Privacy Policy

Hello!

If you have found your way here, it is a sure sign that you value your privacy. We fully understand that, which is why we are providing you with this document, where you can find in one place the rules governing the processing of personal data and the use of cookies and other tracking technologies in connection with the operation of the candela.org.pl website.

A formal note to begin with – the website is operated by Candela Foundation, with its registered office in Warsaw (03-822), at ul. Grochowska 357/513, entered in the register of associations, other social and professional organisations, foundations and independent public healthcare institutions under KRS number 0000885495, holding NIP number 1133028363 and REGON number 388293056.

This Privacy Policy has been structured in a question-and-answer format. We chose this format to ensure that the information presented to you is transparent and easy to read.

If you have any questions or doubts concerning this Privacy Policy, you can contact us at any time by sending a message to hello@candela.org.pl.

# 1: Who is the controller of your personal data?

The controller of your personal data is Candela Foundation, with its registered office in Warsaw (03-822), at ul. Grochowska 357/513, entered in the register of associations, other social and professional organisations, foundations and independent public healthcare institutions under KRS number 0000885495, holding NIP number 1133028363 and REGON number 388293056.

# 2: Who can you contact regarding the processing of your personal data?

As part of implementing personal data protection within our organisation, we have decided not to appoint a Data Protection Officer, as this is not mandatory in our case. For matters related to personal data protection and privacy in the broad sense, you may contact us at hello@candela.org.pl.

# 3: What information do we have about you?

The scope of personal data processed is specified separately for each purpose of personal data processing in Annex 1 to this Privacy Policy.

In addition, we use tools that collect various information about you in connection with your use of our website. This includes, in particular, the following information:

information about your device, operating system and web browser
user identifier (user ID)
IP address subject to truncation and anonymisation
date of your visit to the website
pages viewed
time spent on the website
navigation between individual pages
mouse clicks or screen taps
clicks on individual links
the source from which you arrive at the website
your age range
your gender
your approximate location, limited to the town or city
your interests determined on the basis of your online activity
This information is referred to later in this Privacy Policy as “Anonymous Information”.

In our assessment, Anonymous Information does not in itself constitute personal data because it does not allow us to identify you, and we do not combine it with the typical personal data we collect about you. Nevertheless, given the strict case law of the Court of Justice of the European Union and differing views among lawyers, as a precaution, in case Anonymous Information were to be regarded as personal data, we have also included detailed explanations in this Privacy Policy regarding the processing of such information.

We are unable to provide you with access to Anonymous Information about you because we cannot attribute any Anonymous Information to any specific user. Through the tools that collect Anonymous Information, we have access only to aggregated statistics and information that is not assigned to specific individuals. Moreover, we do not have access at all to information collected by some tools, because we are interested only in the proper functioning of the feature provided by a given tool, rather than in the information it collects. For example, a particular plug-in may collect certain information, but that information is not made available to us in any way, and we are not interested in it because we only need the relevant plug-in functionality (e.g. submission of a newsletter form) to work properly.

Processing Anonymous Information enables us to provide you with access to the features available on the website. In addition, Anonymous Information is used for analytical, statistical and marketing purposes, such as setting up and targeting advertisements.

Because Anonymous Information is collected by external tools that we use, it is also processed by the providers of those tools in accordance with their terms and conditions and privacy policies.

Anonymous Information is also used by the providers of individual tools to provide and improve services, manage them, develop new services, measure advertising effectiveness, protect against fraud and abuse, and personalise content and advertisements displayed across individual services, websites and applications.

The tools we use that involve the collection of Anonymous Information are listed in Annex 2 to this Privacy Policy.

# 4: Where do we obtain your personal data from?

In most cases, you provide it to us yourself. This happens when you:

place an order or take part in an event organised by Fundacja Candela
submit a complaint or withdraw from a contract
subscribe to the newsletter
contact us by email
follow our social media profiles or interact with content that we publish on social media
submit a request relating to the processing of personal data

In Annex 1 to this Privacy Policy, we have assigned the source from which data is obtained to each processing purpose.

