Privacy policy of Studio DR sp. z o.o.
For websites, events and tourist events, online course platforms and commissioned services
Last updated: 14 October 2026
We respect your privacy. This document explains in one place what personal data Studio DR sp. z o.o. processes, why, on what basis, who receives it, how long we keep it and what rights you have. It is universal: the same rules apply to our websites, events, online course platforms and commissioned services. What is specific to a service is in that service’s own documents.
1. Who we are
The controller of your personal data is Studio DR sp. z o.o., ul. Malinka 65D/2, 43-460 Wisła, Poland, registered in the National Court Register (KRS) under number 0000112221 (registry documents kept by the District Court in Bielsko-Biała, 8th Commercial Division of the KRS), tax ID (NIP) 548-10-11-757, REGON 070569257 („Studio DR”, „we”, „us”). Studio DR is a tour operator entered in the Central Register of Tour Operators and Entrepreneurs Facilitating Linked Travel Arrangements under number 43558 (registering authority: the Marshal of the Silesian Voivodeship).
For anything about your personal data write to us at privacy@studiodr.pl (outside Poland) or iod@studiodr.pl (Poland), or by post at the address above marked „DPO”. Our Data Protection Officer is Emilian Kujawski. The addresses used to run our services (for example wydarzenia@studiodr.pl or contact@thesecondstep.net) are for service matters; please send requests about personal data to the DPO addresses.
2. What this Policy covers
This Policy is a single document for all of Studio DR’s activities: our websites (for example studiodr.pl and thesecondstep.net), contact with us, events and tourist events, online course platforms and commissioned services. It sets out the rules common to all of them. Details of a particular service are in that service’s own documents, which supplement this Policy.
| WHO YOU ARE & WHAT YOU DO | WHAT TO READ IN ADDITION TO THIS POLICY |
|---|---|
| You visit our websites | Cookie Policy |
| You register for or take part in an event or tourist event (including as a parent, guardian or contact person) | The general terms of participation (OWU) of the event, and the image notice |
| You have an account or buy courses on an online platform | The Terms of Service of that platform and its Cookie Policy |
| You commission a service from us (recordings, websites and apps, hosting, video, photography, translation, studio equipment) or you are a representative or contact person of the client | The contract or offer for that service and, where one has been concluded, the data processing agreement |
Commissioned services. Besides events and courses we provide services to clients under separate contracts: music and voice-over recordings (in our studio and on location), website design, mobile and web application development, hosting, video, graphics and promotional materials, photography, event and streaming support, translation, and distribution of studio equipment. For the data of the client and of the people the client names (representatives, contact persons, employees) we are the controller and this Policy applies. Where in providing a service we process personal data entrusted to us by the client (for example data of users of the client’s website or application, data in hosted systems, or data in documents for translation), we do so as a processor, only on the client’s documented instructions and under a data processing agreement (Art. 28 GDPR). In that case the client is the controller and it is the client who informs the people concerned. The rules on recording and using the image or voice of people appearing in recordings, films and photographs are set by the contract with the client.
3. Services and tools we use
The table lists, by purpose and provider, the services we use, the personal data they process and where. Our Cookie Policy says which of them run on which website.
