Privacy policy

Student Support privacy policy

This privacy policy describes how the personal data of people using the website https://studentsupport.pl and people contacting Student Support Wioletta Boćkowska, in particular through forms, email, telephone or other communication channels, are processed.

This document has been prepared to fulfil the information obligations arising from Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, hereinafter referred to as the “GDPR”.

Data controller
Contact about data protection
What data we may process
Purposes, legal bases and periods of data processing
Providing data voluntarily
Data recipients and processors
Transfers of data outside the European Economic Area
Cookies and similar technologies
Marketing and electronic communications
Rights of data subjects
Right to lodge a complaint with the President of UODO
Data security
Data of children and minors
Automated decision-making and profiling
Changes to the privacy policy

1. Data controller

The controller of your personal data is:

Student Support Wioletta Boćkowska
entered in the Central Registration and Information on Business
NIP: 1231529988
address: ul. Ogrodowa 16, 05-500 Mysiadło
website: https://studentsupport.pl
email: info@studentsupport.pl
telephone: +48 515 693 084

In the remainder of this privacy policy, the data controller is also referred to as the “Controller”, “Student Support”, “we” or “us”.

2. Contact about data protection

You can contact the Controller about any matter concerning the processing of personal data, including to exercise your rights under the GDPR:

by email: info@studentsupport.pl,
by telephone: +48 515 693 084,
in writing: ul. Ogrodowa 16, 05-500 Mysiadło.

The Controller has not appointed a data protection officer because, in the Controller’s assessment, there is no legal obligation to do so. Contact about personal data is handled directly by the Controller.

3. What data we may process

The scope of the data processed depends on how you use the Student Support website or services. In particular, we may process:

identification data, such as your first name and surname,
contact data, such as your email address, telephone number and correspondence address,
data concerning your enquiry, request, ordered service or correspondence,
billing data, if a contract is concluded or an accounting document is issued,
business data, if you contact us as a business owner or a representative of an entity,
technical and usage data relating to use of the website, such as your IP address, cookie identifiers, device, browser and operating system information, visit time and activity on the website,
other data provided voluntarily in a form, email, telephone conversation or other communication.

Please do not provide special categories of personal data referred to in Article 9 of the GDPR, such as data concerning health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, biometric data or data concerning sexuality, unless this is actually necessary to handle your matter and there is an appropriate legal basis for processing them.

4. Purposes, legal bases and periods of data processing

We process your personal data only for specific, lawful purposes. The most common purposes, legal bases and processing periods are set out below.

Handling enquiries sent through the contact form, email, telephone or other communication channels

Scope of data: First name, surname, email address, telephone number, message content and other data provided in the enquiry.

Legal basis: Article 6(1)(f) of the GDPR – the Controller’s legitimate interest in responding and communicating; for enquiries aimed at concluding a contract, also Article 6(1)(b) of the GDPR.

Retention period: for the time needed to handle the enquiry, and then until any potential claims become time-barred or the correspondence ends.

Concluding and performing a contract for services

Scope of data: Identification data, contact data, service-related data and billing data.

Legal basis: Article 6(1)(b) of the GDPR – performance of a contract or taking steps before entering into it.

Retention period: for the duration of the contract, and then for the limitation period for claims arising from the contract.

Fulfilling bookkeeping, tax and accounting obligations

Scope of data: Identification data, business data, NIP, address data and billing data.

Legal basis: Article 6(1)(c) of the GDPR – a legal obligation to which the Controller is subject.

Retention period: for the period required by tax, accounting and other applicable legal provisions.

Pursuing, establishing or defending claims

Scope of data: Data needed to establish facts relating to a claim, contract, contact or use of the website.

Legal basis: Article 6(1)(f) of the GDPR – the Controller’s legitimate interest in protecting the Controller’s rights and interests.

Retention period: until the limitation periods for claims expire or proceedings end.

Marketing our own services, including contacting people who have expressed an interest in the offer

Scope of data: First name, surname, email address, telephone number, contact history and service preferences.

Legal basis: Article 6(1)(f) of the GDPR – the Controller’s legitimate interest; to the extent required by electronic communications legislation – the user’s consent.

Retention period: until you object, withdraw consent or the marketing purpose ceases to apply.

Sending a newsletter or other commercial information, if such a service is available

Scope of data: Email address and, where applicable, first name and communication preferences.

Legal basis: Article 6(1)(a) of the GDPR – consent; additionally, consent required by electronic communications legislation.

Retention period: until consent is withdrawn, you unsubscribe or the newsletter service ends.

Ensuring website operation, security, error diagnosis and protection against misuse

Scope of data: IP address, technical device data, server logs and data about activity on the website.

Legal basis: Article 6(1)(f) of the GDPR – the Controller’s legitimate interest in maintaining the security and proper operation of the website.

Retention period: for the time necessary to ensure security and diagnose errors, usually no longer than 12 months, unless the data are needed for longer to investigate an incident or pursue claims.

Website analytics, statistics and improvement

Scope of data: Technical data, cookie identifiers and information about how the website is used.

Legal basis: Article 6(1)(a) of the GDPR – consent, if analytics uses cookies or similar technologies that require consent; in limited cases, Article 6(1)(f) of the GDPR.

Retention period: until consent is withdrawn or for the lifetime of the cookie specified in the cookie settings.

5. Providing data voluntarily

Providing personal data is generally voluntary, but may be necessary to:

respond to an enquiry,
prepare an offer,
conclude or perform a contract,
issue an invoice or another accounting document,
carry out other actions you request.

Failure to provide data may make it impossible to handle an enquiry, conclude a contract, provide a service or carry out other actions for which the data are necessary.