In addition, some information about you may be collected automatically by the tools we use:

the website mechanism collects your IP address
the newsletter system mechanism collects your IP address and information about your activity in relation to the content sent to you as part of the newsletter, such as message opens, link clicks, etc.
the external tools listed in Annex 2 to this Privacy Policy collect Anonymous Information relating to your activities on the website

# 5: Is your data secure?

We care about the security of your personal data. We have analysed the risks associated with the individual processes involving the processing of your data and have implemented appropriate security and personal data protection measures. We continuously monitor the condition of our technical infrastructure, train our personnel, review the procedures we use and introduce necessary improvements. If you have any questions concerning your personal data, you can contact us at hello@candela.org.pl.

# 6: For what purposes do we process your personal data?

The purposes for which we process your personal data are listed in Annex 1 to this Privacy Policy.

# 7: How long will we retain your personal data?

We retain your personal data for as long as is justified for the relevant purpose of personal data processing. Accordingly, retention periods vary depending on the purpose; the applicable periods are specified in the table forming an annex to this Privacy Policy.

Please remember that the end of processing your data for one purpose does not necessarily mean that your personal data will be completely deleted or destroyed, because the data may be processed for another purpose for the period specified for that purpose. For example, when an exchange of correspondence ends, we stop processing personal data for the purpose of handling correspondence, but the data collected in connection with that correspondence continues to be retained for archival purposes in order to establish, pursue or defend claims related to the correspondence. Complete deletion or destruction of data takes place when all processing purposes have ended, most often after the expiry of the limitation period for claims, the limitation period for administrative liability, or the period for which we are legally required to retain specific data.

# 8: Who are the recipients of your personal data?

We will venture to say that modern business cannot function without services provided by third parties. We also use such services. Some of them involve the processing of your personal data. External service providers involved in processing your personal data include:

the hosting provider that stores data on the server
the email service provider
providers of cloud software in which data is processed
the accounting firm, which processes your data shown on invoices
other subcontractors who obtain access to data where the scope of their activities requires such access

All of the entities listed above process your data on the basis of data processing agreements concluded with us and guarantee an appropriate level of personal data protection.

Where necessary, your data may be disclosed to a legal adviser or attorney who is bound by professional secrecy. Such a need may arise where legal assistance requiring access to your personal data is necessary.

Your personal data may also be transferred to tax authorities to the extent necessary to fulfil tax, settlement and accounting obligations. This applies in particular to declarations, reports, statements and other accounting documents containing your personal data.

Where necessary, we may disclose your personal data to third parties and the competent market surveillance authorities in matters relating to product safety. The General Product Safety Regulation (GPSR) requires us, among other things, to inform manufacturers and importers of any accidents involving a product sold, for which we may need your personal data. The same applies to market surveillance authorities: if an authority orders us to provide information about customers who purchased a product, we may disclose your personal data to that authority.

In addition, with regard to Anonymous Information, access is available to the providers of tools or plug-ins that collect Anonymous Information. The providers of these tools are independent controllers of the data collected by them and may disclose such data in accordance with the rules they set out in their own terms and privacy policies, over which we have no control.

# 9: Do we transfer your data to third countries or international organisations?

Yes. Some operations involving the processing of your personal data may involve transfers to third countries.

We transfer your personal data to third countries in connection with our use of tools that store personal data on servers located in third countries, in particular in the USA. The providers of these tools guarantee an appropriate level of personal data protection through the relevant compliance mechanisms provided for under the GDPR, in particular by using Standard Contractual Clauses.

The tools that involve transfers of data to third countries are:

email
cloud services

The following information is transferred to third countries:

data stored in the cloud
data contained in email correspondence

We also remind you that we use external tools that may collect Anonymous Information. We have mentioned this several times in this Privacy Policy, including in the answer to the previous question. Providers of these tools often use servers located around the world, in particular in the United States of America (USA), to store the information they collect.

# 10: Do we use profiling? Do we make automated decisions based on your personal data?

We do not make decisions concerning you that are based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you.

We do use tools that may perform certain actions depending on information collected through tracking mechanisms, but we consider that these actions do not significantly affect you because they do not differentiate your situation as a customer, do not affect the terms of any contract you may enter into with us, etc.

