Privacy policy

Last updated 11 October 2026

Introduction

Fundacja PoNadTo ("we", "us" or "our") is committed to protecting the privacy of our website visitors. This policy explains how we collect, use, disclose and safeguard your information when you visit www.ponadto.foundation (the "Site"). By using the Site you agree to this policy. If you do not agree, please do not use the Site.

Data controller

The controller of your personal data is Fundacja PoNadTo, 23/25 Nowy Świat Street, lok. 32, 00-029 Warszawa, Poland. For any question about how your data is handled, contact privacy@ponadto.foundation.

Information we collect

• Personal data such as your name, email address and telephone number, which you provide voluntarily when you fill in a form on the Site. We collect it only to respond to your enquiry.
• Analytics data, aggregated and estimated, which may include approximate location, gender and age range. It is used in aggregate to understand our audience and never to identify you.
• Usage data collected automatically by our analytics, such as browser type, operating system, IP address, pages viewed and time spent. It is used to improve the Site.

Legal basis for processing

Under the General Data Protection Regulation (GDPR) and the Polish Personal Data Protection Act (RODO), we process your personal data on the following bases:

• Consent (Art. 6(1)(a) GDPR): when you submit a form, contact us or accept non-essential cookies. You may withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f) GDPR): for site analytics, security and the prevention of fraud or illegal activity.
• Legal obligation (Art. 6(1)(c) GDPR): where the law requires us to process data.

How we use your information

• To respond to your enquiries and provide the information or services you request.
• To analyse usage trends and improve the content, functionality and usability of the Site.
• To comply with our legal obligations.
• To prevent fraud or other illegal activities.

Disclosure of your information

We do not sell, trade or otherwise transfer your personal information to outside parties, except as described here.

• Service providers. The Site is hosted by Vercel Inc. Messages you send through our forms are delivered to our mailboxes, which are operated by our email provider. We rely on these providers' security measures and confirm that they maintain measures aligned with EU data protection law.
• Legal requirements. We may disclose your information if required by law or in response to valid requests by public authorities.

International data transfers

Because our hosting and email providers operate globally, your personal data may be processed on servers outside the European Economic Area (EEA). Where such transfers occur they are protected by appropriate safeguards, such as European Commission adequacy decisions or Standard Contractual Clauses, so that your data continues to receive a level of protection consistent with EU law.

Cookies

The Site itself sets no tracking cookies. Films are embedded from YouTube in privacy-enhanced mode, which sets cookies only once you play a film. Your light or dark theme choice is kept in your own browser and never sent to us. Any non-essential analytics cookies are set only with your consent, which you can withdraw at any time.

Data security

We use reasonable measures to protect your information from unauthorised access, use or disclosure, and rely on our providers' security infrastructure in compliance with EU regulations. No method of transmission over the internet or of electronic storage is completely secure.

Data retention

We retain your personal information for 365 days, after which it is deleted, unless a longer retention period is required to meet a legal obligation or to establish, exercise or defend legal claims.

Your rights under GDPR and RODO

If you are in the EEA you have the right to access, rectify or erase your personal data, to restrict or object to its processing, to data portability, to withdraw consent at any time, and to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa. To exercise any of these rights, contact privacy@ponadto.foundation.

Children's privacy

The Site is not directed at children. In Poland the age of digital consent is 16. We do not knowingly collect personal data from children under 16 without the verifiable consent of the holder of parental responsibility. If we learn that we have done so, we delete that information.

Changes to this policy

We may update this policy from time to time. Changes are posted on this page with a new "last updated" date.

Contact

Email privacy@ponadto.foundation, or write to Fundacja PoNadTo, 23/25 Nowy Świat Street, lok. 32, 00-029 Warszawa, Poland. We have determined that we are not legally required to appoint a Data Protection Officer.