Privacy policy

1. Data Controller

The controller of personal data is Masters & More Elżbieta Jaroszewicz, with its registered office in Warsaw at ul. Hlonda 10C/U5, 02-972 Warsaw, Poland, Tax ID (NIP): 6511587400 (hereinafter: the “Controller” or “Masters&More”).

For matters relating to personal data protection, you may contact the Controller at: biuro@mastersandmore.pl.

2. Personal data we may process

Depending on your relationship with Masters&More, we may process in particular:

• first name(s) and surname;
• email address and telephone number;
• residential address, correspondence address and postal code, where necessary for the performance of a contract or compliance with legal obligations;
• the PESEL identification number of a parent or legal guardian – provided in the educational services agreement concluded online through the LangLion platform, for the purpose of identifying the contracting party and concluding and performing the agreement;
• the age or date of birth of a course participant;
• information concerning course selection, group, level, attendance, educational progress and use of services;
• billing and payment information necessary for contract performance and accounting or tax obligations;
• information contained in correspondence, contact forms and enrolment forms;
• where justified, information concerning a participant's health if necessary to ensure safety or proper organisation of classes – processed only where an appropriate legal basis for special-category data applies;
• other data that we are required to process under applicable law.

Where the participant is a child, we may process the child's data as well as the data of the child's parent, legal guardian or another person authorised to communicate with us in matters concerning the course.

3. Purposes and legal bases for processing

4. Contact form and Resend

Messages submitted through the contact form are delivered to biuro@mastersandmore.pl. For technical delivery of these messages, we use Resend, a service provided by Resend, Inc. in the United States.

Resend acts as a processor on our behalf under an appropriate data processing agreement. Use of this service may involve transfers of personal data outside the European Economic Area. Such transfers are carried out using mechanisms available under the GDPR, as appropriate to the recipient's status, including an adequacy decision or Standard Contractual Clauses where applicable.

The message content is not stored in the website database; the form script forwards it directly to the sending service. Contact data are retained for the time necessary to handle the correspondence and subsequently for the period required to establish, exercise or defend potential legal claims.

5. LangLion enrolment form and online agreements

On the “Enrolment” page, we use an enrolment form provided through the external LangLion platform. Data entered in the form are transmitted through LangLion's infrastructure and used to process course applications, contact prospective customers and complete the enrolment process.

Educational services agreements are also concluded online through the LangLion platform. As part of entering into and performing the agreement, we process data relating to the parent or legal guardian, including name, contact details, address and PESEL identification number, as well as the child's data necessary to provide educational services. The legal basis for processing data necessary to enter into and perform the agreement is Article 6(1)(b) GDPR.

LangLion acts as a provider of the system used to manage enrolments and agreements and processes data within the scope of the tasks entrusted to it. The form may also use third-party services, in particular Google reCAPTCHA and Google resources such as web fonts. This may result in the transfer of technical data, including IP address, device and browser information and website activity.

6. Data-flow automation and system integrations

To efficiently handle enquiries, enrolments and customer relationships, the Controller may use workflow automation and system-integration tools, in particular n8n, to transfer data between the website form, Trello, Google Sheets and LangLion. Such integration may include creating, searching, updating and deduplicating records using contact details, assigning the source of an enquiry and updating its status.

These processes may involve personal data necessary to handle an enquiry or to enter into and perform an agreement, in particular a person’s name, email address, telephone number, information about the selected course or interest in the offer, source of the enquiry, form or correspondence content, and organisational information concerning the handling of the enquiry.

The legal basis is Article 6(1)(b) GDPR where processing is necessary to take steps at the individual’s request before entering into a contract or to perform a contract, and Article 6(1)(f) GDPR – the Controller’s legitimate interest in efficient enquiry handling, system integration, maintaining accurate data and reducing duplicate records. Where a particular activity requires consent, data are processed on the basis of that consent.

The n8n provider and the providers of systems connected through the integration may act as processors or independent controllers, depending on the scope and manner in which the relevant service is used. The n8n tool may be run on the Controller’s own infrastructure or on infrastructure operated by a cooperating entity under a data processing agreement, or as a cloud service – in each case with an appropriate data processing agreement in place and with safeguards concerning any transfer of personal data outside the EEA in accordance with Chapter V GDPR.

If an external artificial-intelligence model is used in the future to analyse enquiry content or support automation, the Controller will, before such processing begins, ensure an appropriate legal basis, required agreements and data-transfer safeguards, and will update this Privacy Policy where necessary.

