Privacy policy

The controller of personal data is Aidvocates Group sp. z o.o., with its registered office at ul. Hutnicza 6, 40-241 Katowice, Poland, KRS 0001219549, NIP 9542903306, REGON 543991881, share capital PLN 100,000 — the service operator.

Contact for matters concerning personal data: dpo@legaion.com.

The website processes only the data that the user provides when contacting the controller:

• Full name.
• Email address.
• Club name and role within the club, where provided.
• The content of the message and the data provided voluntarily in it.

An enquiry sent through the contact form is stored in the controller's database together with the date and time of submission and the handling status of the enquiry. The record serves solely to handle the enquiry and to organise the correspondence.

Access to stored enquiries is limited to persons authorised by the controller, after signing in to an internal enquiry handling panel. Access is enforced at the database level — without signing in and without a granted permission, enquiries cannot be read.

The website keeps no accounts for website visitors, processes no payment data and does not profile users. The controller takes no decisions based solely on automated processing that would produce legal effects concerning the data subject.

The data is processed in order to answer the enquiry sent and to conduct the related correspondence. The basis for processing is Article 6(1)(f) GDPR — the legitimate interest of the controller in replying to an enquiry from a person who initiated the contact themselves, and in commercial contact within the scope of that enquiry.

The controller carries out a balancing test and does not process the data where the interests or fundamental rights and freedoms of the data subject override those interests, in particular where the data subject is a child.

Providing data is voluntary; however, without an email address a reply cannot be given.

Correspondence data is kept for the duration of the exchange and then for up to 12 months from the last contact — in order to reconstruct the course of the correspondence and to resume it if needed. After that period the data is deleted, unless longer retention is necessary to establish, pursue or defend claims or follows from provisions of law; in that case the data is kept until the relevant time limits expire.

Enquiries stored in the database are kept for the same period and are deleted once 12 months have passed from the last contact. An enquiry is deleted earlier at the request of the data subject, unless one of the grounds for further retention set out above applies.

The data may be entrusted to entities providing the controller with the infrastructure necessary to operate the website and the email service — the website hosting provider, the database provider and the email provider. Those entities process the data solely on the controller's instructions and only to the extent necessary to provide those services.

The provider of the database in which contact form enquiries are stored is Supabase, Inc. Enquiries are stored on infrastructure located in Frankfurt am Main, Germany.

The data may be disclosed to public authorities where such an obligation follows from provisions of law. The controller does not sell personal data.

The data is processed on infrastructure located in the European Economic Area and is not transferred outside the European Economic Area.

• The right of access to the data and to receive a copy of it.
• The right to rectification of incorrect or incomplete data.
• The right to erasure of the data.
• The right to restriction of processing.
• The right to object to processing based on the legitimate interest of the controller.

Requests to exercise these rights may be sent to dpo@legaion.com. The controller replies without undue delay and no later than within one month of receiving the request.

The data subject has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, if they consider that the processing of their data infringes data protection law.

The rules on cookies are described in the cookie policy.