When using certain tools, we may, for example, display personalised advertisements to you based on actions you have previously taken on the website or suggest products that may be of interest to you. This is referred to as behavioural advertising. We encourage you to learn more about behavioural advertising, particularly in relation to privacy. Detailed information, including the ability to manage behavioural advertising settings, can be found here.

We emphasise that, within the tools we use, we have access only to Anonymous Information. This information is stored on the servers of the providers of the individual tools, and those servers may usually be located around the world.

# 11: What rights do you have in connection with the processing of your personal data?

The GDPR grants you the following potential rights in connection with the processing of your personal data:

the right of access to your data and to receive a copy of it,
the right to rectification (correction) of your data,
the right to erasure of data (if you believe there are no grounds for us to process your data, you may request that we delete it),
the right to restriction of processing (you may request that we restrict the processing of your data solely to storing it or carrying out actions agreed with you if, in your opinion, the data we hold is incorrect or we process it without proper grounds),
the right to object to data processing (you have the right to object to processing based on a legitimate interest; you should indicate the particular situation which, in your opinion, justifies our ceasing the processing covered by your objection; we will stop processing your data for those purposes unless we demonstrate compelling legitimate grounds for the processing that override your rights or unless your data is necessary for us to establish, pursue or defend claims),
the right to data portability (you have the right to receive from us, in a structured, commonly used and machine-readable format, the personal data that you provided to us on the basis of a contract or your consent; you may instruct us to transmit that data directly to another entity),
the right to withdraw consent to the processing of personal data if you previously gave such consent,
the right to lodge a complaint with a supervisory authority (if you conclude that we are processing data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office or another competent supervisory authority).

The rules governing the exercise of the rights listed above are described in detail in Articles 16–21 of the GDPR. We encourage you to familiarise yourself with those provisions. We also consider it important to explain that the rights listed above are not absolute and will not apply to all processing activities involving your personal data.

We emphasise that one of the rights listed above is always available to you: if you believe that, when processing your personal data, we have infringed personal data protection laws, you may lodge a complaint with the supervisory authority (the President of the Personal Data Protection Office).

You may also always ask us to provide information about what data we hold about you and for what purposes we process it. Simply send a message to hello@candela.org.pl. We have, however, made every effort to ensure that the information relevant to you is presented comprehensively in this Privacy Policy. You may also use the email address above if you have any questions concerning the processing of your personal data.

# 12: Do we use cookies or other similar technologies, and what are they?

Like almost all other websites, our website uses cookies and other similar technologies, such as tracking codes or pixels, conversion APIs, etc.

Cookies or other similar technologies may be used to collect certain information, which is then used for various purposes, ranging from ensuring the proper operation of individual website features, through analysing user behaviour on the website, to displaying targeted advertising.

If you would like to learn more about cookies and other similar technologies, you can review, for example, the following materials:

# 13: On what basis do we use cookies or other similar technologies?

We use cookies and other similar technologies on the basis of your consent, except where cookies or other similar technologies are necessary for the proper provision of an electronic service to you.

Cookies or other similar technologies that are not necessary for the proper provision of an electronic service remain blocked until you consent to the use of cookies or other similar technologies. During your first visit to the website, we display a message asking for your consent.

Please remember that disabling or restricting cookies or other similar technologies may prevent you from using some features available on our website and may cause difficulties when using the website, as well as many other websites that use cookies or similar technologies. For example, if you block cookies from social media plug-ins, buttons, widgets and social features implemented on the website may be unavailable to you.

# 14: Can you disable cookies or other similar technologies?

Yes. You can manage cookie and similar-technology settings in your web browser. You may block all or selected cookies. You may also block cookies from specific websites. At any time, you may also delete previously stored cookies and other website and plug-in data.

Web browsers also offer an incognito/private browsing mode. You can use it if you do not want information about websites visited and files downloaded to be stored in your browsing and download history. Cookies created in incognito/private browsing mode are deleted when all windows of that mode are closed.

