Privacy policy

This policy explains how we process the personal data of people who visit tiguarfitness.com, send us forms, or sign up for our mailing lists. It applies to all language versions of the website.

1. Data Controller

The data controller is Piotr Ośródka, conducting business activity under the business name tiguar Piotr Ośródka, registered in the Central Registration and Information on Business (CEIDG):

• address: ul. Brukowa 6/8, 91-341 Łódź
• Tax ID (NIP): 7262266346, REGON: 472927286
• email: biuro@tiguar.pl
• phone: +48 505 519 518

In this policy, we refer to him as "tiguar" or "we".

We have not appointed a data protection officer. For any matters concerning your data, write to biuro@tiguar.pl or to the postal address above.

2. Scope of the Policy

This policy covers data we collect on tiguarfitness.com. The website also links to other services that have their own terms:

• the online store tiguar.pl, where you conclude a sales contract,
• the platform for business clients b2b.tiguar.pl,
• ticket sales for EU4YA, operated by Gridaly sp. z o.o. with registered office in Warsaw (ul. Nowogrodzka 64 lok. 43, 02-014 Warsaw), which is an independent controller of ticket buyers' data.

When you visit these services, their own privacy policies apply.

3. Purposes, Legal Grounds, and Retention Periods

We process data that you provide yourself in forms and correspondence, as well as the technical data described below. The legal grounds are the provisions of Article 6(1) of the GDPR: point (a) (consent), point (b) (steps prior to entering into a contract at your request or performance of a contract), point (c) (legal obligation), and point (f) (our legitimate interest).

Replying to messages and inquiries: "Contact us", "Brief: show us your space", "Product inquiry" forms, as well as email and phone

• Data: first and last name, email, phone, company, city, message content, facility information, attached files.
• Legal ground: point (b), and when you act on behalf of a company, point (f) (contact with a counterparty representative).
• How long: 3 years from the last contact. If we enter into a contract, for the duration of its performance and the period required by tax regulations (5 years from the end of the year).

Processing distributor applications

• Data: company, Tax ID (NIP), country, website, first and last name, email, phone, message.
• Legal ground: points (b) and (f).
• How long: 3 years from the last contact, and after entering into a contract, as stated above.

Evaluating ideas submitted to the Innovation LAB

• Data: first and last name, email, phone, description of the idea, date of accepting the terms, and end date of the exclusivity period.
• Legal ground: point (b) (evaluating an idea under accepted terms) and point (f) (proof of acceptance of terms).
• How long: for the duration of the idea evaluation and the exclusivity period, then 3 years from the last contact.

Product feedback in the Innovation LAB

• Data: product, first and last name, email, feedback content.
• Legal ground: point (f) (product development).
• How long: 3 years from submitting feedback.

Applications for #tiguarteam

• Data: first and last name, email, profiles on Instagram, TikTok, and YouTube, type and location of training, message.
• Legal ground: points (b) and (f) (assessing cooperation).
• How long: 3 years from the last contact.

EU4YA exhibitor or sponsor applications

• Data: first and last name, email, phone, company, industry, selected package, message.
• Legal ground: points (b) and (f).
• How long: 3 years from the last contact, and after entering into a contract, as stated above.

Newsletter, EU4YA Early Birds list, and marketing updates after Innovation LAB feedback

• Data: email, first and last name (Early Birds, feedback), website language, IP address, signup date, information on opening messages and clicking links.
• Legal ground: point (a) (consent). Proof of consent: point (f).
• How long: until consent is withdrawn. Proof of consent for 3 years from its withdrawal.

Establishing, pursuing, and defending claims

• Data: data from correspondence and submissions.
• Legal ground: point (f).
• How long: until the expiration of the limitation period for claims.

Campaign performance analysis

• Data: UTM parameters from the URL, website language, submission date.
• Legal ground: point (f) (evaluating where inquiries come from).
• How long: together with the submission data.

Website maintenance and security, including protecting forms against spam

• Data: IP address, date and time, visited subpages, browser data, technical form submission details.
• Legal ground: point (f).
• How long: up to 30 days.

Visitor statistics (Google Analytics 4)

• Data: cookie identifiers, data about the device, browser, and approximate location, visited subpages and interactions.
• Legal ground: point (a) (consent to analytical cookies).
• How long: 14 months.

Advertising and measuring ad performance (Meta Pixel, Google Ads)

• Data: cookie identifiers, IP address, device and browser data, visited subpages, events such as submitting a form (excluding its content).
• Legal ground: point (a) (consent to marketing cookies).
• How long: until consent is withdrawn; cookies for the duration specified in the cookie policy.

