E-learning platform with courses, exercises, and lesson scheduling
Below is the current privacy policy of the e-learning platform with courses, exercises, and lesson scheduling - Code Force.
This Privacy Policy sets out the principles of processing personal data obtained through the Website https://code-force.pl (hereinafter referred to as the "Website").
The Data Controller is Mateusz Zając, conducting business under the name "CODE FORCE" MATEUSZ ZAJĄC, entered into the Central Registration and Information on Business (CEIDG) kept by the minister competent for economy, Tax ID 7622023693, Statistical ID 540458620 (hereinafter referred to as the "Controller").
Personal data collected by the Controller is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
The Controller takes special care to protect the privacy of Users visiting the Website.
The Controller collects information about natural persons conducting business or professional activity on their own behalf, and natural persons representing legal persons or organizational units not being legal persons to whom the law grants legal capacity, hereinafter collectively referred to as "Users".
Users' personal data is collected when registering an account on the Website in order to create and manage an individual account, as well as to provide access to purchased courses and educational materials.
Account registration on the Website is done via a Discord account. During registration, the email address is automatically retrieved from the User's Discord account. The User is not required to provide a first name or last name.
The Website does not store User access passwords. Authorization and authentication are handled through the Discord platform.
The Platform does not collect the User's first name or last name. The email address is automatically retrieved from the Discord account. Payment data is processed exclusively by the payment operator — Stripe.
Using the Website requires a Discord account, which is used for registration and login. Making a payment requires providing the data necessary to complete the transaction via Stripe.
Login and data entry areas are protected in the transmission layer (SSL certificate). As a result, personal data and login credentials entered on the site are encrypted on the user's computer and can only be read on the destination server.
Personal data stored in the database is encrypted so that only the key holder can read it. This protects the data in the event of a database breach on the server.
The Website does not store user passwords. Authentication is handled through the external Discord platform.
The Controller periodically changes administrative passwords.
To protect data, the Controller regularly performs backup copies.
An important element of data protection is the regular updating of all software used by the Controller to process personal data, which in particular means regular updates of software components.
Users' personal data is transferred to service providers used by the Controller in operating the Website. Service providers to whom personal data is transferred, depending on contractual arrangements and circumstances, either follow the Controller's instructions regarding the purposes and methods of processing this data (processors) or independently determine the purposes and methods of processing (controllers).
The Controller uses providers who process personal data only on the Controller's instructions. These include, among others, hosting service providers, accounting services, marketing systems, website traffic analysis systems, and marketing campaign effectiveness analysis systems.
The Controller uses providers who do not act solely on instructions and independently determine the purposes and methods of using Users' personal data. These include, among others, Stripe (electronic payment services) and banking service providers.
Users' personal data is stored – when the basis for processing personal data is the User's consent – for as long as the consent is not withdrawn, and after withdrawal of consent for a period corresponding to the statute of limitations for claims that the Controller may raise and that may be raised against them. Unless specific provisions provide otherwise, the statute of limitations is six years, and for periodic benefit claims and claims related to business activity – three years.
When the basis for processing data is the performance of a contract, the User's personal data is processed by the Controller for as long as necessary to perform the contract, and after that time for a period corresponding to the statute of limitations for claims. Unless specific provisions provide otherwise, the statute of limitations is six years, and for periodic benefit claims and claims related to business activity – three years.
Upon request, the Controller makes personal data available to authorized state authorities, in particular organizational units of the Prosecutor's Office, the Police, the President of the Personal Data Protection Office, the President of the Office of Competition and Consumer Protection, or the President of the Office of Electronic Communications.
The User has the right to withdraw any consent given to the Controller.
Withdrawal of consent takes effect from the moment of withdrawal.
Withdrawal of consent does not affect processing carried out by the Controller in accordance with the law before its withdrawal.
Withdrawal of consent does not entail any negative consequences for the User, but may prevent further use of services or functionalities that, by law, the Controller can only provide with consent.
The User has the right to object at any time – for reasons related to their particular situation – to the processing of their personal data, including profiling, if the Controller processes their data based on a legitimate interest, statistics on the use of individual Website functionalities, facilitation of Website use, and satisfaction surveys.
Resignation by email from receiving marketing communications concerning products or services will constitute the User's objection to the processing of their personal data, including profiling for these purposes.
If the User's objection is justified and the Controller has no other legal basis for processing the personal data, the User's personal data against which the User objected will be deleted.
The User has the right to request the deletion of all or some of their personal data.