| PURPOSE | SERVICE AND PROVIDER | PERSONAL DATA | PLACE OF PROCESSING |
|---|---|---|---|
| Analytics (with consent) | Matomo, self-hosted by Studio DR | Trackers (cookies), usage data | EEA |
| Analytics (with consent) | Google Analytics, Google Ireland Limited and Google LLC | Trackers (cookies), usage data | EEA and United States |
| Measuring the effectiveness of advertising, in a limited way and only on selected websites (with separate consent) | Meta Pixel, Meta Platforms Ireland Limited and Meta Platforms, Inc. | Trackers (cookies), data on usage and events; scope in the Cookie Policy | Ireland and United States |
| Payments | Stripe, Stripe, Inc. (online and international payments) and ING Pay, ING Bank Śląski S.A. | Billing address, email, payment and transaction data. We do not store full card details. | United States and EEA (Stripe); Poland (ING) |
| Hosting and our own platforms | OVH (data centre near Strasbourg, France) and platforms built and run by Studio DR | Data in the hosted systems, including account and course data | EEA (France) |
| Contacts and email communications | Salesforce and Salesforce Marketing Cloud, Salesforce, Inc. | Email, name, subscription status, data on email opens (with consent) | United States |
| Contacting us | Contact forms, email, telephone | Email, name, message content | EEA |
| Events and tourist events | Event’s registration system (Gravity Forms + Salesforce) and DeoLink Association as processor (section 7) | Data of registrants and participants; scope in the OWU | United States and EEA |
| Commissioned services | Systems for handling orders and communicating with clients, and subcontractors (section 8) | Contact and billing data of clients and their representatives; scope in the contract | Depends on the service; details in the contract with the client |
Tools we only plan to use are added to this list on the day they go live.
4. Purposes and legal bases
If you are in the European Economic Area, the United Kingdom or Switzerland, we process data on the GDPR bases shown in the table. The last column shows the areas where each purpose applies.
| PURPOSE | LEGAL BASIS | AREA |
|---|---|---|
| Replying to enquiries and correspondence | Art. 6(1)(f) (legitimate interest in replying to you); where it concerns a contract: (b) | all |
| Concluding and performing a contract: taking part in an event or tourist event, an account and access to courses, buying a course | Art. 6(1)(b) | events, online courses |
| Concluding and performing a contract for a commissioned service, including data of the client’s representatives and contact persons, equipment delivery and warranty service | Art. 6(1)(b) (where the client is an individual); (f) (where the data concern the client’s representatives and contact persons: our legitimate interest in properly performing the contract with the client) | commissioned services |
| Payments, accounting, taxes, and duties under tourism and consumer law, including handling withdrawal from a contract | Art. 6(1)(c) | events, online courses, commissioned services |
| Insurance and financial security for participants in tourist events | Art. 6(1)(b) and (c) | events |
| Safety of participants during an event, including contacting the person named for emergencies | Art. 6(1)(b) and (f); where life or health is at risk: (d) and Art. 9(2)(c) | events |
| Special category data, for example participants’ health and diets, answers to reflection questions in courses (section 5) | Your explicit consent: Art. 9(2)(a) and Art. 6(1)(a) | events, online courses |
| Showing the consents and statements you gave (consent record) and establishing, exercising and defending legal claims | Art. 6(1)(f) (including accountability, Art. 7(1) GDPR) | all |
| Marketing information and newsletters, including measuring email opens | Art. 6(1)(a) (consent), in line with Art. 398 of the Polish Electronic Communications Law; where consent is not required: (f) | all |
| Analytics and traffic statistics on websites | Art. 6(1)(a) (consent), in line with Art. 399 of the Polish Electronic Communications Law | websites |
| Measuring the effectiveness of advertising (Meta Pixel) | Art. 6(1)(a) (separate consent), in line with Art. 399 of the Polish Electronic Communications Law | selected websites |
| Security of websites and systems and preventing abuse | Art. 6(1)(f) | all |
| Capturing and using images during events | Art. 6(1)(a) | events |
Giving us the data needed to conclude a contract and meet legal duties is voluntary, but without it we cannot conclude the contract or provide the service. Everything else, including consent to special category data, marketing, analytics and advertising, is your choice and does not affect your access to the service.
5. Special category data
In some services we may process data about health (for example information on participants’ diets and special needs, or answers to reflection questions in courses, which may reveal addiction or recovery), and taking part in a spiritual programme may indirectly reveal religious beliefs. We process such data only with your explicit, separate consent, only as far as the service needs it and only if you choose to give it to us, or in a situation expressly provided for by law, for example to save a life. Consent is voluntary and you can withdraw it at any time, without affecting the lawfulness of processing before withdrawal. Only people who need access and are authorised have it, we do not use this data for analytics, advertising or to train or feed artificial intelligence tools, and no analytics or advertising scripts run on pages where we collect such content. The details for each service, including what happens when you withdraw consent, are in its OWU or Terms of Service.
