Privacy Policy

Information on the Processing of Personal Data on the Website, in the Customer Portal, the App and EDS Schools

This document covers the processing of data on the egurrola.com website, in the Customer Portal, the mobile app and in connection with the operation of Egurrola Dance Studio schools.

1. Scope of the Terms and Conditions and Parties to Agreements

1. This Policy describes the rules governing the processing of personal data in connection with the use of the egurrola.com website, the Customer Portal and the Egurrola Dance Studio mobile app, the central Customer service system, the conclusion and performance of Agreements, participation in classes, payments, complaints, communication and the operation of EDS Schools.
2. In this Policy, the abbreviation “EDS” refers to the Egurrola Dance Studio brand and network of schools, rather than to a single legal entity. The entities operating EDS Schools are listed in the current Appendix No. 1 to the Egurrola Dance Studio Terms and Conditions. To the extent that at least two of these entities jointly determine the purposes and means of processing personal data, they act as Joint Controllers within the meaning of Article 26 of the GDPR. With regard to processes carried out independently by a specific entity, in particular its own contractual, accounting, tax or legal obligations, that entity may act as an independent Controller.
3. An additional privacy notice may be provided for a separate process, in particular a camp, day camp, tournament, recruitment process, competition, video surveillance or a partner service, where required by the nature of the processing.

2. Data Controllers and Contact Point

1. The entities involved in data processing within EDS are those listed in the current Appendix No. 1 to the Egurrola Dance Studio Terms and Conditions, including EGURROLA DANCE STUDIO – Agustin Marek Egurrola. With regard to joint processes in which these entities jointly determine the purposes and essential means of processing personal data, they act as Joint Controllers.
2. Joint controllership may apply in particular to the operation of the central Customer service system and CRM, the shared Account and profiles of Related Persons, the operation of the Website, Customer Portal and App, the identification and authentication of Users, the presentation of data concerning services provided at different Schools, centralised Customer service, the security of shared systems and joint programmes and Offers. Marketing activities may be subject to joint controllership only to the extent that specific entities jointly conduct a particular process and the individual has been informed which entities are covered by the relevant consent or other legal basis for processing.
3. EGURROLA PRODUCTION sp. z o.o., Aleje Jerozolimskie 91, 02-001 Warsaw, KRS 0000565765, NIP 5223033134, REGON 361959421, acts as the Platform Operator and is organisationally responsible for technical processes relating in particular to the creation and security of the Account, authentication in the App, session management, Platform maintenance, diagnostics and central technical support. In processes jointly determined with other EDS entities, it may act as a Joint Controller.
4. The relevant Seller indicated in the Offer, Agreement, order summary or payment confirmation is primarily responsible for processes connected with the specific Agreement and service, including participation in classes, Participant documentation, schedules, attendance, amounts due, sales documents, complaints and the obligations of the relevant School. Where it independently determines the purposes and means of a given processing operation, it acts as an independent Controller in this regard.
5. The mere fact of operating under the shared EDS brand or jointly controlling selected processes does not mean that every Joint Controller has access to all data concerning all Customers and Participants. Access is limited to the extent necessary for the relevant purpose, role, service and authorisation.
6. The publisher of the App in the Apple App Store is EGURROLA PRODUCTION sp. z o.o. The publisher of the App in Google Play is EGURROLA DANCE STUDIO – Agustin Marek Egurrola. Publisher status alone does not determine the role of Controller with regard to all data processed in the App.
7. The Joint Controllers make the arrangements required under Article 26 of the GDPR, transparently defining the division of responsibilities for compliance with obligations arising under the GDPR, in particular those concerning the provision of information, the handling of data subject rights, data security, access management, responding to personal data breaches and cooperation with the supervisory authority.
8. The main division of responsibilities is as follows: the Platform Operator coordinates obligations relating to the technical operation of the shared Platform and Account; the relevant Seller is responsible for processes arising from the service and Agreement it performs; and each entity is responsible for its own legal, accounting and tax obligations and its own claims. The shared contact point facilitates the receipt of requests and their referral to the entity or entities responsible for the relevant process.
9. A data subject may exercise their rights under the GDPR against any of the Joint Controllers, regardless of the internal division of responsibilities between them.
10. Central contact point for data protection matters: ido@egurrola.pl. The enquiry will be handled or forwarded to the entity or entities responsible for the matter concerned. Using the central contact point does not restrict the option of contacting the relevant Controller or Joint Controller directly.

3. Categories of Data Processing

4. Sources of Data

1. Data is provided directly by the Customer, Participant, parent, legal guardian, Payer or another authorised person and may also originate from an earlier registration in the central Customer service system, a concluded Agreement, the School reception, the Website, Customer Portal or App.
2. Payment status and transaction identifiers may be obtained from the payment service provider and banks participating in the process.
3. Technical and diagnostic data is generated while using the Platform in accordance with its configuration, settings and consents.
4. The App does not require access to the content of SMS messages or call history for login using a one-time SMS code.

