The protection of personal data is one of the key aspects of the ZygZak go-kart track's operations.
We assure you that we exercise due diligence to protect the interests of the individuals whose personal data we process. In particular, we ensure that we process data in accordance with the GDPR and the UODO, for specific, lawful purposes about which we inform you. Personal data is factually accurate and relevant to the purposes for which it is processed and stored, and is retained no longer than is necessary to achieve the purpose of processing and to comply with legal requirements.
This Privacy Policy applies to situations in which Apena-Remont sp. z o.o. independently determines the purposes and means of processing personal data in connection with the operation of the ZygZak Karting Track, the sale or reservation of services and goods, the operation of the Website, and related communications.
If a separate privacy notice is provided in a specific process, its provisions supplement this Policy, and in the event of any conflict, they take precedence with respect to that process .
The controller of your personal data is Apena-Remont Sp. z o.o., with its registered office in Bielsko-Biała at ul. Partyzantów 61a, 43-300 Bielsko-Biała, registered with the 8th Commercial Division of the District Court in Bielsko-Biała under KRS number 0000140697, with Tax Identification Number (NIP) 937-21-76-881 and Statistical Identification Number (REGON) 072161448, owner of the ZygZak Karting Track, hereinafter referred to as the „Controller.”.
For all matters related to the processing of personal data, including exercising your rights, you may contact the Data Controller via email at rodo@apena-remont.com.pl (preferred method of contact) or in writing to the specified address of the company’s headquarters. The email address provided may also be used to submit requests regarding the exercise of rights under the GDPR.
Data is collected directly from the data subject, from the data subject’s legal representative, or from the person making a reservation or purchase on behalf of other participants. In the latter case, the person providing the data must be authorized to do so, and the Controller shall provide the data subject with the required information no later than at the time of the first contact, unless an exception provided for in Article 14 of the GDPR applies. Technical data is collected from the device, browser, cookies, and server logs; payment data is obtained from the Przelewy24 provider; and data regarding the progress of service delivery and results is collected during the session at the go-kart track.
Depending on the selected service, the Administrator may process: identification data, first and last name, age or year of birth of the participant, contact information, user account data, reservation, order, payment, and accounting document data, the content of correspondence, complaints, and other reports, data regarding consents granted, images (if separate consent has been provided), as well as online identifiers and technical device data, including IP address, information about the browser, operating system, activity on the Website, and files cookies . Not every category listed is processed in every case. A detailed breakdown of how data is categorized for processing purposes is provided in the table below.
Providing the data marked as required is necessary to enter into or perform a contract, make a reservation, complete a sale, issue an accounting document, or process a complaint. Failure to provide this data may prevent the specified action from being carried out. Providing data in optional fields and granting consent for marketing, analytics, or the use of your image is voluntary and does not condition your use of the basic service, unless a given function, by its very nature, requires the use of specific data . If an order or reservation is made on behalf of another person, you must provide only the information necessary to perform the service and ensure that it is accurate.
We process data in various situations described in our privacy policy. Below, we provide information on the purposes of processing and the legal bases. The specific purpose and legal basis for processing are provided in a separate information notice addressed to data subjects at the time their data is collected.
| Process and Purpose | What personal data may be processed | Legal Basis | Retention period |
| Use of the Website Ensuring the proper functioning of the website, sessions, shopping cart, and reservations; diagnostics; fraud prevention and security. | IP address; date and time of the connection; URL of the requested page; session ID or necessary cookie; browser, device, and operating system type; resolution; referring URL; response codes, errors, and security events. | Article 6(1)(b) of the GDPR—the provision of a service by electronic means; Article 6(1)(f) of the GDPR—the Controller’s legitimate interest in ensuring the efficiency and security of the Website. For essential cookies, see also Article 399(3) of the Electronic Communications Act. | Session data — until the end of the session. Essential cookies — for the period specified in the privacy settings panel. Logs — generally no longer than 12 months, unless longer retention is necessary to investigate an incident, defend against claims, or pursue legal remedies. |
| Inquiries and Contact Information Providing responses, handling inquiries via forms, email, phone, or social media, and taking action prior to entering into a contract. | First and last name or username, if provided; email address; phone number; social media profile ID; message content and attachments; date of contact; and details regarding the matter. | Article 6(1)(b) of the GDPR—actions taken at the request of an individual prior to entering into a contract; Article 6(1)(f) of the GDPR—legitimate interest consisting of handling correspondence and providing responses. | Until the matter is resolved, and thereafter, generally, for 12 months. If the correspondence leads to the conclusion of a contract, a complaint, or a dispute—for the period appropriate to that process and until the statute of limitations for claims expires. |