6. Minors and age
Our online course platforms are for adults only, aged 18 or over. Minors can take part in events and tourist events. In that case a parent or legal guardian concludes the contract and gives the data (we process that person’s data too), and the legal representative gives, on the minor’s behalf, the consents needed for the minor’s participation (in particular on health and image). We process minors’ data with particular care and only as far as necessary.
7. Cooperation with DeoLink Association at events
Part of the programme of some events (spiritual and experiential in nature) is delivered for Studio DR by DeoLink Association, ul. Malinka 65D/2, 43-460 Wisła, KRS 0000160777 („DeoLink”), which owns Studio DR, with volunteers. In that role DeoLink acts as a processor on behalf of Studio DR, on its documented instructions and under a processing agreement (Art. 28 GDPR). It processes participants’ data only during the event and, if the nature of the work requires it, before it, does not build its own databases of participants and keeps no data after the event. People acting on its behalf, including volunteers, are bound by confidentiality. DeoLink acts as an independent controller only if you separately and voluntarily agree that it may use your contact data or image for its own purposes. The OWU of the event give the details. DeoLink takes no part in processing data of users of our online course platforms.
8. Who receives your data
We share data only with those who need it for the purposes in this Policy. Providers that process data on our behalf do so under a processing agreement and on our documented instructions.
| RECIPIENT | ROLE | DATA |
|---|---|---|
| OVH (hosting) | Processor | Data in the hosted systems |
| Stripe, Inc. / ING Bank Śląski S.A. (payments) | Processor; for their own legal and anti-fraud duties, independent controller | Payment and transaction data |
| Salesforce, Inc. | Processor | Email, name, subscription status, email open data |
| Google Ireland Limited / Google LLC (Google Analytics) | Processor | Website analytics data, with consent |
| Meta Platforms Ireland Limited / Meta Platforms, Inc. (Meta Pixel) | For collection and transmission of data by the Pixel: joint controller with us (Art. 26 GDPR); beyond that, independent controller | Visit and event data, with separate consent |
| DeoLink Association | Processor at events; independent controller only with your separate consent | Programme data; contact data and image only with consent |
| Insurer, guarantor, Marshal of the Silesian Voivodeship, Tourist Guarantee Fund | Independent controllers | Data needed for protection and benefits (events) |
| Carriers, hotels, resorts and other travel service providers | Independent controllers or processors | Data needed to deliver the service (events) |
| Subcontractors and collaborators (for example voice-over artists, translators, graphic designers, photographers, operators), suppliers and manufacturers of studio equipment | Processors or independent controllers | Data needed to carry out the commission or order (commissioned services) |
| Accountants, law firms, advisers | Processors or independent controllers | Data needed for their tasks |
| Public authorities and services | Independent controllers | Where the law requires |
We do not sell your personal data. Matomo analytics data is processed by Studio DR in its own installation in the EEA.
9. Transfers outside the EEA
Some of our providers are based in the United States (Stripe, Salesforce, Google, Meta), as are the manufacturers of the studio equipment we distribute (in connection with handling orders and warranty). Your data may therefore be transferred outside the European Economic Area. This happens on the basis of the European Commission’s adequacy decision (the EU–U.S. Data Privacy Framework, for certified providers) and otherwise on the standard contractual clauses approved by the European Commission. For events outside the EEA, we give the data needed to deliver the services (for example hotel or transport bookings) to the providers of those services in the destination country, which is necessary to perform our contract with you (Art. 49(1)(b) GDPR); in such countries the level of data protection may be lower than in the EU. You can obtain a copy of the safeguards by writing to the DPO. We publish the current list of providers and mechanisms on the page „Data Controller’s Information on Data Transfer to Third Countries”: https://studiodr.pl/data-transfer-to-third-countries/.
