Last updated: July 2026

Privacy Policy

1. Data controller

The controller of personal data is Fundacja Świat Bioniki, with its registered office in Poznań, Poland (the foundation is currently being registered in the National Court Register; the KRS, NIP and REGON numbers will be added here as soon as registration is complete). For matters concerning data protection, please use the contact form. The foundation has not appointed a Data Protection Officer, as this is not currently required under the GDPR given the scale of its activity.

2. What data we process and why

Each purpose of processing is listed separately below, together with its legal basis:

• Handling the contact form: name, e-mail address, message content. Legal basis: Article 6(1)(f) GDPR (legitimate interest of the controller, namely responding to your enquiry).
• Newsletter: e-mail address. Legal basis: Article 6(1)(a) GDPR (your voluntary, separate consent). This service will be launched once the foundation's registration in the National Court Register is complete.
• Website traffic analytics: data on how the site is used, to the extent described in the Cookie Policy. Legal basis: Article 6(1)(a) GDPR (your consent given in the cookie banner).
• Pursuing the foundation's statutory purposes, for example documenting activities and financial reporting. Legal basis: Article 6(1)(c) GDPR (legal obligation) and Article 6(1)(f) GDPR (legitimate interest).

3. How long we keep your data

Data from the contact form is kept for as long as is necessary to handle your enquiry and for up to 12 months afterwards, in case we need to refer back to earlier correspondence. Data processed on the basis of consent (newsletter, analytics) is kept until that consent is withdrawn. Data we are required to keep under statutory provisions, such as the foundation's accounting records, is kept for the period set out in those provisions, as a rule 5 years counted from the end of the tax year in which the obligation arose.

4. Who we share data with

Data may be entrusted to the following categories of recipients, strictly to the extent necessary to achieve the purposes set out above:

• the website hosting provider (storage of data on the server),
• the provider of the mailbox that receives submissions from the contact form,
• Cloudflare, Inc., the provider of the anti-spam verification service (Cloudflare Turnstile), which processes IP addresses and technical browser data in order to distinguish a human from a bot.

We do not sell your data and we do not share it with third parties for marketing purposes.

5. Transfers outside the European Economic Area

The Cloudflare Turnstile service may process data on infrastructure located outside the EEA. Such transfers take place on the basis of standard contractual clauses approved by the European Commission, which Cloudflare applies as its transfer mechanism. For details, see the Cloudflare privacy policy available on the provider's website.

6. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Article 22 GDPR.

7. Your rights

You have the right to access your data, to have it rectified or erased, to restrict its processing, to data portability, and to object to processing based on legitimate interest. Where data is processed on the basis of consent, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. To exercise these rights, write to us through the contact form.

8. Right to lodge a complaint

If you believe that the processing of your data infringes the GDPR, you have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw).

9. Changes to this policy

We will announce any material changes to this policy by publishing an updated version on this page, together with the update date shown at the top of the document.

10. Contact