Privacy policy

This policy explains what personal data we process on the Road Show website (roadshow.com.pl), why, for how long, and what rights data subjects have. It is applied in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

1. Data controller

The controller of personal data is Fundacja Centrum Inicjatyw Bezpieczeństwa Ruchu Drogowego (Road Safety Initiatives Centre Foundation), ul. Zielona 13, 30-623 Kraków, Poland, entered in the National Court Register under KRS number 0001076394, tax ID (NIP) 6793285896, REGON 527242146 (“the Foundation”, “we”).

Contact on personal data matters: e-mail biuro@cibrd.org.pl or by post to the Foundation’s registered office.

2. School application to the Road Show programme

The application form is completed by a teacher or another school representative. We process:

school details – name, address, RSPO number,
details of the applicant – first name and surname, phone number, e-mail address,
participation details – the selected session, number of students and supervisors, comments,
the date the application was sent and the IP address it was sent from.

Purpose: organising the school’s participation in a Road Show session, contacting the applicant about the application (confirmation, organisational arrangements, information about dates), preparing participant lists and summaries of attendance.

Legal basis: the applicant’s consent (Art. 6(1)(a) GDPR), given by ticking the consent box in the form, and our legitimate interest (Art. 6(1)(f) GDPR) in protecting the form against abuse and in establishing or defending legal claims.

Providing the data is voluntary, but we cannot accept an application without it. Consent may be withdrawn at any time by writing to the address in section 1; this does not affect the lawfulness of processing carried out before withdrawal.

Retention: application data is kept for as long as needed to organise and settle the session, and no longer than 12 months after the session date, or until consent is withdrawn. Aggregate attendance figures (without personal data) are kept in the programme statistics.

The school address is sent to the OpenStreetMap Nominatim service (OpenStreetMap Foundation) to place the school on the events map. The service receives only the school address, without the applicant’s details.

3. Website security

To protect the forms against spam and attacks, when forms are submitted and when users log in we record the IP address, the approximate country derived from the IP address, and the date and type of the event (e.g. a rejected application). Addresses that repeatedly abuse the forms may be temporarily blocked. The forms may be available only to connections from Poland.

Legal basis: our legitimate interest in keeping the website secure (Art. 6(1)(f) GDPR). Retention: up to 30 days.

4. Visit statistics

We keep our own simple visit statistics, without third-party tools (we do not use Google Analytics or advertising pixels). We record the page visited, the date and hour, and the approximate country and city derived from the IP address – without storing the IP address itself. To avoid counting the same person more than once, for one day we keep a one-way hash created from the IP address and a random key that changes daily; it is deleted after 2 days. The “currently online” counter keeps the IP address for about an hour.

Clicks on partner logos are counted in a similar, pseudonymous way (without storing the IP address).

Legal basis: our legitimate interest in assessing the programme’s reach and developing the website (Art. 6(1)(f) GDPR).

The country and city are determined using the GeoLite2 database (MaxMind) installed on our own server – the IP address is not sent to anyone for this purpose.

5. Cookies and browser storage

The website does not use cookies for regular visitors – we do not use analytics, marketing or tracking cookies, which is why we do not display a cookie consent banner.

A session cookie (technical, strictly necessary) is set only for people who log in to edit the website (editors). It is deleted after logging out or closing the browser. For editors’ convenience, the browser may also store editing tool settings in local storage (localStorage) – this is not personal data.

6. Editor login

People authorised to edit the website log in with their e-mail address and a one-time code sent by e-mail. We process the e-mail address, IP address and login history to provide access and keep the account secure (Art. 6(1)(f) GDPR), for as long as the person has editing rights; data on login attempts is kept for up to 30 days.

7. Third-party content and services

When displaying pages, the browser loads some elements from external servers, which therefore receive the visitor’s IP address and browser information:

Google Fonts (Google Ireland Ltd.) – typefaces; Google may also process data in the USA under the EU-U.S. Data Privacy Framework,
unpkg.com – the Leaflet map library used on the events map.

Links to other websites (e.g. news sources, social media, partner websites) lead to sites we are not responsible for – their own privacy policies apply there.

8. Recipients of data

Data may be shared only to the extent necessary to run the website and organise the programme:

hosting and e-mail providers on whose servers the website runs and through which we send messages,
people and entities providing technical support for the website (under a data processing agreement),
co-organisers of a particular Road Show session (e.g. local authorities, the Regional Road Safety Council, emergency services) – to the extent needed to prepare it, e.g. school name, number of participants, applicant’s contact details,
public authorities – where required by law.

We do not sell data or use it for marketing. We do not make automated decisions or carry out profiling, except for automatically rejecting applications that look like spam and temporarily blocking IP addresses that abuse the forms – in that case you can contact us by e-mail.

9. Rights of data subjects

Every person whose data we process has the right to:

access their data and receive a copy,
rectification of their data,
erasure of their data,
restriction of processing,
data portability – for data processed on the basis of consent,
object to processing based on our legitimate interest,
withdraw consent at any time,
lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl).

To exercise these rights, write to biuro@cibrd.org.pl. We reply without undue delay and no later than within one month.