Legal Documents
Privacy Policy
Information on the processing of personal data on the TOGKF Poland website
Please choose a language:
TOGKF Poland
Privacy Policy
Last updated: September 22, 2026
1. General Provisions
This Privacy Policy sets out the rules for processing the personal data of persons using the website available at https://togkf-polska.pl.
The Website is operated in connection with the activities of the Traditional Okinawan Goju-Ryu Karate-do Federation Poland and the organization of sporting events, in particular the TOGKF European Gasshuku 2027 taking place in Bydgoszcz.
This Privacy Policy has been prepared in particular on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR") and applicable provisions of Polish law on the protection of personal data.
2. Data Controller
The controller of the personal data processed in connection with registrations for events organized through the Website is:
BYDGOSKI KLUB OKINAWA GOJU-RYU KARATE-DO
National Court Register (KRS): 0000017794
Tax ID (NIP): 9532393588
Statistical No. (REGON): 092598550
Legal form: physical culture association
ul. Brzozowa 15/76
85-154 Bydgoszcz
Kuyavian-Pomeranian Voivodeship, Poland
For matters concerning the processing of personal data, the Controller can be contacted at:
3. Entity Responsible for Technical Operation of the Website
The Website has been built and is technically maintained by:
HASU sp. z o.o.
National Court Register (KRS): 0001186257
Tax ID (NIP): 9662209318
Statistical No. (REGON): 542324183
Share capital: PLN 5,000.00
ul. Alberta 11A/---
16-001 Księżyno
Podlaskie Voivodeship, Poland
HASU sp. z o.o. is not the organizer of the event and is not the controller of the personal data of event participants.
HASU sp. z o.o. provides technical services related to the operation of the Website, including maintenance of its software, infrastructure, and technical support for the forms.
To the extent that HASU sp. z o.o. processes personal data on behalf of the Controller, it acts as a data processor under the relevant legal relationship with the Controller, and only to the extent necessary to carry out the tasks entrusted to it.
4. What Data Is Processed
In connection with registration for the TOGKF European Gasshuku 2027, the Website may process the following data:
- first and last name,
- e-mail address,
- phone number,
- karate rank or rank in another martial art,
- information about affiliation with a karate organization, another martial arts organization, or lack of such affiliation,
- the participant's country,
- information regarding the status of the event participation fee.
Information regarding the payment status ("paid" / "unpaid") is organizational information used by the Controller and is not presented to other users of the Website.
The Website does not collect, via the form, data relating to payment card numbers, bank account numbers, or other payment instrument data.
5. Purposes of Data Processing
Personal data is processed in particular for the purpose of:
- accepting and processing registrations for event participation;
- organizing the TOGKF European Gasshuku 2027;
- contacting the participant regarding matters related to the event;
- confirming and managing participation in the event;
- maintaining organizational information regarding participants;
- verifying the status of event fee payments;
- ensuring the proper functioning of the Website;
- protecting the Website against misuse and security incidents;
- establishing, pursuing, or defending against potential claims, if necessary.
6. Legal Bases for Processing
Depending on the specific purpose, data processing may be based on:
- Article 6(1)(b) GDPR – where processing is necessary to take steps at the request of the data subject prior to event participation and to carry out organizational activities related to their participation;
- Article 6(1)(c) GDPR – where processing is necessary for compliance with a legal obligation to which the Controller is subject;
- Article 6(1)(f) GDPR – where processing is necessary for the purposes of the legitimate interests pursued by the Controller, in particular ensuring security, the proper functioning of the Website, and establishing or defending against claims;
- Article 6(1)(a) GDPR – in cases where the basis for processing is freely given consent.
The Controller selects the legal basis appropriate to the specific purpose of processing.
7. Voluntary Provision of Data
Providing the data required in the registration form is voluntary; however, for data necessary to process the registration, failure to provide it may prevent registration for the event or its proper processing. The Controller does not require the provision of data that is not necessary to achieve a specific purpose.
8. Recipients of Data
Personal data may be accessible to:
- the Controller – BYDGOSKI KLUB OKINAWA GOJU-RYU KARATE-DO;
- persons authorized by the Controller to organize the event;
- HASU sp. z o.o. – to the extent necessary to provide technical support for the Website;
- providers of the IT infrastructure used for the operation of the Website, in particular Netlify and Supabase;
- other entities providing services to the Controller, where their involvement is necessary for organizing the event or fulfilling legal obligations.