Browser extensions that allow you to control cookies are also available, such as Ghostery (https://www.ghostery.com). Cookie controls may also be provided by additional software, in particular antivirus packages, etc.

In addition, tools are available online that allow you to control certain types of cookies, in particular to manage behavioural advertising settings collectively (e.g. www.youronlinechoices.com/, www.networkadvertising.org/choices).

Please remember that disabling or restricting cookies or other similar technologies may prevent you from using some features available on our website and may cause difficulties when using our website, as well as many other websites that use cookies. For example, if you block cookies from social media plug-ins, buttons, widgets and social features implemented on our website may be unavailable to you.

# 15: For what purposes do we use first-party cookies?

First-party cookies are used to ensure the proper functioning of individual website mechanisms, such as the correct submission of forms displayed on the website.

First-party cookies also store information about the consent you have given to the use of cookies.

# 16: What third-party cookies are used?

Our website uses third-party cookies or other similar technologies associated with the tools listed in Annex 2 to this Privacy Policy. Individual tools may use more than one cookie, but we have chosen not to list them in detail because we do not want to overwhelm you with excessive information and consider it clearer to provide a list of tools together with the purposes for which those tools are used rather than list every cookie or other similar technology technically used within each tool.

We have also chosen not to specify the scope of information collected in cookies for each tool we use, taking into account that each tool collects information related to your characteristics and your behaviour on our website. In this respect, we are dealing with Anonymous Information, which we discussed earlier in this Privacy Policy.

Being aware of the requirements established by the Court of Justice of the European Union, we have nevertheless chosen not to specify the lifespan of cookies used by individual tools. To accurately determine the lifespan of every cookie, we would have to overwhelm you with an amount of information that would not in any way serve the principle of transparency and readability of the information provided to you. In addition, cookie lifespans may be changed so frequently by tool providers that we are unable to exercise reliable control over them. As we do not specify cookie lifespans, we remind you that the only way to exercise real control over how long information is stored in cookies is for you to manage cookies directly. From your web browser, you can delete cookies stored on your device at any time.

We would once again like to emphasise that, through cookies or other similar technologies, we do not have access to information that would allow us to identify you. In this respect, we are dealing with Anonymous Information, which we have discussed in this Privacy Policy.

Moreover, although in the case of statistical and marketing tools we can view various reports generated on the basis of Anonymous Information, with regard to the other tools we do not obtain any access at all to the information collected in cookies and are interested only in whether the functions of the tool for which it was installed operate correctly on our website.

# 17: Do we track your behaviour on our website?

Yes. We use tools that involve collecting information about your activity on our website. These tools are listed in Annex 2 to this Privacy Policy.

# 18: Do we display targeted advertising to you?

No. We do not set up targeted advertising.

§ 19: How can you manage your privacy?

The answer to this question can be found in many places in this Privacy Policy when discussing individual tools, behavioural advertising, consent to cookies, etc. Nevertheless, for your convenience, we have collected this information once again in one place. Below you will find a list of ways in which you can manage your privacy.

cookie settings in your web browser
browser extensions supporting cookie management, e.g. Ghostery
additional cookie-management software,
incognito/private browsing mode in your web browser
behavioural advertising settings, e.g. youronlinechoices.com
settings provided by external tool providers (links to these settings are collected in Annex 2 to this Privacy Policy)

# 20: What are server logs?

Using the website involves sending requests to the server on which the website is stored. Every request sent to the server is recorded in the server logs.

The logs include, among other things, your IP address, the server date and time, and information about the web browser and operating system you use. The logs are recorded and stored on the server.

Data recorded in server logs is not associated with specific individuals using the website and is not used by us to identify you.

Server logs are used solely as supporting material for website administration, and their contents are not disclosed to anyone other than persons authorised to administer the server.

# 21: Is there anything else you should know?

As you can see, the processing of personal data, the use of cookies and the management of privacy in the broad sense are fairly complex matters. We have made every effort to ensure that this document provides you with the fullest possible information on issues that are important to you. If anything is unclear, if you would like to learn more, or if you simply want to talk about your privacy, write to us at hello@candela.org.pl.

