Privacy Policy

§ 1. General Provisions

To carry out its statutory objectives (link to the Statute), the Attention, Garbage Truck is Coming! Foundation collects personal data as well as data about your visits to our websites and your activity on our social media, including the Foundation’s groups on Facebook.

As the controller of your personal data, we assure you that we make every effort to ensure this processing takes place with the utmost respect for the privacy of the individuals concerned and with care for the security of the data being processed. We confirm that we apply technical and organizational measures to protect personal data appropriate to the risks involved and the categories of data protected, in particular safeguarding the data against disclosure to unauthorized persons, unauthorized removal, processing in violation of the law, and alteration, loss, damage, or destruction.

§ 2. Definitions

Wherever this Privacy Policy refers to:

Controller: this means the Attention, Garbage Truck is Coming! Foundation, based in Żyrardów (96-300), at ul. 1 Maja 54, entered in the register of associations, other social and professional organizations, foundations, and independent public healthcare institutions under KRS number 0000999466, NIP 8381879400, website: www.uwagasmieciarkajedzie.org. You can contact the Controller regarding personal data processing at: rodo@uwagasmieciarkajedzie.org.

Personal Data: this means information about an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

Processing of Personal Data: this means an operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Website: this means the website operating at www.uwagasmieciarkajedzie.org.

Groups: Facebook groups for users where it’s possible to post information about items to give away or items found by the trash bins. The full list of groups can be found at the following link: www.facebook.com/UwagaSmieciarkaJedzie/posts/pfbid0356e2jHEobZ5F3mebBn3goXjyUTVWT9jrNQJLBQJcMNakRsVH73eRAiPfSoki1TXkl.

Facebook Page: the Controller’s page on the Facebook social network, at https://www.facebook.com/UwagaSmieciarkaJedzie.

Device: this means the electronic device through which a User accesses the Website.

User: this means a natural person who uses the Website, the Groups, or the Facebook Page.

Cookies: this means small text files sent by the Website and stored on the User’s device, necessary for the Website to function properly, used among other things to identify and count the browsers and devices used to visit the Website.

§ 3. Purposes of Processing Personal Data

1. The Controller processes the Personal Data of Users:

Who contact the Controller: to handle and respond to inquiries submitted by Users. The legal basis for processing is the Controller’s legitimate interest in responding to the inquiry submitted (Article 6(1)(f) GDPR). The Controller processes the personal data provided by the User, meaning first name, last name, email address, and any other data the User has voluntarily included in the content of their message.

Who interact with the Controller via the Facebook Page: to administer the Controller’s Facebook Page, by responding to messages, comments, and reactions, and for statistical purposes carried out through tools provided as part of these social networking services. The legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) GDPR) in informing people about the Foundation’s activities, including promoting events. The Controller processes the User’s personal data that is publicly available on Facebook, such as first name, last name, and profile image, as well as, in the case of sent messages, data voluntarily provided in the content of the message or in comments.

Who have joined Groups on Facebook created and managed by the Controller: to allow Users to join a Group and post information about items to give away or items found by the trash bins. The legal basis for processing is the User’s consent, expressed by sending a request to join the Group chosen by the User (Article 6(1)(a) GDPR). The Controller processes the User’s personal data that is publicly available on Facebook, such as first name, last name, and profile image, as well as data voluntarily included in the content of the item listing.

Who have completed the Controller’s survey(s) regarding the Controller’s activities, including how the Groups function: to gather information from Users on the topic addressed in each particular survey. The legal basis for processing is the Controller’s legitimate interest in improving the effectiveness of the Controller’s activities, including matters concerning the operation of the Foundation or the Groups (Article 6(1)(f) GDPR), and, for data provided by the User that is not required, the User’s consent (Article 6(1)(a) GDPR). The Controller processes the User’s data as indicated by the User in the relevant survey form.

Who are Group admins and have completed the survey dedicated to them: to take steps toward entering into a volunteer agreement with the Foundation. The legal basis for processing is the performance of a contract with the Controller (Article 6(1)(b) GDPR), and, for data provided by the User that is not required, the User’s consent (Article 6(1)(a) GDPR). The Controller processes the User’s data as indicated by the User in the relevant survey form.

Who have signed up for the Controller’s newsletter: to receive information by email about the Controller’s activities. The legal basis for processing is the Controller’s legitimate interest in marketing its own services (Article 6(1)(f) GDPR), in connection with the User’s consent expressed in accordance with the Act on Providing Services by Electronic Means and the Telecommunications Law. The Controller processes the personal data the User entered in the contact form, namely first name, email address, and city.

