Privacy Policy

Who is responsible for your data

The controller of your personal data processed by the site is POLPROG Damian Skrzyński, ul. Kościuszki 57A, 22-600 Tomaszów Lubelski, Poland, NIP (tax ID) 9211929080, REGON 369055647. POLPROG runs vodatrio.pl, the official website of the band VODA. You can reach the controller at contact@polprog.pl. The one exception is your correspondence with the band, described in its own section below.

Contact form

When you send a message through the form, the site's server receives the data you enter (your name, email address, inquiry type, subject and message) and forwards it by email, through an external mail delivery (SMTP) service, to the band's mailbox write2voda@gmail.com. It also sends an automatic confirmation to your address that does not contain your message. POLPROG is the controller of this receiving and forwarding, on the basis of its legitimate interest in letting visitors contact the band (Art. 6(1)(f) GDPR). Giving the data is voluntary, but without your name, email address and message the form cannot send it.

The server does not store messages. To protect the form from abuse, it keeps in memory for 15 minutes how many messages were sent from an IP address, and for one hour how many confirmations were sent to an email address; after that the entries expire.

Correspondence with the band VODA

The messages delivered to the band's mailbox write2voda@gmail.com, whether from the form or written to that address directly, are controlled by the members of the band VODA as separate controllers, not by POLPROG. They process your email address, the message and any other data you include in order to reply, on the basis of their legitimate interest in answering correspondence (Art. 6(1)(f) GDPR), and when you write about a concert or other cooperation, also to take steps at your request before entering into a contract (Art. 6(1)(b) GDPR).

The band's mailbox is provided by Google (Gmail), which may process data outside the European Economic Area. Messages stay in the mailbox for as long as the correspondence requires. For anything about this correspondence, including your rights, write to write2voda@gmail.com.

Contact with POLPROG by email

When you write to contact@polprog.pl about the site, POLPROG processes your email address, the message and any other data you choose to include in order to reply, on the basis of its legitimate interest in answering correspondence (Art. 6(1)(f) GDPR). Messages stay in the mailbox for as long as the correspondence or protection against claims requires, and you can ask for them to be deleted earlier.

Technical data and page delivery

Every visit involves technical data: your IP address, the date and time, the requested address and information about your browser. It is needed to deliver the page and keep the service secure, which is our legitimate interest (Art. 6(1)(f) GDPR). The site's application does not write it to logs; the server provider may keep it for the period its configuration sets.

Cookies and browser storage

The site sets one first-party cookie, voda_lang, and only when you pick a language in the language switcher: it remembers that choice for a year, so that an address without a language prefix (vodatrio.pl and the Polish pages) opens in your language. Without such a choice the server uses the language your browser asks for (the Accept-Language header), and Polish otherwise. An address with a language prefix (for example /en) always opens in its own language.

In your browser's local storage the site keeps one entry, voda_notice: the date of this policy, once you close the short notice about browser storage, so that the notice does not come back until the policy changes. The voda_cookie_consent entry left by an earlier version of the site is removed on your next visit.

Both are necessary for features you ask for and are not used for tracking, so they need no consent (Art. 399(3) of the Polish Electronic Communications Law). The admin panel, used only by the band, also uses a session cookie, voda_admin, and remembers its language in local storage (the voda_lang entry).

YouTube and other external services

Video thumbnails in the Videos section load from YouTube servers (i.ytimg.com), so Google receives your IP address when they are displayed. We do this in our legitimate interest in presenting the band's videos (Art. 6(1)(f) GDPR). A video itself starts only after you click it, in YouTube's privacy-enhanced mode (youtube-nocookie.com); from then on YouTube may store data on your device under Google's privacy policy.

Fonts, photos and graphics come from this site. Spotify, Bandcamp, YouTube and Facebook are not embedded: they are plain links that open those services, where their own privacy rules apply.

Who receives data

The data POLPROG is responsible for is processed by the provider of the server the site runs on, the mail delivery (SMTP) provider through which the server sends messages from the form, the provider of POLPROG's mailbox, and Google when YouTube thumbnails are shown. POLPROG passes the messages from the form to the members of the band VODA, who are their separate controllers. Nobody receives your data for their own marketing, and it is never sold.

Transfers outside the EEA

Google may process data outside the European Economic Area (YouTube, and Gmail for the band's mailbox). Such a transfer relies on the safeguards of Chapter V GDPR, in particular the European Commission's decision on the EU-US Data Privacy Framework or standard contractual clauses.

Your rights

You have the right to access your data, to have it rectified or erased, to restrict its processing, to data portability and to object to processing based on legitimate interest. To use them with POLPROG, write to contact@polprog.pl; for your correspondence with the band, write to write2voda@gmail.com.

You can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

Your data is not used for automated decision-making or profiling.

Changes to this policy

When the site or the law changes, we update this policy. The date at the top shows the version in force, and after a change the site shows the short notice about browser storage again.