Last updated: 24 October 2026.
This policy explains how Centrum Sportów Spokojna processes the personal data of website visitors, people contacting the club, competition participants and visitors to our premises.
1. Data controller and contact details
The data controller is Mariusz Kawa, trading as Firma Handlowa Mariusz Kawa, ul. Spokojna 20C, 33-100 Tarnów, Poland, tax identification number (NIP) 8730011730, REGON 850006361. For personal data enquiries, contact fhkawa@poczta.onet.pl, call +48 664 759 302 or write to the address above.
2. Contacting the club
We process the information you provide in a form, message or conversation, including your name or company name, email address, telephone number and enquiry. We use it to reply, discuss the service and handle your request. Please do not send health information or other sensitive personal data unless it is needed to deal with your request.
Enquiries about entering into or performing a contract are handled under Article 6(1)(b) GDPR. For other enquiries, we rely on our legitimate interest in handling correspondence and keeping a record of arrangements (Article 6(1)(f) GDPR). Providing information is voluntary, but required form fields must be completed to submit the form. You can contact us by telephone or email instead.
We retain ordinary correspondence that does not lead to a contract until the matter is closed and for no longer than 12 months after the last substantive message. Correspondence relating to payments, complaints or legal claims is subject to the periods described in section 5.
3. Bookings through Playmore
Our booking buttons take you to Playmore, an external service operated by Reservise sp. z o.o. Accounts, time-slot selection and payments are handled in that system. You do not enter your Playmore password or payment card details on our website. Playmore’s terms and privacy policy explain how the operator manages accounts and processes data.
The club processes the data needed to provide the booked service: customer identification and contact details, the type and time of the booking, and payment information. We receive this information from you, including through the booking system. The legal bases are performance of a contract (Article 6(1)(b) GDPR), compliance with legal obligations (Article 6(1)(c) GDPR) and protecting legal claims (Article 6(1)(f) GDPR).
4. Leagues and tournaments
We use information provided when registering for a league or tournament to process entries, send organisational messages, arrange matches, maintain results and rankings, and handle participation fees. We process participants’ identification and contact details and information about their participation to the extent needed for the competition. The legal basis is performance of the participation agreement (Article 6(1)(b) GDPR), with Article 6(1)(c) and (f) GDPR applying to accounting and legal claims respectively.
Required information, publication of results and use of external tools depend on the rules of the competition and the information provided at registration. Telephone numbers and email addresses supplied to the organiser are not intended for public publication online. Entering a competition does not constitute consent to advertising or unrestricted use of your image.
We retain working participant contact lists for the duration of the competition and for no more than 3 months afterwards. Data needed for accounting or a specific dispute is retained separately under section 5. Results and rankings are subject to the publication and archiving rules of the particular league or tournament.
5. Accounting, complaints and legal claims
Accounting records are retained for the period required by tax and accounting law. For tax records, this is generally 5 years from the end of the calendar year in which the tax payment was due, subject to any statutory extensions.
Data relating to a complaint or legal claim is retained until the matter is resolved and the applicable limitation period expires. If proceedings are ongoing, retention also covers their final conclusion and enforcement of the decision. We retain only the data needed for the matter. The legal basis is a legal obligation or our legitimate interest in establishing, pursuing and defending claims.
6. CCTV at the premises
Centrum Sportów Spokojna uses CCTV for personal safety, protection of property and investigating incidents. The legal basis for processing images is our legitimate interest (Article 6(1)(f) GDPR). Recordings are retained for 7 days. A specific recording may be preserved for longer if it is evidence of an incident or is needed for a claim or proceedings, until that matter is concluded.
Recordings are intended for authorised people responsible for CCTV and investigating incidents. They may be disclosed to authorities entitled to receive them by law. To request access to a recording relating to you, contact reception as soon as possible with the date, approximate time and location of the incident. Requests are handled with due regard for the privacy of other people shown in the recording.
7. Website and cookies
When you use the website, technical information may be processed, including your IP address, connection date and time, visited URLs, browser and device information, and errors. Logs support website delivery, troubleshooting and protection against abuse. The legal basis is our legitimate interest in website security and reliable operation (Article 6(1)(f) GDPR).
Cookies are small files stored on your device. The website uses mechanisms for cookie preferences, language selection and signed-in user sessions. We also use Google Analytics and Google Tag Manager to measure website use, and Google Maps and reCAPTCHA for the map and form protection. These services may process your IP address, device information and information about website use.
Optional cookies, including analytics and advertising cookies, require your consent. Consent is voluntary. You can change your choices in the website’s cookie preferences panel and delete cookies in your browser. Withdrawal does not affect the lawfulness of earlier processing. Necessary technical mechanisms do not require consent to the extent permitted by Article 399 of the Polish Electronic Communications Law. Processing covered by consent is based on Article 6(1)(a) GDPR.
Session cookies expire when the session ends; persistent cookies expire at their configured time or when deleted. A cookie’s lifetime is not necessarily the same as the service provider’s data retention period. Information about Google’s processing and retention is available in Google’s privacy policy and your Google account settings.
8. Recipients and external services
To the extent needed to provide services, data may be received by hosting and website support providers, email providers, booking and competition management services, accounting and legal advisers, and authorised public authorities. The website is hosted by LH.pl. Recipients process data according to their respective roles and legal bases.
When you follow a link to Playmore, BO5, Facebook, Instagram or Google Maps, you use an external service. Its operator provides its own privacy policy. Following a link does not give the club access to your login credentials for those services.
Using international services, particularly Google, may involve processing outside the European Economic Area. Google describes its transfer mechanisms, including adequacy decisions and standard contractual clauses, in its data transfer information. You can contact us for information about recipients and safeguards relating to your data.
9. Your rights
Under the conditions set out in the GDPR, you may request access to your data and a copy, rectification, erasure and restriction of processing. Data portability applies in the circumstances specified in Article 20 GDPR, where data is processed automatically on the basis of consent or a contract. You may withdraw consent at any time.
You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing at any time. Contacting the club, making a booking or joining a league does not itself constitute marketing consent.
Send requests using the contact details in section 1. If we have reasonable doubts about your identity, we may request information needed to verify it. We normally respond within one month. If an extension is required under the GDPR, we will inform you within that period and explain why. The right to erasure does not override statutory retention obligations.
You have the right to complain to the President of the Polish Personal Data Protection Office (UODO). Information about submitting a complaint is available at uodo.gov.pl.
10. Policy updates
We update this policy when the website, services used or data processing arrangements change. The current version and its update date are published on this page.
