1. General Information

1. This policy applies to the website available at the URL: ensembly.eu
2. The website operator and personal data controller is:
   Tomasz Praczyk, ul. Bernardynska 19/46, 02-904 Warsaw, Poland
3. The operator's contact email address is: ensemblyeu@gmail.com
4. The Operator is the Controller of your personal data with respect to data provided voluntarily through the Website.
5. The Website uses personal data for the following purposes:
• Operating the newsletter
• Providing ordered services
6. The Website obtains information about users and their behavior in the following ways:
   1. Through data voluntarily entered in forms, which is then entered into the Operator's systems.
   2. Through saving cookie files on end devices.

2. Selected Data Protection Methods Used by the Operator

1. Login areas and areas where personal data is entered are protected at the transmission layer using an SSL certificate. As a result, personal data and login data entered on the website are encrypted on the user's computer and can be read only on the target server.
2. Personal data stored in the database is encrypted in such a way that only the Operator holding the key can read it. This protects the data in case the database is stolen from the server.
3. User passwords are stored in hashed form. The hashing function is one-way, which means it cannot be reversed. This is currently the standard for storing user passwords.
4. The Website uses two-factor authentication, which provides an additional form of login protection.
5. The Operator periodically changes its administrative passwords.
6. To minimize the risk of unauthorized access to data, the Operator uses complex passwords containing lowercase and uppercase letters, digits, and special characters, with a minimum length of 8 characters.

3. Hosting, Logs, Backups

1. The Website is hosted and technically maintained on the servers of the operator: webh.pl
2. To ensure technical reliability, server-level logs are maintained. The following information may be recorded:
   • resources identified by URL, such as requested pages and files,
   • the time the request was received,
   • the time the response was sent,
   • the client station name, identified through the HTTP protocol,
   • information about errors that occurred during HTTP transaction processing,
   • the URL of the page previously visited by the user, known as a referrer link, if the Website was accessed through a link,
   • information about the user's browser,
   • information about the IP address,
   • diagnostic information related to the self-service ordering process through website registrars,
   • information related to email correspondence addressed to or sent by the Operator.
3. To protect against data loss in the event of hosting problems, backup copies are stored on Amazon Web Services (AWS) servers located in Sweden.

4. Your Rights and Additional Information About Data Use

1. In certain situations, the Controller has the right to transfer your personal data to other recipients if this is necessary to perform an agreement concluded with you or to fulfill obligations imposed on the Controller. This applies to the following groups of recipients:
   • postal operators
2. Your personal data is processed by the Controller no longer than necessary to perform the related activities specified in separate regulations, such as accounting regulations. With respect to marketing data, the data will not be processed for longer than 3 years.
3. You have the right to request from the Controller:
   • access to your personal data,
   • rectification of your personal data,
   • erasure of your personal data,
   • restriction of processing,
   • and data portability.
4. You have the right to object to the processing referred to in point 3.2 where personal data is processed for the purposes of legitimate interests pursued by the Controller, including profiling. The right to object may not be exercised where there are compelling legitimate grounds for the processing which override your interests, rights, and freedoms, in particular the establishment, exercise, or defense of legal claims.
5. You have the right to lodge a complaint regarding the Controller's actions with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.
6. Providing personal data is voluntary, but necessary to use the Website.
7. Automated decision-making, including profiling, may be carried out in relation to you for the purpose of providing services under the concluded agreement and for the Controller's direct marketing purposes.
8. Personal data is not transferred to third countries within the meaning of personal data protection regulations. This means that we do not transfer it outside the European Union.

5. Information in Forms

1. The Website collects information voluntarily provided by the user, including personal data if such data is provided.
2. The Website may record connection parameters, such as the timestamp and IP address.
3. In some cases, the Website may save information that helps associate data entered in a form with the email address of the user completing the form. In such a case, the user's email address appears inside the URL of the page containing the form.
4. Data provided in a form is processed for the purpose resulting from the function of the specific form, for example to process a service request, handle commercial contact, register services, and similar activities. Each time, the context and description of the form clearly indicate what the form is used for.

6. Controller Logs

1. Information about user behavior on the Website may be logged. This data is used to administer the Website.

7. Cookie Information

1. The Website uses cookies.
2. Cookies are IT data, in particular text files, stored on the end device of the Website User and intended for use with the Website pages. Cookies usually contain the name of the website they come from, the time they are stored on the end device, and a unique number.
3. The entity placing cookies on the end device of the Website User and accessing them is the Website operator.
4. Cookies are used for the following purposes:
   1. maintaining the Website user's session after login, so that the user does not have to re-enter their login and password on every subpage of the Website;
   2. saving information about the user's acceptance of cookies so that the acceptance request is not displayed on every subpage of the Website after acceptance has been given.
5. The Website uses two main types of cookies: session cookies and persistent cookies. Session cookies are temporary files stored on the User's end device until logout, leaving the website, or closing the web browser. Persistent cookies are stored on the User's end device for the time specified in the cookie parameters or until deleted by the User.
6. Web browsing software usually allows cookies to be stored on the User's end device by default. Website Users may change their settings in this regard. The web browser allows cookies to be deleted. It is also possible to block cookies automatically. Detailed information on this topic is available in the browser's help or documentation.
7. Restrictions on the use of cookies may affect some functionality available on the Website pages.

8. Managing Cookies: How to Give and Withdraw Consent in Practice

1. If the user does not want to receive cookies, they may change their browser settings. We note that disabling cookies necessary for authentication, security, and maintaining user preferences may make it difficult, and in extreme cases impossible, to use websites.
2. To manage cookie settings, select the browser you use from the list below and follow the instructions:
   • Edge
   • Internet Explorer
   • Chrome
   • Safari
   • Firefox
   • Opera

   Mobile devices:

   • Android
   • Safari (iOS)
   • Windows Phone

9. Leaving an Ensemble and Deleting an Account

1. The user may leave an ensemble and delete their Ensembly account.
2. Data related to the user's activity in ensembles, such as attendance declarations, is stored in separate tables. When the user leaves an ensemble, the connection between their account and activity data is removed. This data remains visible in the context of the ensemble as assigned to a "deleted user" and cannot be associated with a specific person, so it does not constitute personal data. However, the user's account retains an identifier for this data, which makes it possible to reconnect it if the user returns to the ensemble, provided that the account has not been deleted. If the user permanently deletes their account, all data that would allow earlier activity in ensembles to be identified is irreversibly deleted. This means that after creating a new account, it will not be possible to recover historical data or associate it with the new user account.

10. Application Development and Possible Errors

1. The Ensembly application is continuously developed, and its functionality is regularly improved. Despite our best efforts to ensure it works correctly, users may occasionally encounter errors or other unexpected problems. Please report any irregularities so that we can fix them as soon as possible.
2. The Ensembly application is available 24/7, but server resources are still being tested and optimized. If load exceeds server capacity, the application may become temporarily unavailable or slower. In such situations, we will take all possible steps to restore full application functionality as soon as possible.

11. Disclaimer Regarding Project Termination and Data Transfer

1. We reserve the right to close the project if unforeseen circumstances make it impossible to continue providing services through the application.
2. If the project is terminated, data collected by the application during the ensemble's use will be provided to the ensemble administrator in a format that allows further processing, such as an Excel file or another appropriate format.