2. The Controller also processes the Personal Data of Donors who have made donations to the Controller, covering the following data: first name, last name, home address, and bank account number. The Controller may also process other data provided directly by the Donor. The basis for processing is:

• entering into and performing the donation agreement between the Controller and the Donor (Article 6(1)(b) GDPR),
• fulfilling the Controller’s legal obligations related to receiving a donation, such as keeping proof of payment (Article 6(1)(c) GDPR),
• the Controller’s legitimate interest in contacting the Donor, among other things to thank the Donor for their support, inform them what has been achieved thanks to the Donor’s help, invite them to support further initiatives, inform them of our current activities, send holiday greetings, and enable further support; in short, you’ll be included in our Donor database.

3. In addition, the personal data of all Users and Donors is processed by the Controller for the purpose of possibly establishing, pursuing, or defending against legal claims. The legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) GDPR) in protecting or pursuing its rights.

§ 4. Voluntary Provision of Data and Consent

Providing data is voluntary for the User, but necessary for purposes such as communication, including via social media, gaining access to a Group, receiving the newsletter, or entering into a volunteer agreement, depending on the purpose for which the data is provided. Without providing the data marked as mandatory, it won’t be possible to fulfill the purpose the User is seeking, such as receiving a response from the Controller, receiving the newsletter, or being added to a Group. Not providing data that isn’t marked as required doesn’t affect the Controller’s ability to carry out the above actions for the User.

Providing data is voluntary for the Donor, but necessary for properly entering into and performing the donation agreement. Without providing it, it won’t be possible to make a donation to the Controller.

§ 5. Data Retention Period

The Controller will process personal data for the following periods:

• Personal data processed on the basis of the User’s consent: no longer than until the consent is withdrawn.
• Personal data of Users provided to receive the newsletter (email): for as long as the Controller’s legitimate interest in marketing its own services exists, but no longer than until the User objects to the processing or withdraws consent under the Act on Providing Services by Electronic Means or the Telecommunications Law.
• Personal data of Donors: for a period of no less than 5 years from the date the donation was made, in accordance with applicable law, including accounting and tax regulations, in order to demonstrate the Controller’s compliance with its obligations.
• Personal data of Users and Donors processed on the basis of the Controller’s legitimate interest: for as long as that interest exists, but no longer than until the User or Donor objects to such processing.
• Personal data processed within social networking services: for as long as the Controller’s legitimate interest exists (but no longer than until an objection to such processing is raised), for as long as the given social network operates, or until the User’s account on that network is deleted.
• Personal data of Users processed for the purpose of entering into a volunteer agreement: for the entire duration of the volunteer agreement.

The data retention period may be extended by the Controller until any potential claims related to the data processing or the relationship between the User or Donor and the Controller become time-barred.

§ 6. Recipients of Data

Recipients of personal data include entities cooperating with the Controller in the course of performing their duties: providers of IT, internet, and hosting services, survey tools, email services, and newsletter software, accounting, legal, and marketing service providers, banks, tax authorities, social media service providers, and the Foundation’s staff, associates, and volunteers, within the scope of their duties.

The personal data of Users and Donors may also be shared with public administration bodies or judicial authorities, if the Controller is required by law to provide such data.

§ 7. Transfer of Data Outside the European Economic Area

To fulfill the purposes for which Users and Donors provide their data to the Controller, the Controller uses tools provided by internationally operating companies. As a result, the Controller transfers personal data to third countries outside the European Economic Area, to the United States:

1. To engage the community and allow Users to share ideas and opinions about the Controller’s activities, as well as for surveys for group admins in order to enter into volunteer agreements, we use surveys within Google Workspace, provided by Google LLC, based in California, USA, in accordance with Google LLC’s privacy policy at https://workspace.google.com/security/. Google has stated that it has implemented new standard contractual clauses, which you can read about at https://support.google.com/analytics/answer/9012600, as well as https://business.safety.google/adscontrollerterms/ and https://business.safety.google/adsprocessorterms/.
2. To analyze traffic on the Website, we use Google Analytics, provided by Google LLC, based in California, USA, in accordance with Google LLC’s privacy policy at the addresses above.
3. To carry out our mission, we run a Facebook Page and Groups on Facebook, owned by Meta Platforms Inc., based in California, USA. Information on privacy standards: https://www.facebook.com/privacy/explanation. Meta Platforms Inc. has stated that it has implemented standard contractual clauses, which you can read about at https://www.facebook.com/business/help/336550838147603.
4. The General Data Protection Regulation (GDPR) doesn’t apply within the United States. Nor has the European Commission issued a decision finding that the United States provides an adequate level of personal data protection. This may result in increased risk in connection with the processing of your personal data by these entities, in particular due to the absence of a supervisory authority in the United States. Any complaints regarding compliance with personal data protection regulations may be submitted to the national supervisory authority for the Foundation, namely the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.

The transfer of your personal data to recipients in the United States is based on standard data protection clauses (model contractual clauses) that have been approved and adopted by the European Commission. You can obtain a copy of the standard contractual clauses by contacting the Controller at: rodo@uwagasmieciarkajedzie.org.

