Privacy policy
Last updated:
This document explains what personal data we process when you use the multiskill.pl website, write to us or call us, order our services or take part in an event at which we provide an attraction. The terms “personal data”, “processing”, “controller” and “processor” have the meaning given to them in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter: GDPR).
1. Data controller
The controller of your personal data is MultiSkill Adrian Bokuniewicz, ul. Zaciszna 12, Tartak Brzóski, 96-325 Radziejowice, NIP 8451936469, REGON 385326967 (hereinafter: “MultiSkill” or “we”).
2. Data protection contact
You can contact us about any matter relating to personal data:
- by e-mail: biuro@multiskill.pl,
- by phone: +48 519 742 034,
- by post at the registered office address given in section 1.
We have not appointed a Data Protection Officer, as we are not required to do so.
3. Purposes, legal bases and retention periods
We only process the data needed for a given purpose. You will find an overview below.
| Purpose | What data | Legal basis | How long |
|---|---|---|---|
| Replying to an enquiry sent via the form, by e-mail or by phone | full name, e-mail address, phone number, company name, event details, content of the message | Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract); where you write on behalf of a company – Art. 6(1)(f) GDPR (our legitimate interest: communicating with clients) | until the correspondence ends and, if no cooperation follows, no longer than 3 years from the last contact |
| Preparing a quote, concluding and performing a contract | contact details, company details and details of contact persons, event details | Art. 6(1)(b) GDPR; for persons representing the client or designated as contacts – Art. 6(1)(f) GDPR | for the duration of the contract and then until the relevant limitation periods for claims expire |
| Settlements, accounting and taxes | data from invoices and accounting documents | Art. 6(1)(c) GDPR in conjunction with accounting and tax legislation | for the period required by that legislation – as a rule, 5 years from the end of the calendar year in which the tax payment deadline expired |
| Establishing, pursuing and defending legal claims | data needed to demonstrate the course of cooperation | Art. 6(1)(f) GDPR (our legitimate interest: protection of our rights) | until the limitation period for claims expires (Art. 118 of the Polish Civil Code) |
| Informing clients about our services (direct marketing) | full name, e-mail address, phone number, company name | Art. 6(1)(f) GDPR; sending commercial information by e-mail or SMS and contacting you by telephone for this purpose – only with your consent (Art. 398 of the Polish Electronic Communications Law Act) | until you object or withdraw your consent |
| Website visit statistics (Google Analytics 4) | cookie identifiers, device and browser information, pages visited, approximate location (without the full IP address) | Art. 6(1)(a) GDPR – your consent given in the cookie banner (and Art. 399 of the Polish Electronic Communications Law) | until consent is withdrawn; we retain data in Google Analytics for no longer than 14 months |
| Remembering your cookie choice | settings version, date and scope of consent | Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (obligation to demonstrate consent) and Art. 6(1)(f) GDPR | 12 months, after which the banner will appear again |
| Running our social media profiles (Facebook, Instagram, LinkedIn) and replying to messages sent there | profile name, profile picture, content of comments and messages, profile statistics | Art. 6(1)(f) GDPR (our legitimate interest: communication and brand promotion) | for as long as the profile is maintained or until the content is deleted; statistics – in accordance with the platform's settings |
| Website security and protection against abuse (e.g. form spam) | IP address, date and time of the request, browser information (server logs) | Art. 6(1)(f) GDPR (our legitimate interest: security of our systems) | for the period during which the hosting provider stores logs, usually no longer than a few weeks |
We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.
4. Event participants' data
Some of our attractions process event guests' data – for example photos and videos from photo booths and the 360° Photo Booth, iris photographs (Iris Photography), game and game-show results, or data collected in games at exhibition stands.
In such cases the data controller is usually our client – the event organiser, who decides why and how the data is collected. We process it on the organiser's behalf under a data processing agreement (Art. 28 GDPR). Information on the processing rules and your rights is then provided by the organiser. If you contact us about this, we will forward your request to the organiser and help them respond to it.