4. Who We Share Data With

We do not sell data. We share it with companies that provide services to us and process data on our behalf under a data processing agreement, and with your consent also with advertising tool providers. When we conclude a contract, data is also received by our accounting firm and bank. Data may also be provided to public authorities where required by law.

• Railway Corp., San Francisco (USA): hosting the website, database, and files; website traffic, server logs, draft submissions. Servers in the EU.
• Bitrix24 system provider: CRM system for handling inquiries and cooperation; form data and attachments. Servers in the EU.
• GetResponse S.A., ul. Grunwaldzka 413, 80-309 Gdańsk: sending newsletters and EU4YA updates; email, first and last name, IP address, date of consent, list.
• Google Ireland Limited, Dublin: visit statistics (Google Tag Manager, Google Analytics 4) and Google Ads advertising, only upon your consent; analytical and advertising data described in section 3. Possible transfer to Google LLC in the USA.
• Meta Platforms Ireland Limited, Dublin: advertisements on Facebook and Instagram and measuring their effectiveness (Meta Pixel), only upon your consent; identifiers from cookies, IP address, device data, visited subpages, and events. Possible transfer to Meta Platforms, Inc. in the USA.
• Google (YouTube): video player; technical device data, only upon consent and starting the video.
• Google (Gemini): translation of texts published on the website, including names, job titles, and biographies of individuals. No data from forms.
• dhosting.pl: e-mail and domain DNS; messages sent to addresses in the tiguarfitness.com domain.
• Koda Plus: contractor and technical maintenance of the website; access to the admin panel and server to the extent necessary for the work.
• Operator of the tiguar.pl store (Shoper): displaying product photos; the IP address of your device when the browser downloads a photo from tiguar.pl.

With Meta Pixel, we act as a joint controller with Meta Platforms Ireland Limited regarding data collection on the website and transferring it to Meta. Further processing is described in Meta's privacy policy: facebook.com/privacy/policy.

5. Data transfer outside the European Economic Area

Some of our providers are US companies or belong to US groups: Railway, Google, and Meta. Data may therefore be transferred to the USA, e.g. during technical maintenance or as part of analytical and advertising services.

Transfers take place based on the European Commission's adequacy decision under the EU-US Data Privacy Framework, and when a recipient is not covered by it, based on standard contractual clauses approved by the Commission. You can obtain a copy of the safeguards by writing to biuro@tiguar.pl.

6. Your rights

In connection with data processing, you have the right to:

• access your data and receive a copy of it,
• rectify your data,
• erase your data,
• restrict processing,
• data portability, when we process it based on consent or a contract,
• object to processing based on our legitimate interest,
• withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

Right to object. You can object at any time to the processing of your data based on our legitimate interest. If the objection concerns marketing, we will stop processing your data for that purpose.

To exercise your rights, write to biuro@tiguar.pl. We will reply within a month. You can also unsubscribe from the newsletter using the link in every message. You can change your cookie consent using the "Cookie settings" button in the website footer.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw.

7. Do you have to provide your data

Providing data is voluntary. However, without the fields marked as required in the form, we cannot accept your submission or answer your enquiry. Without an e-mail address, we will not sign you up for the newsletter.

8. Profiling

We do not make decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you. If you consent to marketing cookies, Meta and Google may tailor the ads displayed to you based on your interests, including showing tiguar ads to people who visited our website. Google Analytics 4 creates aggregate visit statistics, which we do not use to make decisions about specific individuals.

9. Personal data published on the website

On the website, we display the first names, surnames, job titles, photos, and biographies of our team members and contact persons, EU4YA speakers, authors of participant reviews, and installation specialists during projects. We do this based on the consent of these individuals (Art. 6(1)(a) of the GDPR, and regarding image rights, Art. 81 of the Copyright and Related Rights Act) or our legitimate interest, which is presenting the company, team, and event (point f). We display data for the duration of the cooperation or until consent is withdrawn.

If you want us to remove your data from the website, write to biuro@tiguar.pl. We will remove it promptly from the website and version history in the admin panel, and from backups once they expire.

Texts published on the website, including biographies, are translated into other languages using the Google Gemini tool.

10. Security

We use an encrypted connection (HTTPS), limit access to data to individuals who need it, and protect forms against spam without third-party CAPTCHA services.

11. Policy changes

We update the policy whenever our services, providers, or regulations change. The current version is always available on this page along with its effective date.