Data is not sold or shared with third parties for their own marketing purposes.
9. Infrastructure Providers
Netlify
The presentation layer of the Website is hosted using Netlify's services.
Within Netlify's infrastructure, technical data related to use of the Website may be processed, in particular data concerning requests made to the server, information about the device or connection, and technical data necessary to ensure the security and proper functioning of the infrastructure.
Supabase
Registration form data is stored in a database operated by Supabase.
The Controller's database project is configured in the West EU (Ireland) region, i.e. in Ireland.
Supabase provides mechanisms relating to data protection and the processing of personal data, including a Data Processing Addendum.
10. Transfer of Data Outside the European Economic Area
The Controller makes efforts to ensure that participants' data is processed within the European Economic Area. However, due to the use of technology providers' services, certain technical data may nevertheless be processed by, or accessible to, entities located outside the EEA, in accordance with the rules set out in the GDPR and the appropriate mechanisms for legalizing data transfers.
11. Data Retention Period
Participants' personal data is stored for the period necessary to organize and manage the event, and subsequently for the period necessary to fulfill legal obligations and to establish, pursue, or defend against potential claims.
As a general rule, data related to participation in the TOGKF European Gasshuku 2027 will be stored for up to 12 months from the end of the event, after which it will be deleted or anonymized, unless further storage is justified by a legal obligation or the need to establish, pursue, or defend against claims.
12. Rights of Data Subjects
In the cases specified in the GDPR, a data subject has the right to:
- access their personal data;
- obtain a copy of the data;
- rectify inaccurate or incomplete data;
- erasure of data;
- restriction of processing;
- data portability;
- object to processing based on Article 6(1)(e) or (f) of the GDPR;
- withdraw consent, if processing is based on consent;
- lodge a complaint with the President of the Personal Data Protection Office (UODO).
The scope of individual rights may be limited in cases provided for by law.
To exercise these rights, please contact the Controller at togkf.polska@gmail.com.
13. Right to Lodge a Complaint
If a data subject believes that their data is being processed in violation of the GDPR, they may lodge a complaint with the competent supervisory authority.
In Poland, the supervisory authority is:
The President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych)
ul. Stanisława Moniuszki 1A
00-014 Warsaw, Poland
14. Data of Minors
The Website may allow the registration of a minor for an event.
For a person under 18 years of age, registration is carried out by their parent or legal guardian, unless applicable laws or the organizer's rules provide otherwise.
The Controller may require confirmation of the parent's or legal guardian's authority to register the minor and to provide the required consents.
For persons under 16 years of age, the Controller applies the requirements regarding the consent of a legal representative arising from Article 8 of the GDPR, where the basis for processing is consent to an information society service.
15. Data Security
The Controller applies appropriate technical and organizational measures aimed at protecting personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.
The Website uses an encrypted HTTPS connection.
Access to data stored in the system is limited to persons and entities that need it to perform their duties.
16. Cookies and Technical Data
The Website does not use its own cookies for the purpose of profiling, behavioral advertising, or tracking users.
However, in connection with the use of the Website's technical infrastructure, service providers may process technical information regarding the connection to the Website, such as IP address, browser and device information, time, and the nature of the request.
Technical data may be used in particular to ensure security, prevent misuse, and ensure the proper functioning of the infrastructure.
If additional technologies using cookies or similar technologies are implemented on the Website in the future, this Privacy Policy will be updated accordingly.
17. Automated Decision-Making and Profiling
Website users' personal data is not used for automated decision-making that produces legal effects concerning them or similarly significantly affects them. The Controller does not carry out profiling of participants for marketing purposes.
18. Changes to the Privacy Policy
The Controller may update this Privacy Policy, in particular in the event of:
- changes in the law;
- changes in how the Website operates;
- changes in the technology providers used;
- an expansion of the scope of data processed or the purposes of its processing.
The current version of the Privacy Policy is published on the Website.
19. Contact
For matters relating to the protection of personal data, please contact:
BYDGOSKI KLUB OKINAWA GOJU-RYU KARATE-DO
ul. Brzozowa 15/76
85-154 Bydgoszcz, Poland
e-mail: togkf.polska@gmail.com