| User account — if this feature becomes available Creating, maintaining, and managing an account, as well as saving its settings and history. | First and last name or username; email address; phone number, if required; account ID; password hash; settings, consents, and history of activity, reservations, and orders associated with the account. | Article 6(1)(b) of the GDPR—performance of the account agreement; Article 6(1)(f) of the GDPR—account security, prevention of fraud, and defense against claims. | Until the account is deleted or the service is terminated, and thereafter to the extent necessary for accounting purposes, to demonstrate the correctness of actions, and until the statute of limitations on claims expires. |
| Reservations, Orders, and Service Provision Conclusion and performance of the contract; sale and electronic delivery of a Ticket, Voucher, or Pass; booking of a trip or event; organizational contact; verification of eligibility for redemption. | First and last name; email address; phone number; order number, date, and details; type of product or service; reservation date; number of participants; QR code or other transaction code; product usage history; participant data necessary for the selected service, such as first name or nickname, age or year of birth, and height; legal representative’s information, when required. | Article 6(1)(b) of the GDPR — the conclusion and performance of a contract. With regard to participant data provided by the purchaser or the organizer: Article 6(1)(b) of the GDPR, when the participant is a party to the contract, or Article 6(1)(f) of the GDPR—organization of the service, verification of eligibility, and security of its performance. | For the duration of the contract, the product’s shelf life, and after-sales service, and thereafter until the expiration of the applicable statute of limitations for claims. Data recorded in accounting records—for the period required by law. |
| Payments and Returns Receiving payment confirmation, processing the order, identifying the transaction, preventing fraud, and issuing a refund. | Transaction number and ID; amount and currency; date; status and selected payment method; payer ID provided by the operator; bank account number or other information necessary for the refund. As a general rule, the administrator does not receive bank login credentials or full payment card details. | Article 6(1)(b) of the GDPR — performance of a contract and billing; Article 6(1)(c) of the GDPR — legal obligations; Article 6(1)(f) of the GDPR — prevention of fraud and verification of the accuracy of billing. | Until the settlement or refund is finalized, and thereafter for the period required by financial and tax regulations, and until the statute of limitations on claims expires. |
| Sales Documents and Tax Returns Issuing and providing receipts or invoices, maintaining accounting records, and fulfilling tax obligations. | First and last name or company name; address; tax ID number (NIP)—if it is to appear on the invoice; order, payment, and sales document details; email address for document delivery; information about corrections. | Article 6(1)(c) of the GDPR — compliance with obligations under tax and accounting laws; additionally, Article 6(1)(b) of the GDPR — performance of a contract. | For the period required by tax and accounting regulations—generally 5 years, counting from the end of the calendar year relevant to the obligation in question, unless a specific provision requires a longer period. |
| Complaints, Cancellations, and Claims Processing a complaint, fulfilling consumer obligations, and establishing, pursuing, or defending claims. | Identification and contact information; order number, ticket number, voucher number, pass number, or reservation number; description and date of the incident; request; correspondence; evidence and attachments; payment and refund account information; information needed to resolve the matter. | Article 6(1)(b) of the GDPR—performance of a contract; Article 6(1)(c) of the GDPR—consumer obligations; Article 6(1)(f) of the GDPR — legitimate interest in establishing, pursuing, and defending claims. | Until the completion of the complaint process or the completion of the withdrawal, and thereafter until the expiration of the applicable statute of limitations for claims; in the event of a dispute—until its final resolution and the enforcement of the decision. |
| Race Results, Rankings, and Events Organizing races and competitions, determining results, and presenting them without unnecessarily revealing participants' identities. | Nickname chosen by the participant; go-kart or run number; lap time and result; category or event; date. First and last name only if necessary for organizing the event or if the participant has separately consented to their public disclosure. | Article 6(1)(b) of the GDPR — the performance of a service or compliance with the rules of an event; Article 6(1)(f) of the GDPR — the organization of competitions and the maintenance of results lists; Article 6(1)(a) of the GDPR — public disclosure of a person’s first and last name, if based on consent. | Service-related results — for the time required to settle the service and handle claims. Public rankings — for as long as they remain current or until a valid objection is raised; data published based on consent — until such consent is withdrawn. |
| Digital Marketing Newsletters, information about promotions, competitions, and events sent via email or text message; managing consents and opt-outs. | First name, if provided; email address; phone number; content, scope, date, source, and status of consent; opt-out information; basic data regarding the delivery or opening of messages—if such measurements are tracked and included in the information. | Article 6(1)(a) of the GDPR—consent, and Article 398 of the Electronic Communications Act. Data used to demonstrate the granting or withdrawal of consent: Article 6(1)(f) of the GDPR — accountability and defense against claims. | To withdraw consent or unsubscribe from a given channel. Information regarding consent, withdrawal, or objection may then be retained for the period necessary to demonstrate compliance and until the statute of limitations for claims expires. |