5. Purposes and Legal Bases

6. Data Concerning Minors

1. The Platform is designed primarily as a tool for adult Customers, parents, legal guardians and adult Participants. A minor’s profile is linked to a person authorised to act on their behalf.
2. The following may be available in the App on a child’s profile: full name, date of birth, Group / course, School / location, attendance, payments and passes and schedule. The App does not use the child’s PESEL number.
3. A parent or another authorised person may switch between linked children’s profiles without logging in again and manage their registrations to the extent made available through the Platform. Minors’ profiles are not used for behavioural advertising or advertising profiling; the App does not use an Advertising ID / IDFA.
4. Child Safeguarding Standards are applied at the Schools.

7. Mobile App – Technical Data and Permissions

1. The App uses technical data required for login, security, notification handling and diagnostics, including the device model and manufacturer, Android/iOS version, App version, IP address, Firebase installation identifier and FCM notification token.
2. The App does not use an Advertising ID / IDFA or Android ID / IDFV. It does not request access to precise or approximate GPS location, the camera, photo gallery, microphone, contacts, calendar, Bluetooth or NFC.
3. The following may be stored locally on the device: the login token and user data in the App’s memory, tickets or passes in PDF format and the image cache. The token and user data are removed when the User logs out or deletes the Account; files and cached data are removed in accordance with the operation of the App and the operating system.
4. The QR code of a ticket or Customer Card contains a random digital identifier (GUID / ticket token), rather than personal data that can be read without access to the EDS validation system.
5. Push notifications may be segmented in the CRM according to service-related criteria, in particular the School / location or the Participant’s registrations. This does not constitute behavioural advertising to children.
6. The App’s backend servers and CRM are hosted in Poland / within the EEA. The exception is certain Google services used by the App, which may also process technical data outside the EEA, as described in Section 11 of the Policy.

8. Recordings, Images and Video Surveillance

1. Photographic or video documentation may be created in connection with classes, rehearsals, shows, tournaments, examinations, auditions and other events. Every use of such documentation requires a specified purpose and an appropriate legal basis, and the scope of the recording must be necessary and proportionate to that purpose. The material may be used in particular for teaching and methodological purposes, to document the delivery of the programme or service, to organise events, ensure safety, investigate incidents and complaints and establish, exercise or defend claims. Where a documentation obligation genuinely arises from legislation, statutes, a programme, supervisory authority requirements or the rules governing the records of an establishment, the material may be processed to the extent necessary to comply with that obligation.
2. Recording material for internal purposes is not equivalent to its public dissemination. The publication of an individual Participant’s image for informational, promotional or marketing purposes takes place on an appropriate legal basis; where consent is required, it is obtained separately and freely given.
3. Where a recording includes a Participant’s artistic performance, in particular a performance of choreography, EDS respects the rights of the performer. Public use of such material takes place on the basis of appropriate consents, permissions or other legal grounds permitted by law.
4. Video surveillance may be used at selected Schools to ensure the safety of individuals or protect property. The Controller responsible for the surveillance, its legal basis and detailed rules are specified in the notice available at the relevant location. Where Article 108a of the Education Law Act applies to a School or establishment, video surveillance is introduced and operated in compliance with the requirements of that provision. Video surveillance records images only and is not used to monitor the quality of employees’ work.
5. As a rule, video surveillance does not cover rooms in which teaching, educational or care activities take place, cloakrooms, changing rooms, sanitary facilities or other rooms protected by law. An exception is permitted only where the specific conditions laid down by law have been met and measures protecting dignity and personal rights have been implemented. The monitored area is marked, and detailed information concerning the Controller, purpose, legal basis and retention period of recordings is available at the relevant location.

9. Paynow Payments

1. Online payments are processed using the Paynow service provided by mElements S.A., with its registered office in Warsaw at 18 Prosta Street, 00-850 Warsaw, KRS 0000590484, NIP 5223047892, a domestic payment institution entered in the register maintained by the Polish Financial Supervision Authority under number IP47/2019.
2. mElements S.A. processes data to the extent necessary to provide the payment service, authenticate users, prevent fraud, handle complaints and comply with legal obligations, in accordance with its own documents.
3. The following data is transferred to Paynow: order identifier (External ID), amount, PLN currency, transaction description, Payer’s first name and surname, email address and User’s IP address. Full card details, card numbers, CVC codes and BLIK codes never pass through the EDS API or App. Once the transaction is completed, Paynow sends a webhook containing the payment status (e.g. CONFIRMED or REJECTED) to the EDS systems; the payment status and Paynow transaction identifier are stored in the CRM and mobile database.

10. Data Recipients and Service Providers

1. Within jointly controlled processes, data may be shared between the Joint Controllers only to the extent necessary to fulfil the joint purpose and in accordance with the permissions granted. Independently of this, data may be made available to the relevant Sellers and Schools to the extent necessary to administer their Agreements and comply with legal obligations.
2. Providers of the central Customer service system, hosting and cloud services, Website and App maintenance, SMS, email, push notifications, enquiry handling, analytics and diagnostics, archiving, accounting and payments, as well as legal advisers and auditors, may be granted access to the relevant categories of data to the extent arising from their roles and the relevant agreements. In particular, the App uses the Google/Firebase services described below.

3. Apple and Google process data relating to App distribution, the operating system and platform services in accordance with their own documents.
4. Data may be disclosed to public authorities or courts where there is a legal basis. Data is not sold.

11. Transfers Outside the European Economic Area

Certain Google services used by the App, in particular Firebase Core / FCM, Firebase Crashlytics and Google Fonts, may process technical network or device identifiers outside the EEA, including in the United States. Transfers are carried out using mechanisms provided for under the GDPR, in particular the EU–US Data Privacy Framework for eligible recipients and Standard Contractual Clauses (SCCs). The App’s backend servers and CRM are located in Poland / within the EEA. Information about the safeguards can be obtained by contacting ido@egurrola.pl.

12. Retention Periods

13. Data Subject Rights

• access to personal data and a copy of the data
• rectification and completion of personal data
• erasure of personal data where the relevant conditions are met
• restriction of processing
• data portability in the cases provided for under the GDPR
• the right to object to processing based on a legitimate interest; in the case of direct marketing, at any time
• withdrawal of consent at any time, without affecting processing carried out before its withdrawal
• the right to lodge a complaint with the President of the Personal Data Protection Office

Requests may be submitted by email to ido@egurrola.pl, through the App where the relevant feature is available, or in writing to the address of the relevant Controller. With regard to jointly controlled processes, rights under the GDPR may be exercised against any of the Joint Controllers. The Controller or Joint Controller may verify the individual’s identity to the extent necessary to protect personal data.

14. Deletion of the Account and Data

1. The User may initiate Account deletion directly in the App or through the public webpage at https://egurrola.com/aplikacja-usuniecie-konta/. Once the process has been initiated, the request is sent to the backend, the Account in the CRM is referred for the appropriate anonymisation or deletion procedure, authorisation tokens are invalidated, the FCM token is disconnected from the Account and the App’s local session memory is cleared.
2. Deleting the Account does not constitute termination of an active Agreement for classes, cancellation of a ticket, cancellation of amounts due or an obligation to erase data that must be retained for legal, settlement, security or claims purposes.
3. Deleting the Account does not result in the immediate deletion of all data held by external technical service providers. In particular, Firebase installation identifiers are also subject to Google’s retention rules; after the local instance has been deleted and in the absence of further activity, Firebase may delete such an identifier following a period of inactivity. Data retained in accordance with the law is not used for purposes incompatible with the basis for its continued retention.

15. Profiling and Automated Decision-Making

1. The Platform may automatically adapt the view according to the type of User, the Participant’s age, School, Agreements and payment status. This does not constitute a decision that independently produces legal effects beyond those arising from the Agreement.
2. Marketing personalisation may be carried out only on an appropriate legal basis and with the option to object or withdraw consent.
3. No decisions based solely on automated processing that produce significant legal effects are made unless the requirements of Article 22 of the GDPR have been met and a separate notice has been provided.

16. Security

Organisational and technical measures appropriate to the risk are applied, including encryption in transit, access controls, login attempt limits, session management, event logging, backups, updates, testing, segregation of permissions and incident response procedures. Users should protect their devices and login codes and use the latest version of the App.

17. Voluntary Provision of Data

The provision of data required for identification, documentation, the conclusion and performance of an Agreement or the operation of an Account is voluntary in the sense that the individual decides whether to use the service; however, failure to provide data required for a specific process may make it impossible to conclude an Agreement or use a feature. Marketing consents and consents to optional technologies are voluntary and are not a condition of the basic administration of the Agreement.

18. Changes to the Policy

The Policy may be updated in connection with changes in the law, features, entities, service providers or technologies. The current version is published at https://egurrola.com/polityka-prywatnosci/ and may also be made available in the section concerning the App and directly in the App. Users are informed of material changes in the manner required by law.

19. List of EDS Entities and Their Roles in Processing

The current list of entities operating EDS Schools, together with their registration details and assigned locations, is provided in Appendix No. 1 to the Egurrola Dance Studio Terms and Conditions. In joint processes, the entities listed there may act as Joint Controllers in accordance with the rules described in Section 2 of this Policy. In processes concerning a specific Agreement, legal obligation or activity carried out independently, the relevant entity may act as an independent Controller. The applicable role is also indicated when the Agreement is concluded or in the notice concerning the specific process.