Privacy policy

Last updated: 4 September 2026

1. Data controller

The controller of personal data processed in connection with heroesorchestra.com (the "Site") is the Heroes Orchestra Foundation (Fundacja Heroes Orchestra), Synów Pułku 7/30, 01-354 Warsaw, Poland, registered under KRS number 0000730120, NIP 5223124977, REGON 380140152 (the "Foundation"). You can reach us through the addresses listed in the Contact section.

2. What data we process

  • Orders for CDs and vinyl: your name, e-mail address, phone number, delivery address or pickup point code (parcel locker or kiosk), the contents of the order and the order number we assign — as entered in the order form.
  • Newsletter: the email address you voluntarily submit in the signup form.
  • Correspondence: data contained in emails you send to the Foundation.
  • Technical data: standard server logs (including IP address, request time and browser) processed by our infrastructure provider to keep the Site secure and reliable.

The Site does not profile users and makes no automated decisions.

3. Purposes and legal bases

  • fulfilling orders for CDs and vinyl — accepting the order, sending the confirmation and payment details, shipping and contacting you about the order: performance of the contract (Art. 6(1)(b) GDPR);
  • documenting sales for accounting and tax purposes: a legal obligation of the Foundation (Art. 6(1)(c) GDPR);
  • newsletter delivery: your consent (Art. 6(1)(a) GDPR), withdrawable at any time via the unsubscribe link in every message;
  • replying to correspondence and handling complaints: the Foundation's legitimate interest (Art. 6(1)(f) GDPR);
  • Site security and statistics: the Foundation's legitimate interest (Art. 6(1)(f) GDPR).

Providing data in the order form is voluntary, but without it we cannot accept or fulfil your order.

4. Recipients of data

  • Cloudflare, Inc. (USA): hosting and protection of the Site and storage of submitted orders; also cookie-free traffic analytics. Transfers rely on the EU–US Data Privacy Framework.
  • Resend, Inc. (USA): delivery of transactional e-mail — your order confirmation arrives from no-reply@heroesorchestra.com. Transfers rely on standard contractual clauses; the data is processed in an EU data centre (Ireland).
  • Postal operators and couriers delivering orders (including InPost and Paczka w Ruchu): only the data needed to deliver the parcel.
  • Intuit Mailchimp (The Rocket Science Group LLC, USA): newsletter delivery. Transfers to the USA rely on the EU–US Data Privacy Framework and standard contractual clauses.
  • PostHog (PostHog, Inc.): usage statistics in a cookie-free configuration with no persistent visitor identifier; data is processed on servers in the European Union (EU region).

We do not sell personal data and do not share it with third parties for marketing purposes.

5. Retention

Order data is kept for the period required by accounting and tax regulations — 5 years from the end of the tax year in which the order was fulfilled. Newsletter addresses are kept until you withdraw consent. Correspondence is kept for as long as needed to handle the matter. Technical logs rotate automatically at our infrastructure provider.

6. Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability, and to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). You may also lodge a complaint with the President of the Personal Data Protection Office (PUODO, ul. Stawki 2, 00-193 Warsaw) or your local supervisory authority.

7. Cookies and embedded services

The Site sets no cookies of its own. Traffic statistics are collected with Cloudflare Web Analytics and PostHog (in a cookie-free configuration) — tools that work without cookies or cross-site tracking.

Embedded videos load from YouTube (youtube-nocookie.com) only after you click play; from that moment Google's privacy terms apply. The newsletter form transmits your email directly to Mailchimp only when you submit it. The order form sends your data to our infrastructure (Cloudflare) only when you press "Place order".

The ticket panel loads from stage24.pl only after you click "Show tickets". From that moment Stage24 sets its own cookies and acts as a separate controller for the data you give it while buying a ticket — its own privacy policy applies.

8. Changes

This policy may be updated, for example when the Site or the law changes. The current version, with its date, is always available at this address.

← Back to the main page