§ 8. Joint Controllership with Facebook

In connection with the Controller’s operation of a Facebook Page and Groups, the Controller is a joint controller of Users’ data together with the service provider, Meta Platforms Ireland Limited, based in Dublin (Ireland), at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, D02X525, Ireland (“Joint Controllers”).

Joint controllership covers aggregate data analysis aimed at displaying statistics on the activity of Users of the Facebook Page and Groups, as well as advertising activities carried out using the tools available there.

More information about Facebook and the arrangements between the Joint Controllers (including their respective areas of responsibility) can be found in Facebook’s privacy policy at: https://www.facebook.com/privacy/explanation and https://www.facebook.com/legal/terms/page_controller_addendum.

§ 9. Data Other Than Personal Data

The Controller uses Users’ IP addresses to diagnose issues related to the Website’s operation, analyze security breaches, and manage the website. The IP address is used to identify and gather demographic data about visitors to the site (such as the region a connection came from). This information is never combined in any way with the personal data of users or other services provided through our services.

Based on the information obtained, in certain cases aggregate, general statistical summaries are prepared and disclosed to third parties. These typically include information about the Website’s traffic. These summaries, however, don’t contain any data that would allow individual Users of our Website to be identified.

§ 10. Rights of Individuals Whose Data the Controller Processes

Every User whose personal data is processed by the Controller has the right to:
a) request information about whether we store their personal data,
b) access and review their data, and have it supplemented, updated, or corrected,
c) request a temporary or permanent restriction on processing,
d) request that it be transferred or erased,
e) lodge a complaint with the President of the Personal Data Protection Office, if they believe the processing of their personal data violates GDPR.

Where personal data is processed on the basis of consent, the User may withdraw consent at any time. Withdrawing consent doesn’t affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

The User has the right to object at any time to the processing of their data for direct marketing purposes, including profiling, if the processing is based on the Controller’s legitimate interest.

The User may also object at any time, on grounds relating to their particular situation, to the processing of their data in cases where the legal basis for processing is the Controller’s legitimate interest. The Controller will no longer be permitted to process that personal data, unless it demonstrates compelling legitimate grounds for processing that override the interests, rights, and freedoms of the User, or grounds for establishing, pursuing, or defending legal claims.

To exercise their rights regarding personal data, the User should send a request to the Controller’s email address: rodo@uwagasmieciarkajedzie.org.

With regard to jointly controlled personal data processed within social networking services, the User may exercise their rights against the Facebook service provider in accordance with the rules set out at https://www.facebook.com/privacy/explanation.

§ 11. Cookies

The website www.uwagasmieciarkajedzie.org may use cookies, which are used to identify the User’s browser while using the Website. By remaining on the Website, the User at the same time consents to the use of cookies. If a User doesn’t want cookies to be stored on their Device, they should adjust their browser settings accordingly.

Cookies are small text files sent by the Controller’s server and stored on the User’s side, which can only be read by the system that saved them. Cookies are used solely to aid identification. They store information necessary for the Website to display correctly, such as IP address, domain name, and browser type.

Cookies don’t allow any personal or address data of the user to be retrieved, and they aren’t harmful to the Device or to the User’s data, so it’s recommended not to disable them in the browser. If these files are disabled, some features of the Website may become unavailable.

Two main types of cookies are used on the Website:

Session cookies: these are temporary files stored on the User’s device until they leave the Website or close their browser software.

Persistent cookies: these are files stored on the User’s device for a period specified in the cookie’s parameters, or until deleted by the User.

Only first-party cookies are used on the Website, meaning cookies whose operation is necessary for the Website to function properly, namely:

NAME: PHPSESSID
DOMAIN: www.uwagasmieciarkajedzie.org
DURATION: 1 session
DESCRIPTION: This cookie stores and identifies a unique user session ID in order to manage user sessions on the website. It is a session cookie and will be deleted once all browser windows are closed.

NAME: cookieyes-consent
DOMAIN: www.uwagasmieciarkajedzie.org
DURATION: 1 year
DESCRIPTION: This cookie stores and identifies a unique user session ID in order to manage user sessions on the website. It is a session cookie and will be deleted once all browser windows are closed.

§ 12. Final Provisions

The Website, Groups, and Facebook Page may contain links to other websites. Such websites operate independently of the Controller and aren’t supervised by the Controller in any way. These sites may have their own privacy policies and terms of service, which we recommend reviewing.

The Foundation will inform Users of changes to this Privacy Policy. The current version of the Privacy Policy can be found at: https://www.uwagasmieciarkajedzie.org/polityka-prywatnosci/

Questions, comments, and requests related to this policy should be sent by email to: rodo@uwagasmieciarkajedzie.org.

Last updated: March 30, 2023.