz Integracji i Rozwoju Nowoczesnych Technologii oraz Sztucznej Inteligencji w Branży Filmowej ARTOS (in English: Foundation for Integration and Development of New Technologies and Artificial Intelligence for the Film Industry ARTOS; operating name “ARTOS Foundation”), seated at ul. Adama Borkiewicza 6 lok. 49, 00-712 Warszawa, Poland; KRS 0001221559, NIP 5214151555, REGON 543915897 (the “Foundation” or “controller”).
Data-protection contact: contact@artosfoundation.ai.
The Foundation has not appointed a Data Protection Officer; data-protection matters are handled directly by the controller at the email above. This English version is a courtesy translation — in case of discrepancy, the Polish version (Polityka prywatności) prevails.
2. Purposes, data, and legal bases
| Purpose | Data categories | Legal basis (GDPR) |
|---|---|---|
| Creating/running the member account, authentication, member-area services | name, email, hashed password, account ID | art. 6(1)(b) contract |
| Public listing of a member on the “community” page (name, optional organization) | name, organization name | art. 6(1)(a) consent (separate checkbox) |
| Contact form and correspondence | data in the message, email | art. 6(1)(f) legitimate interest (handling enquiries) |
| Donations | name, email, transaction data (payment-instrument data handled by the operator) | art. 6(1)(b)/(f) and legal (accounting) duties |
| Newsletter | email, name | art. 6(1)(a) consent, plus art. 10 UŚUDE / direct-marketing rules |
| Security, logs, abuse prevention | IP address, session/technical data, logs | art. 6(1)(f) legitimate interest |
| Claims, defence, complaints | data needed for the matter | art. 6(1)(f) and legal duties |
| Legal obligations (accounting, tax) | transaction and ID data | art. 6(1)(c) |
| Accountability — consent register (content, version, acceptance date of Terms and Policy) | consent flags, date, document version | art. 6(1)(c) and (f) (art. 5(2) GDPR) |
3. Whether data is required
Name, email, and password are voluntary but necessary to create an account; without them the account contract cannot be concluded. Consents for the public members list, the organization name, and the newsletter are entirely optional and do not condition account creation.
4. Recipients and processors
The controller uses trusted providers under art. 28 GDPR data-processing agreements:
- Supabase — database hosting and authentication (account data; passwords stored hashed), and delivery of account-related transactional emails (registration confirmation, password reset).
- Vercel — app hosting, server rendering, logs (serverless functions run in region iad1 — Washington, USA).
- PayU S.A. — payment operator for donations; a licensed Polish payment institution seated in Poznań, handles payment data under its own privacy policy.
- Newsletter delivery provider — only if and when a newsletter is launched; until then no data is shared with any provider for this purpose.
Data may be disclosed to public authorities where required by law.
5. Transfers outside the EEA
- Some providers (Supabase, Vercel) may process data on servers in the United States, which is a transfer outside the EEA.
- Transfers rely on: (a) the European Commission adequacy decision under the EU–US Data Privacy Framework, where the provider holds an active DPF certification; and (b) Standard Contractual Clauses (SCCs) as a supplementary safeguard and fallback should the DPF status change.
- You may request a copy of the safeguards used at contact@artosfoundation.ai.
6. Retention
Account data is kept for the life of the account contract and deleted promptly on account deletion, except data required by law. Donation accounting data is kept for the period required by accounting and tax law (as a rule 5 years from the end of the relevant year). Consent-based data (members list, newsletter) is kept until consent is withdrawn. Legitimate-interest data is kept until an effective objection or the purpose ends; claims data until limitation periods expire.
7. Your rights
You have the rights of access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interest, and withdrawal of consent at any time (without affecting the lawfulness of prior processing). Exercise via contact@artosfoundation.ai. You may lodge a complaint with the supervisory authority, the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
8. Automated decisions
No decisions producing legal effects are made solely by automated processing, including profiling.
9. Cookies
The Service uses cookies strictly necessary to keep the logged-in session (authentication); these require no consent. The Service currently uses no analytics or marketing cookies. Should any be introduced, they will run only after consent via a cookie banner, withdrawable at any time.
10. Changes
The controller may update this Policy and will notify Members of material changes by email or in-Service. The date and version appear at the top. The Polish version prevails in case of discrepancy.