# 22: Can this Privacy Policy be changed?

Yes. We may modify this Privacy Policy, in particular due to technological changes affecting our website and changes in the law. If a change affects the rules governing our processing of your personal data and we have your electronic contact details, you will receive a message about each change to the Privacy Policy.

This version of the Privacy Policy is effective from 2026-09-01.

In addition, all archived versions of the Privacy Policy are linked below.

Annex 1 – purposes of personal data processing

Processing purpose	Legal basis for processing	Scope of data processed	Data retention period	Source of data
Handling correspondence	Article 6(1)(f) GDPR – the legitimate interest pursued by the controller consisting in responding to messages addressed to it.	Email address. Data contained in correspondence.	Until the exchange of correspondence is concluded.	Incoming message.
Email newsletter management	Article 6(1)(f) GDPR – the legitimate interest pursued by the controller consisting in its own marketing.	Email address. IP address. Approximate location. Subscriber profile, including statistics related to engagement with the content sent.	Until you unsubscribe from the newsletter.	A form in which the user provides an email address and at the same time consents to receiving the newsletter. The mailing system mechanism that creates the subscriber profile.
Order handling	Article 6(1)(b) GDPR – entering into and performing a contract concluded as a result of placing an order.	Data provided in the order form. IP address. Order details.	Until performance of the contract is completed.	Order form. Website mechanism recording the user’s IP address.
Complaint handling	Article 6(1)(f) GDPR – the legitimate interest pursued by the controller consisting in handling the complaint procedure.	Data provided in the complaint. Complaint details.	Until the complaint procedure is completed.	Complaint.
Handling withdrawal from a contract	Article 6(1)(f) GDPR – the legitimate interest pursued by the controller consisting in handling the procedure for withdrawal from a contract.	Data provided in the statement of withdrawal from the contract.	Until the withdrawal procedure is completed.	Statement of withdrawal from the contract.
Fulfilment of GPSR obligations	Article 6(1)(c) GDPR in conjunction with the applicable provisions of the GPSR.	Data provided in the order form. Data contained in correspondence relating to product safety.	Until the expiry of the period for which the law requires the documentation/data to be retained.	Order form. Email correspondence.
Accounting	Article 6(1)(c) GDPR in conjunction with the applicable tax-law provisions – fulfilment of tax obligations.	Data shown on the sales document.	Until the expiry of the period for which the law requires accounting documentation to be retained.	Order form.
Social media management	Article 6(1)(f) GDPR – the legitimate interest pursued by the controller consisting in managing social media profiles.	Data publicly visible in the user’s social media profile. Details of interactions with the user through social media profiles.	Until the data is deleted by the user from the social media service.	Social media profiles. Content published by the user on social media.
Analytics and statistics	Article 6(1)(f) GDPR – the legitimate interest pursued by the controller consisting in creating, reviewing and analysing statistics relating to user activity on the website in order to draw conclusions enabling subsequent optimisation of the website.	Anonymous Information.	Until the information ceases to be useful or an objection is raised.	Tracking scripts.
Handling requests relating to personal data processing	Article 6(1)(c) GDPR – fulfilment of obligations arising under the GDPR.	Data provided in the submitted request. Content of the request.	Until the request-handling procedure is completed.	Request relating to the processing of personal data.
Archive	Article 6(1)(f) GDPR – the legitimate interest pursued by the controller consisting in securing data for the purposes of establishing, defending or pursuing claims and demonstrating compliance with obligations arising under the GDPR.	Data of varying scope, depending on what data has been provided to us and what scope of data is justified for archival purposes.	Until the expiry of the limitation period for claims or the limitation period for our liability relating to personal data protection.	All forms used to provide data.

Annex 2 – list of external tools

Tool	Provider	Purpose of use	Provider information	Provider settings
Google Analytics	Google LLC	Analytics and statistics relating to the behaviour of visitors to the website.	View	View
YouTube	Google LLC	Embedding video content from YouTube.	View	View
GetResponse	GetResponse S.A	Handling sign-up forms, conversion analytics and display control (e.g. preventing pop-ups from being shown repeatedly).	View	Browser settings.