Privacy policy

1. Data controller

The controller of personal data processed in connection with heroesorchestra.com (the "Site") is the Heroes Orchestra Foundation (Fundacja Heroes Orchestra), Synów Pułku 7/30, 01-354 Warsaw, Poland, registered under KRS number 0000730120, NIP 5223124977, REGON 380140152 (the "Foundation"). You can reach us through the addresses listed in the Contact section.

2. What data we process

• Newsletter: the email address you voluntarily submit in the signup form.
• Correspondence: data contained in emails you send to the Foundation.
• Technical data: standard server logs (including IP address, request time and browser) processed by our infrastructure provider to keep the Site secure and reliable.

The Site does not profile users and makes no automated decisions.

3. Purposes and legal bases

• newsletter delivery: your consent (Art. 6(1)(a) GDPR), withdrawable at any time via the unsubscribe link in every message;
• replying to correspondence: the Foundation's legitimate interest (Art. 6(1)(f) GDPR);
• Site security and statistics: the Foundation's legitimate interest (Art. 6(1)(f) GDPR).

4. Recipients of data

• Intuit Mailchimp (The Rocket Science Group LLC, USA): newsletter delivery. Transfers to the USA rely on the EU–US Data Privacy Framework and standard contractual clauses.
• Cloudflare, Inc. (USA): hosting, protection and cookie-free traffic analytics. Transfers rely on the EU–US Data Privacy Framework.

We do not sell personal data and do not share it with third parties for marketing purposes.

5. Retention

Newsletter addresses are kept until you withdraw consent. Correspondence is kept for as long as needed to handle the matter. Technical logs rotate automatically at our infrastructure provider.

6. Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability, and to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). You may also lodge a complaint with the President of the Personal Data Protection Office (PUODO, ul. Stawki 2, 00-193 Warsaw) or your local supervisory authority.

7. Cookies and embedded services

The Site sets no cookies of its own. Traffic statistics are collected with Cloudflare Web Analytics, a tool that works without cookies or cross-site tracking.

Embedded videos load from YouTube (youtube-nocookie.com) only after you click play; from that moment Google's privacy terms apply. The newsletter form transmits your email directly to Mailchimp only when you submit it.

8. Changes

This policy may be updated, for example when the Site or the law changes. The current version, with its date, is always available at this address.