The User has the right to request the deletion of personal data if the personal data is no longer necessary for the purposes for which it was collected or processed, if the User has withdrawn specific consent to the extent that personal data was processed based on their consent, if the User has objected to the use of their data for marketing purposes, if the personal data is being processed unlawfully, or if the personal data must be deleted to comply with a legal obligation under Union law or the law of a Member State.
Despite the request to delete personal data due to an objection or withdrawal of consent, the Controller may retain certain personal data to the extent that processing is necessary to establish, pursue, or defend claims, as well as to comply with a legal obligation requiring processing under Union law or the law of a Member State. This applies in particular to the email address and transaction data obtained from the payment operator — Stripe, which are retained for the purpose of handling complaints and claims related to the use of Website services.
The User has the right to request restriction of processing of their personal data. Submitting a request, until it is processed, prevents the use of certain functionalities or services whose use would involve the processing of data covered by the request. The Controller will also not send any messages, including marketing messages.
The User has the right to request restriction of the use of personal data when the User contests the accuracy of their personal data – the Controller then restricts their use for the time needed to verify the accuracy of the data, but no longer than 7 days; when the data processing is unlawful and the User requests restriction of their use instead of deletion; when the personal data is no longer necessary for the purposes for which it was collected or used, but it is needed by the User to establish, pursue, or defend claims; when the User has objected to the use of their data – the restriction then occurs for the time needed to consider whether, due to the particular situation, the protection of the User's interests, rights, and freedoms outweighs the interests pursued by the Controller in processing the User's personal data.
The User has the right to obtain confirmation from the Controller as to whether personal data is being processed, and if so, the User has the right to access their personal data, obtain information about the purposes of processing, the categories of personal data being processed, the recipients or categories of recipients of this data, the planned period of storage of the User's data or the criteria for determining this period (when determining the planned processing period is not possible), the rights available to the User under the GDPR, and the right to lodge a complaint with a supervisory authority, the source of this data, automated decision-making, including profiling, and the safeguards applied in connection with the transfer of this data outside the European Union.
The User has the right to request from the Controller immediate rectification of their personal data that is inaccurate. Taking into account the purposes of processing, the data subject has the right to request completion of incomplete personal data, including by providing an additional statement, by sending a request to the Controller's email address.
The User has the right to receive their personal data that they have provided to the Controller and then transmit it to another data controller of their choice. The User also has the right to request that the personal data be transmitted directly by the Controller to such a controller, if technically possible.
When the User exercises a right arising from the above rights, the Controller fulfills the request or refuses to fulfill it immediately, but no later than within one month of receiving it. However, if the Controller cannot fulfill the request within one month, they will fulfill it within the next two months, informing the User in advance within one month of receiving the request – about the intended extension of the deadline and its reasons.
Users may submit complaints, inquiries, and requests to the Controller regarding the processing of their personal data and the exercise of their rights.
The User has the right to request from the Controller a copy of the standard contractual clauses by sending an inquiry to the Controller's email address.
The User has the right to lodge a complaint with the President of the Personal Data Protection Office regarding violation of their rights to personal data protection or other rights granted under the GDPR.
In certain situations, the Controller has the right to transfer your personal data to other recipients if necessary to perform the contract concluded with you or to fulfill obligations incumbent on the Controller.
The Website additionally uses personal data in the provision of ordered services, including to grant access to purchased courses and educational materials.
The Website implements functions for obtaining information about users and their behavior through voluntarily entered data in forms, which are entered into the Controller's systems, and through storing cookie files on end devices.
The Website uses Google reCAPTCHA v3, a service designed to protect forms against automated abuse (bots). This service may place cookies on the User's device provided by Google LLC, including test cookies and cookies used to collect behavioral data to determine whether traffic originates from a human or automated software. Detailed information on data processing by Google can be found in Google's Privacy Policy: https://policies.google.com/privacy.
The Controller provides Users with a secure and encrypted connection when transmitting personal data and when logging into the User Account on the Website.
The Controller uses an SSL certificate issued by one of the world's leading companies in the field of security and encryption of data transmitted over the Internet.
Access password management is handled exclusively through the Discord platform. If a User has lost their password, they should use the password recovery procedure available on the Discord platform.
The Controller does not send any correspondence, including electronic correspondence, asking for login details, in particular the User's account access password.
The User may consent to the processing of personal data by the Controller for the purposes of direct marketing of the Controller's own products and services. Data for this purpose will be processed based on Article 6(1)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR).
For any matters related to the processing of personal data, please contact us: