Privacy Policy of the GBT Calendar

Effective date: 26 August 2026 · Version: 1.0

1. General information and scope

This Privacy Policy (the Policy) sets out the rules for processing the personal data of users of the Gdańsk Bay Tech events calendar (the Calendar), operated by the Gdańska Fundacja Przedsiębiorczości (Gdańsk Entrepreneurship Foundation), based in Gdańsk (GFP or the Controller).

The Policy supplements the general GFP Privacy and Cookies Policy available at https://startergdansk.pl/polityka-prywatnosci/. In case of discrepancy concerning the Calendar, the provisions of this Policy prevail.

The Calendar is a website accessed through a browser. It is an aggregator of publicly available information about events. Using the Calendar does not require creating an account or logging in — the Calendar does not maintain user accounts.

2. Data controller

3. Data Protection Officer

The Controller has appointed a Data Protection Officer (DPO), whom you can contact in any matter concerning the processing of your personal data:

1. e-mail: iod@startergdansk.pl
2. telephone: +48 58 731 65 81

4. Scope of personal data processed

4.1. Data provided by the user

Browsing the Calendar does not require providing any data. You provide data only if you yourself start one of two optional features:

The event details given in the submission form (title, date, place, website address, description) concern the event, not the person submitting it, and we publish them in the Calendar after editorial review.

4.2. Data collected automatically

While you use the Calendar we collect data about how the site is used, to the extent necessary to keep anonymous statistics and to ensure the security and correct operation of the service:

• events such as: viewing an event card, opening an event, going to an organiser, a "like" in "Roulette mode", use of filters and the search box,
• a random visit identifier stored in your browser (not linked to your identity), needed so that the same visit is not counted several times,
• the domain name from which you came to the site (e.g. "google.com") — without the full URL.

5. Purposes and legal bases of processing

5.1. Providing the Calendar

1. Purpose: displaying information about events and supporting the Calendar's features (filtering, searching, "Roulette mode").
2. Legal basis: Art. 6(1)(f) GDPR — the Controller's legitimate interest in running an information service.
3. Data: technical data necessary to display the page.

5.2. Weekly events digest (e-mail)

1. Purpose: preparing and sending a digest of events matching the topics you selected.
2. Legal basis: Art. 6(1)(a) GDPR — your consent, given by subscribing and confirmed by clicking the link in the confirmation message (double opt-in).
3. Data: e-mail address, selected topics.

You may withdraw your consent at any time; this does not affect the lawfulness of processing carried out before withdrawal. You unsubscribe with one click ("unsubscribe") in any message or by writing to the Controller's contact address.

5.3. Event submissions by users

1. Purpose: verifying the submitted event and replying to the submitter if they provided an e-mail address.
2. Legal basis: Art. 6(1)(f) GDPR — the Controller's legitimate interest in verifying content before publication.
3. Data: the submitter's e-mail address (if provided).

5.4. Statistics and development of the service

1. Purpose: keeping anonymous, aggregated statistics on the use of the Calendar in order to develop it and to select the content shown.
2. Legal basis: Art. 6(1)(f) GDPR — the Controller's legitimate interest. Data is collected without identifying elements, and you can object at any time (section 14).

5.5. Security and prevention of abuse

1. Purpose: ensuring the technical security of the Calendar, detecting and preventing abuse and unauthorised actions.
2. Legal basis: Art. 6(1)(f) GDPR — the Controller's legitimate interest in protecting IT systems and users' data.

5.6. Establishing, pursuing and defending claims

1. Purpose: establishing, pursuing or defending against possible claims.
2. Legal basis: Art. 6(1)(f) GDPR — the Controller's legitimate interest.

6. Local device storage (localStorage, "cookies")

Access to your device's storage and its use is governed by Art. 399 of the Polish Act of 12 July 2024 — Electronic Communications Law (Journal of Laws 2024, item 1221). Under Art. 399(3)(2) of that Act consent is not required where storage or access is necessary to provide a service requested by the user.