Once the event is over, we delete this data or hand it over to the organiser, in accordance with the contract.
5. Recipients of data
We do not sell personal data. We may only share it where this is necessary for the purposes described above, with the following categories of recipients:
- providers of hosting, e-mail and IT services,
- our accounting firm and legal advisers,
- subcontractors who help us deliver attractions and technical support for events (e.g. hosts, technicians, transport companies) – to the extent necessary to carry out the order,
- Google Ireland Limited – for Google Analytics, if you consent to it,
- social media operators – Meta Platforms Ireland Limited (Facebook, Instagram) and LinkedIn Ireland Unlimited Company – in connection with running our profiles; with regard to profile statistics we are joint controllers with them (Art. 26 GDPR), and the rules of this cooperation are described by these platforms in their privacy policies,
- public authorities and other entities, where required by law.
Entities processing data on our behalf do so under data processing agreements and only in accordance with our instructions.
6. Transfers of data outside the European Economic Area
As a rule, we process data within the EEA. However, some service providers (e.g. Google, Meta, LinkedIn) may transfer data to countries outside the EEA, in particular to the USA. This takes place on the basis of a European Commission adequacy decision (in the case of the USA – for entities certified under the EU-U.S. Data Privacy Framework) or standard contractual clauses adopted by the European Commission. You can obtain a copy of these safeguards by writing to us.
7. Your rights
In connection with the processing of your data, you have the right to:
- access your data and receive a copy of it (Art. 15 GDPR),
- rectification of your data (Art. 16 GDPR),
- erasure of your data (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- portability of data processed on the basis of a contract or consent (Art. 20 GDPR),
- object to processing based on our legitimate interest (Art. 21 GDPR) – in the case of direct marketing you may object at any time and without giving reasons,
- withdraw your consent at any time – this does not affect the lawfulness of processing carried out before its withdrawal,
- lodge a complaint with the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warszawa) if you believe that we are processing your data unlawfully.
To exercise these rights, write to biuro@multiskill.pl. We will reply without undue delay and no later than within one month. We may ask for information needed to confirm your identity.
8. Voluntary provision of data
Providing your data is voluntary. However, without your full name and e-mail address or phone number we will not be able to reply to your enquiry, and without the data required by law we will not be able to conclude a contract or issue an invoice.
9. Cookies
Cookies are small text files saved on your device by your browser. On multiskill.pl we use:
- essential browser storage – without them the website could not remember your choice in the cookie banner; they do not require consent,
- analytics cookies (Google Analytics 4) — analytics and its cookies start only with your consent. Without consent we do not connect to Google for analytics. Advertising consent remains denied.
| Name | Provider | Purpose | Type | Expiry |
|---|---|---|---|---|
multiskill-consent-v1 (localStorage) | multiskill.pl | remembering your cookie choice | necessary | 1 year |
_ga | distinguishing users in statistics | analytics | 2 years | |
_ga_* | maintaining session state in statistics | analytics | 2 years |
Browser localStorage remembers consent for 12 months under multiskill-consent-v1 and your theme under theme. These settings remain on your device. Clearing storage shows the banner again.
You can change or withdraw your consent at any time using the button (also in the website footer). You can also delete or block cookies in your browser settings – some website features may then work differently.
10. Security
We apply technical and organisational measures appropriate to the risk, including an encrypted HTTPS connection across the entire website, restricted access to data and spam protection for the form. Messages sent via the form go directly to our e-mail inbox and are not stored in a database on the website's server.
If a personal data breach occurs that is likely to result in a high risk to your rights or freedoms, we will inform you without undue delay and, where required by law, we will report it to the President of the Polish Data Protection Authority (UODO).
11. Changes to this policy
We update this policy when the law or the way we process data changes. The current version is always available on this page, and the date of the last change is shown at the top.