10. How long we keep data
| DATA | PERIOD |
|---|---|
| Correspondence and enquiries | Until the matter is closed, then no longer than 36 months |
| Data from the contract for taking part in an event, buying a course or a commissioned service, and its performance | Until the contract is performed, then for the limitation period of claims under Polish law (the Civil Code and the Act on Tourist Events and Linked Travel Arrangements) |
| Materials and data entrusted by the client | In line with the contract with the client and the data processing agreement; after the service ends we delete them or return them to the client on its instruction |
| Tax and accounting records | 5 years from the end of the year in which the deadline for paying the tax expired |
| Account on an online platform | Until you delete the account. We delete inactive accounts after 2 years of inactivity |
| Special category data | Only as long as the service needs them and no longer than until you withdraw consent or delete the account (the OWU or Terms of Service of the service give details, including immediate deletion on withdrawal of consent). Event participants’ data: until the event ends and related incidents are settled, unless a legal provision or the defence of claims requires longer |
| Data entrusted to DeoLink | Only during the event and, if the nature of the work requires it, before it. DeoLink keeps no data after the event |
| Consent record, withdrawal-from-contract statements and their acknowledgements | 6 years, to the end of the calendar year in which that period ends (to show we met our obligations) |
| Newsletter and email open data | Until you withdraw consent |
| Cookie, analytics and advertising data | As set out in the Cookie Policy |
| Backups | We make them daily. Data deleted from our systems disappears from backups in their normal rotation within 365 days |
After these periods we delete or anonymise the data.
11. Cookies and similar technologies
On our websites we use only the cookies needed to make them work, unless you consent to more. We switch on analytics and advertising cookies only after you consent in the cookie banner, where „Accept all”, „Reject all” and „Customise” are equally easy to choose and closing the banner without choosing counts as no consent. You can change your choice at any time with „Cookie settings” at the bottom of the page. Emails we send because of what you do (for example an order confirmation) contain no tracking pixels; newsletters contain an element that measures whether the email was opened, which works only after the consent you give when you subscribe. The full list of cookies (name, provider, purpose, duration) and which tools run on which website are in the Cookie Policy.
12. Your rights
In connection with the processing of your data you have the right to:
- access your data and get a copy,
- rectification of your data,
- erasure of your data where we have no basis to keep processing it,
- restriction of processing,
- portability of data we process on the basis of consent or contract by automated means; in services that allow it you can download a copy of your data in your account settings,
- objection to processing based on our legitimate interests, on grounds relating to your particular situation, and at any time to direct marketing,
- withdrawal of consent at any time, without affecting the lawfulness of processing before withdrawal. You can change cookie consent in „Cookie settings”, consents in a service in your account settings or as described in the OWU, and marketing consent with one click in an email.
To use these rights write to the DPO (section 1). We reply without undue delay and within one month. We may ask you to confirm your identity. If a client entrusted your data to us and we act as a processor, send your request to the client; any request that reaches us we will pass on to the client without undue delay.
13. Complaints to a supervisory authority
If you think we are processing data unlawfully you can complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland), our lead authority, or to the supervisory authority of the EEA country where you live, work or where the breach occurred. People in the United Kingdom can contact the Information Commissioner’s Office. We encourage you to contact our DPO first, because we can often settle things faster.
14. Security and automated decisions
We apply technical and organisational measures suited to the risk, including encrypted connections, access control, separate handling of special category data, daily backups and agreements with processors. If a personal data breach may put you at risk, we will tell you and the supervisory authority as the law requires. We do not make decisions about you based solely on automated processing, including profiling, that would have legal effects on you or similarly significantly affect you.
15. Changes to this Policy
We may update this Policy, in particular when the law, the services we use or the way we process data changes. The current version is always on our websites with the date of the last update, and the Polish and English versions have the same content. We will tell you clearly about material changes that affect your data and, where a change needs your consent, we will ask for it again.
Thank you for choosing Studio DR!
Studio DR Team