The Calendar does not set cookies and does not use third-party tracking tools. It only stores data in the browser's local storage (localStorage), on your device, not on our server — all of it is necessary for a feature that you start yourself, so it falls within the exemption above:

You can delete this data at any time by clearing site data in your browser settings or by blocking local storage — the Calendar will keep working. The only cookie in the whole service is a technical session cookie of the editorial panel (for logged-in GFP editors only), necessary for the login to work.

7. Recipients of personal data

The personal data of Calendar users may be passed to:

1. Hostinger International Ltd. — the provider of the server on which the Calendar and its database run, acting as a processor under a data processing agreement,
2. Resend — the provider of the e-mail sending service, only to the extent necessary to send the events digest (section 5.2),
3. authorised employees and associates of GFP,
4. entities providing legal, IT, accounting and organisational services to GFP — to the extent necessary to perform those services.

The Controller does not sell users' personal data and does not make it available to other controllers for marketing purposes without the user's explicit consent.

8. Transfers of data outside the European Economic Area

As a rule, personal data is stored on servers located in the European Economic Area. If, in connection with the use of the e-mail provider's services, users' personal data is processed by entities based outside the EEA (including in the USA), the Controller ensures an adequate level of data protection, in particular by using standard contractual clauses or other mechanisms provided for in the GDPR.

On the user's request the Controller provides additional information about the safeguards applied in connection with any transfer of data to third countries.

9. Data retention periods

1. Raw analytics events — deleted automatically after 90 days from being recorded.
2. E-mail address subscribed to the digest — kept until you unsubscribe or withdraw consent, whichever comes first.
3. E-mail address of the person submitting an event — kept for the period necessary to verify the submission and to reply if needed.
4. Data in the browser's local storage — until you delete it (by clearing site data in your browser).

After the relevant periods have passed, personal data is permanently deleted or anonymised.

10. Rights of data subjects

In connection with the processing of personal data you have the following rights under the GDPR:

You can direct requests concerning your rights to the Controller (sekretariat@startergdansk.pl) or directly to the DPO (iod@startergdansk.pl). The Controller endeavours to handle each request without undue delay and no later than within one month.

Note: analytical data is anonymous and does not let us assign it to a specific person — to that extent some rights may be impossible to exercise (Art. 11 GDPR), and the simplest route is to switch off collection (section 14) and clear the site data in your browser.

If you believe that the processing of your data infringes the law, you have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

11. Data security

The Controller applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or disclosure, in particular:

1. encryption of data in transit (HTTPS),
2. access control to systems and databases,
3. backups,
4. updates of software and security systems,
5. personal authorisations for people who have access to data.

12. Profiling and automated decision-making

The Calendar adapts the order in which events are shown to your interests on the basis of a profile stored only in your browser's memory ("Roulette mode", key gbt_swipe_v1). This profile is not sent to the server, is not linked to your identity and exists only on your device — you remove it by clearing site data in your browser.

This adaptation does not lead to decisions being taken about you that produce legal effects or similarly significantly affect you, as referred to in Art. 22 GDPR.

13. Voluntary nature of providing data

Browsing the Calendar does not require providing any personal data or creating an account. Providing an e-mail address is voluntary and necessary only if you want to receive the weekly events digest (section 5.2) or to receive a reply about an event you submitted (section 5.3). Not providing this data does not limit your ability to use the Calendar.

14. How to switch off data collection

Anonymous statistics respect the "Do Not Track" signal. You can switch them off in two ways:

1. turn on "Do Not Track" (DNT) in your browser settings, or
2. set in the browser console: localStorage.setItem('gbt_no_track','1')

After either step no analytics events are sent. This is also the exercise of your right to object (Art. 21 GDPR).

15. Relationship with other GFP policies

This Policy concerns only the Gdańsk Bay Tech events calendar.

• The GBT application (Radar), available at app.gdanskbaytech.pl, requires an account and has its own Privacy Policy.
• For data processed through the startergdansk.pl website, contact forms, the newsletter and cookies, the general GFP Privacy and Cookies Policy applies, available at: https://startergdansk.pl/polityka-prywatnosci/.

16. Changes to this Privacy Policy

The Controller reserves the right to change this Policy in the event of changes in the law, the technologies used or the way the Calendar works. Users will be informed of material changes on the service and/or by e-mail (for people subscribed to the events digest).