6. Data recipients and processors

Your personal data may be disclosed to entities that support the Controller’s business activities, in particular:

hosting and website maintenance providers,
email and communication tool providers,
analytics and marketing tool providers, if those tools are used on the website,
an accounting firm, law firms, tax advisers or other professional advisers,
payment operators, banks or financial service providers, if needed for billing and payments,
entities entitled to obtain the data under legal provisions.

Entities that process personal data on our behalf do so under appropriate data processing agreements and only in accordance with our instructions, unless the law provides otherwise.

If an entity processes data for its own purposes and independently determines how they are processed, it acts as a separate data controller. In that case, it is independently responsible for its processing of the data.

7. Transfers of data outside the European Economic Area

As a rule, we try to use service providers that process data within the European Economic Area. However, some providers of IT, analytics, marketing or communication tools may process data outside the European Economic Area.

If personal data are transferred outside the European Economic Area, this takes place only when the conditions set out in the GDPR are met, in particular where:

the European Commission has adopted an adequacy decision for the country or entity concerned,
standard data protection clauses adopted by the European Commission have been applied,
other appropriate safeguards provided for in the GDPR have been applied,
the transfer is based on another ground permitted by the GDPR.

You can obtain more information about the safeguards used by contacting the Controller using the details in the section Contact about data protection.

8. Cookies and similar technologies

The website may use cookies and similar technologies, such as pixels, tags, online identifiers, analytics scripts or tools for measuring website traffic.

Cookies are small files stored on or read from a user’s device when the website is used. Some cookies are necessary for the website to work properly and may be used without the user’s consent if they are necessary to provide an electronic service or a function expressly requested by the user.

Other cookies, in particular analytics, marketing, advertising, social media or activity-tracking cookies, are used only after obtaining your consent, where consent is required by applicable law.

The website may use the following categories of cookies:

necessary cookies – needed for the website to work properly, for security, to remember privacy settings or to handle forms,
analytics cookies – help measure the number of visits, traffic sources and how the website is used,
functional cookies – enable users’ preferences to be remembered,
marketing cookies – used for advertising, remarketing or measuring campaign effectiveness, if such tools are used.

You can give, refuse or change your cookie consent in the settings of the cookie banner available on the website. You can also restrict or delete cookies through your web browser settings. Changing browser settings may affect how some website functions work.

If a separate cookie policy or consent management panel has been implemented on the website, detailed information about individual cookies, their providers, purposes and lifetimes should be available in that panel or the separate cookie policy.

9. Marketing and electronic communications

The Controller may market its own services, in particular by responding to enquiries, presenting an offer or contacting people who have expressed an interest in Student Support services.

The sending of commercial information by electronic means or the use of telecommunications terminal equipment and automated calling systems for direct marketing takes place only where there is an appropriate legal basis, in particular where you have given the required consent.

You can withdraw consent at any time by contacting the Controller or using the unsubscribe mechanism, if one is provided in the message. Withdrawal of consent does not affect the lawfulness of activities carried out before it was withdrawn.

10. Rights of data subjects

In connection with the processing of your personal data, you have the rights provided for in the GDPR, to the extent and on the terms set out in law.

You have the right to:

access your data – obtain confirmation of whether we process your data and receive a copy of the data,
rectification of your data – correct inaccurate data or complete incomplete data,
erasure of your data – request erasure in the cases provided for in the GDPR,
restriction of processing – request restrictions on operations involving your data in certain cases,
data portability – receive your data in a structured, commonly used format where processing is based on consent or a contract and is carried out by automated means,
object – to processing based on the Controller’s legitimate interest, including direct marketing,
withdraw consent – where data are processed on the basis of consent; withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn,
not be subject to decisions based solely on automated processing, including profiling, where such a decision would produce legal effects concerning you or similarly significantly affect you.

You can submit a request to exercise your rights using the contact details in the section Contact about data protection.

We will respond to your request without undue delay and no later than one month after receiving it. Where a request is complex or there are many requests, this period may be extended by a further two months. In that case, we will inform you of the extension and the reasons for it within one month of receiving your request.

If we cannot identify the person making the request, we may ask for additional information necessary to confirm their identity.

11. Right to lodge a complaint with the President of UODO

If you believe that the processing of your personal data infringes the GDPR or other personal data protection provisions, you have the right to lodge a complaint with the President of the Personal Data Protection Office.

Supervisory authority details:

President of the Personal Data Protection Office
ul. Stanisława Moniuszki 1A
00-014 Warszawa
website: https://uodo.gov.pl

12. Data security

The Controller applies appropriate technical and organisational measures to protect personal data, proportionate to the risks associated with their processing.

The measures used may include, in particular:

controlling access to data,
using passwords and access permissions,
IT system safeguards,
using trusted providers’ services,
entering into data processing agreements with processors,
limiting access to data to people who need it to carry out specified tasks,
monitoring and responding to security incidents.

People acting under the Controller’s authority who have access to personal data are required to maintain confidentiality.

13. Data of children and minors

If minors’ data are processed as part of Student Support services, processing takes place only to the extent necessary to handle the matter, provide the service, contact a parent or legal guardian, or fulfil legal obligations.

If parental or legal guardian consent is required to use a service, the Controller may ask for confirmation of that consent or for the parent’s or legal guardian’s contact details.

We ask minors not to provide us with personal data without a parent’s or legal guardian’s knowledge and consent where such consent is required.

14. Automated decision-making and profiling

Your personal data are not used to make decisions based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.

If the Controller introduces such activities in the future, this privacy policy will be updated accordingly and users will receive the information required by the GDPR.

15. Changes to the privacy policy

The Controller may update this privacy policy, in particular if legal provisions, the way the website operates, the tools used, the scope of services or the way personal data are processed change.

The current version of the privacy policy is published on the website
https://studentsupport.pl.

Last updated: 20 October 2026.