| Photos and coverage of the events The creation and publication of photos or videos featuring a participant on the Website or on social media—only to the extent covered by separate consent, if such consent is required. | Image and voice; first name, last name, or pseudonym, if included in the consent; name, location, and date of the event; the content of the consent given. | Article 6(1)(a) of the GDPR — consent. Regardless of the GDPR, the publication of an image must comply with the provisions on the protection of images and the exceptions provided for by law. | Until consent is withdrawn or until the end of the period specified in the consent. Withdrawal does not affect the lawfulness of prior processing; materials already shared by recipients or recorded by the platform operator may remain outside the Controller’s direct control. |
| Analytics and Optional Cookies Measuring how the Website is used, compiling statistics, and improving its features; tailoring content or marketing—only if such features are used and the user has previously given consent. | Cookie and device identifiers; IP address, to the extent provided to the tool; approximate location derived from the IP address; device type, operating system, and browser; pages visited; referral source; clicks, events, and time spent on the site; campaign ID. The scope depends on the categories you have accepted. | Article 6(1)(a) of the GDPR—consent—and Article 399 of the Electronic Communications Act. Consent does not apply to cookies that are necessary for the service requested by the user. | Until consent is withdrawn, files are deleted, or the expiration period specified for a given tool in the privacy settings panel expires—whichever occurs first—taking into account data that has already been aggregated or anonymized. |
Consents for marketing, analytics, optional cookies, and the use of your image are voluntary and separate from consent to the Terms of Service. You may withdraw them by using the opt-out link in the message, contacting the Administrator, or through the privacy settings panel. Withdrawing consent to the publication of your image applies to the future use of the material; it does not automatically result in the removal of copies previously shared by other users or stored by the operator of an external platform in accordance with its own terms.
• Access to the data is granted only to persons authorized by the Administrator and only to the extent necessary to perform their assigned duties.
• Data may be disclosed to providers of hosting, IT maintenance and security, email, reservation and sales systems, code generation and distribution, customer service tools, accounting, archiving, legal support, and debt collection services. Entities acting on behalf of the Controller process data pursuant to a contract and in accordance with the Controller’s instructions.
• Data may be disclosed to public authorities, courts, or other authorized entities if the obligation or right to disclose such data is provided for by law. The data controller does not sell personal data.
As a general rule, the Controller selects data processors located within the European Economic Area. However, the use of global analytics, cloud, or social media services may result in data being accessed from a third country. In such cases, the transfer is based on a European Commission decision recognizing an adequate level of protection, including, where applicable, the EU-U.S. Privacy Shield, or it is carried out using appropriate safeguards, in particular standard contractual clauses. Information about the mechanism used and the possibility of obtaining a copy of the safeguards can be found at rodo@apena-remont.com.pl.
Within the limits set forth by the GDPR, you have the following rights:
1. Right of access to data — You have the right to obtain confirmation as to whether we are processing your data, to access your data and obtain a copy of it, as well as to receive information about the processing.
2. The Right to Rectification, Erasure, and Restriction of Processing — You may request that incorrect data be corrected, incomplete data be supplemented, data be erased in the cases provided for in Article 17 of the GDPR, or that the use of your data be temporarily restricted in the cases provided for in Article 18 of the GDPR.
3. Right to withdraw consent — if the processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of the processing that took place prior to the withdrawal.
4. Right to data portability — this applies to data you have provided that is processed automatically based on consent or a contract. You may receive this data in a structured, commonly used, machine-readable format or, if technically feasible, request that it be transmitted to another controller.
5. Right to object — You may object to direct marketing at any time. You may object to other processing activities based on Article 6(1)(f) of the GDPR on grounds relating to your particular situation.
6. You have the right to file a complaint with the President of the Personal Data Protection Office if you believe that the processing violates the GDPR. The Office’s current contact information: 1A Stanisława Moniuszki St., 00-014 Warsaw, uodo.gov.pl.
Personal data is processed using the technical and organizational measures required by law to ensure a level of protection appropriate to the risks and the categories of data being protected, and is safeguarded against processing that violates applicable laws.
You can withdraw or change your consent at any time in the „Privacy Settings” panel. The change applies going forward and does not affect the lawfulness of prior processing. Re-enabling optional categories requires another informed choice by the user.
Users can also delete and block cookies in their browser settings. However, browser settings may not delete the consent stored on the Website’s end; therefore, to fully change your preferences, you should also use the privacy settings panel.
Links to external websites or social media platforms do not, in and of themselves, result in the transfer of data beyond what is technically necessary to display the link. Once you visit an external website, the privacy policy of that website’s operator applies.
Log data may be disclosed to authorized public authorities only in the cases and to the extent provided for by applicable law. For statistical purposes, the Controller uses aggregated or anonymized data whenever possible.