7. Google Analytics 4

We use Google Analytics 4 to generate statistics, analyse website traffic and improve the website and the effectiveness of our marketing activities. The service may process information about pages visited, events performed on the website, device and browser information, approximate location and technical identifiers.

Google Analytics 4 is activated only after consent to analytics cookies and technologies has been given. Consent can be withdrawn or changed at any time using the consent settings available on the website.

8. Meta Pixel

We use marketing and analytics tools provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, including Meta Pixel.

Meta Pixel enables us to analyse activity on the website, such as visiting a page, submitting a form or clicking a telephone number. This helps us measure campaign effectiveness, optimise advertising and create audiences for campaigns on Facebook and Instagram, including remarketing.

Meta Pixel is activated only after consent to marketing cookies and technologies has been given. The legal basis for such processing is Article 6(1)(a) GDPR. Consent may be withdrawn or changed at any time using the consent settings available on the website.

9. Google Maps

We use Google Maps in the section presenting our locations. Displaying an embedded map may cause the user's browser to connect to Google servers and transmit technical data, in particular the user's IP address and device and browser information.

Where the operation of the map involves cookies or similar technologies that require consent, the map should be activated only after the user has given the relevant consent.

10. Cookies and consent management

The website uses a consent banner that allows users to manage categories of cookies and similar technologies. Depending on the website configuration, these include in particular essential, analytics/statistics, marketing and third-party service technologies.

Essential cookies may be used without separate consent where they are necessary for the proper operation of the website or for a service explicitly requested by the user. Other technologies are activated after the relevant consent has been obtained. Consent can be withdrawn or changed at any time through the consent settings available on the website.

Further information is provided in our separate Cookie Policy.

11. Recipients of personal data

Personal data may be disclosed only to entities that need them to perform specific tasks, in particular:

• authorised employees and contractors of Masters&More, to the extent necessary for their duties;
• providers of IT systems, hosting, email and communication tools;
• providers supporting forms, enrolments and agreements, including LangLion;
• analytics, marketing and mapping service providers, including Google and Meta, where the relevant technologies have been activated in accordance with consent settings;
• accounting firms, law firms, payment providers and other service providers supporting the Controller where necessary;
• public authorities where disclosure is required by law.
• providers of workflow automation, integration and process-management tools, including n8n, and – to the extent the relevant functions are used – Trello/Atlassian, Google Sheets/Google Workspace and LangLion;

Persons acting on behalf of the Controller are granted access to personal data only to the extent necessary to perform their assigned tasks and are required to maintain confidentiality.

12. Transfers outside the EEA

Because we use certain IT services, personal data may be transferred to countries outside the European Economic Area, in particular to the United States.

Such transfers are made in accordance with Chapter V of the GDPR, in particular on the basis of a European Commission adequacy decision where applicable to the recipient, or using appropriate safeguards such as Standard Contractual Clauses where required.

13. Data retention periods

• data related to contract performance – for the duration of the agreement and thereafter for the applicable limitation period for claims;
• accounting and tax data – for the period required by applicable law;
• data processed on the basis of consent – until consent is withdrawn, unless another legal basis permits continued processing;
• data used for direct marketing based on legitimate interests – until an effective objection is made;
• correspondence data – for the duration of the matter and thereafter for the period necessary to protect against claims;
• technical and analytics data – according to the lifetime of the relevant cookies, consent settings and the policies of the relevant providers.

14. Your rights

Subject to the conditions set out in the GDPR, you have the following rights:

• right of access and to receive a copy of your personal data;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to data portability where the GDPR conditions are met;
• right to object to processing based on legitimate interests;
• right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) in Poland.

To exercise your rights, please contact us at biuro@mastersandmore.pl and indicate the nature of your request. The Controller responds without undue delay and, as a rule, within one month of receiving the request, in accordance with the GDPR.

The Controller does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning a data subject or similarly significantly affect them. Profiling for online marketing purposes (for example, creating advertising audiences) takes place only after the appropriate consent to marketing cookies has been given.

15. Data security

The Controller applies appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, damage or destruction. Access to personal data is limited according to each person's role and responsibilities.

The Controller also seeks to minimise the scope of personal data processed and the applicable retention periods and removes temporary documents when they are no longer needed.

16. Changes to this Privacy Policy

This Privacy Policy may be updated if the website functionality, service providers, data processing practices or applicable law change. The current version is published at www.mastersandmore.pl.