1. Data Controller
The controller of your personal data is Stowarzyszenie GOFUS Polska (GOFUS Polska Association) with its registered office in Szczecin,
ul. Senna 54, 70-893 Szczecin, Poland, registered in the National Court Register under KRS: 0000872273,
NIP: 8513255198, REGON: 387724330 (hereinafter: the "Controller").
Contact for data protection matters:
info@gofus.pl
or in writing to the Controller's registered address.
2. Purposes and Legal Bases of Processing
We process your personal data for the following purposes and on the following legal bases:
- Administration of association membership — on the basis of the membership declaration and the association's statutes (Art. 6(1)(b) GDPR).
- Processing of membership fees — on the basis of obligations arising from accounting regulations (Art. 6(1)(b) and (c) GDPR).
- Organisation of tournaments and events — for the purpose of facilitating participation (Art. 6(1)(b) GDPR).
- Handling enquiries submitted via contact forms — on the basis of your consent (Art. 6(1)(a) GDPR).
- Sending marketing communications (newsletter, tournament and project updates) — solely on the basis of your freely given consent (Art. 6(1)(a) GDPR and applicable electronic services legislation).
- Processing of donations and public acknowledgement of contributions (where you have consented) — Art. 6(1)(c) and (a) GDPR.
- Website traffic analysis (analytical cookies, Google Analytics) — on the basis of your consent given in the cookie banner (Art. 6(1)(a) GDPR).
- Online marketing (marketing cookies, Meta Pixel) — on the basis of your consent given in the cookie banner (Art. 6(1)(a) GDPR).
- Assertion and defence of legal claims — on the basis of the Controller's legitimate interests (Art. 6(1)(f) GDPR).
3. Recipients of Personal Data
Your data may be disclosed to the following categories of recipients:
- Hosting provider — nazwa.pl S.A., Kraków, Poland (website data storage).
- Bank — Santander Bank Polska SA (processing of membership fee and donation payments).
- Accounting firm / tax adviser — handling the association's financial records.
- Google LLC (Google Analytics, Google Tag Manager) — traffic analytics (only with your consent).
- Meta Platforms Ireland Ltd. (Meta Pixel, Facebook) — online marketing (only with your consent).
- Public authorities — solely where required by law.
- Association partners — solely with your separate consent.
4. Transfers of Data Outside the EEA
Some of our service providers (Google, Meta) are based in the United States. Transfers of data
to the USA are carried out on the basis of the European Commission Implementing Decision of 10 July 2023
on the adequacy of protection provided by the EU-US Data Privacy Framework, or
on the basis of Standard Contractual Clauses approved by the European Commission.
Data is transferred only where you have consented to analytical or marketing cookies.
5. Retention Periods
- Members' data — for the duration of membership, and thereafter until mutual claims become time-barred.
- Data for membership fee and donation accounting — for 5 years from the end of the year in which the last transaction occurred (tax retention obligation).
- Contact form data — until the enquiry is answered and for 3 months thereafter.
- Marketing data — until consent is withdrawn.
- Cookie data — in accordance with the validity period of each cookie (see Section 9).
6. Your Rights
You have the right to:
- Access your personal data (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of data — "right to be forgotten" (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object to processing (Art. 21 GDPR)
- Withdraw consent at any time (without affecting the lawfulness of processing carried out prior to withdrawal)
- Lodge a complaint with the President of the Personal Data Protection Office (UODO)
(uodo.gov.pl)
To exercise any of these rights, please contact us at: info@gofus.pl.
7. Voluntary Nature of Data Provision
Providing personal data is voluntary; however, in certain cases it is necessary to achieve specific purposes:
association membership requires the provision of identification and contact data; handling an enquiry
requires a first name and email address. Failure to provide such data will prevent the respective purpose from being fulfilled.
8. Profiling and Automated Decision-Making
Your data is not used for automated decision-making,
including profiling within the meaning of Art. 22 GDPR.
An exception applies to analytical and marketing cookies (where consent has been given), which may
create anonymous statistical profiles — without producing legal or similarly significant effects.
9. Cookies
The website uses cookies in three categories:
a) Necessary cookies (always active)
Essential for the proper functioning of the website — including storing your language preference and cookie settings.
No consent required. Legal basis: Art. 6(1)(f) GDPR.
b) Analytical cookies (consent required)
Google Analytics / Google Tag Manager — measurement of traffic, traffic sources, and user behaviour.
Helps us improve the website.
Provider: Google LLC (USA). Validity: up to 24 months. Can be disabled in cookie settings.
c) Marketing cookies (consent required)
Meta Pixel (Facebook) — measurement of advertising campaign effectiveness
and personalisation of content within Meta services.
Provider: Meta Platforms Ireland Ltd. (Ireland) / Meta Platforms Inc. (USA).
Validity: up to 13 months. Can be disabled in cookie settings.
You may change your preferences at any time by clicking
Cookie settings
in the website footer. You may also delete cookies through your browser settings.
10. Information Clause for Association Members
Persons submitting a membership application additionally receive an
extended GDPR information clause attached to the membership application form.
The clause contains detailed information on all purposes of processing personal data
in connection with association membership.
11. Data Security
We implement appropriate technical and organisational measures to protect personal data
against unauthorised access, loss, destruction or alteration. The website uses an encrypted
HTTPS connection, and access to data is restricted to authorised personnel only.
12. Changes to this Privacy Policy
We reserve the right to amend this Privacy Policy.
We will notify you of any material changes in advance via the website or by email
(where we hold your address). The current version of the Privacy Policy is always available at this address.
Effective from: 1 June 2026