Privacy policy

1. Data controller

The controller of your personal data is Fundacja Rozwoju Przedsiębiorczości „Twój StartUp”, registered office: ul. Żurawia 6/12, lok. 766, 00-503 Warszawa, Polska, KRS 0000442857, NIP 5213641211, REGON 146433467 (the “Foundation”, “we”), at which reKoncepcja operates. The Foundation owns and operates this website. For anything concerning personal data, you can contact us at:

• Email: info@rekoncepcja.pl
• Postal address: Fundacja Rozwoju Przedsiębiorczości „Twój StartUp”, ul. Żurawia 6/12, lok. 766, 00-503 Warszawa, Polska
• Phone (foundation office): +48 503 942 413
• Foundation contact page: twojstartup.pl/kontakt/

2. What data we process

We process only the data needed to handle your application, conclude and perform the agreement, and run the website:

• Course application: your name, the chosen course, your experience level, a description of your product idea, and the email address (and sender name) you send the application from.
• Correspondence and the initial call: the content of messages, the call date, and information you share with us during the call and the entry diagnostic.
• Agreement and payments: full name, address, email address, phone number (if you provide it), Client details and details for the accounting document (such as company name and tax ID), payment and Payment schedule information and, if you apply for the discount, your Twój StartUp beneficiary status.
• Course delivery: attendance, session dates, assignment submissions, feedback, assessments, access to your project repository and the details on your certificate.
• Complaints and withdrawal: the content of your request and our reply.
• Technical data: IP address, date and time of the visit, the page visited and browser information — processed automatically by the hosting server when the website is displayed.

3. How the application form works

The application form at /apply/ asks for your full name, email address, phone number (optional), chosen course and start date, teaching language, experience level, who pays for the course, and a description of your idea or goal. When you click “Send application”, the data is sent through the Web3Forms service, which forwards it by email to the reKoncepcja team inbox. We reply to the email address you give.

• Do not include sensitive data (such as health information), passwords, confidential business information or other people’s data in your application.
• Sending an application does not conclude an agreement or reserve a place.

4. Purposes and legal bases

We process data under Regulation (EU) 2016/679 (GDPR) for the following purposes:

• Handling your application, the initial call, the diagnostic and preparing an offer — steps taken at your request before concluding an agreement (Article 6(1)(b) GDPR).
• Concluding and performing the agreement, including sessions, reviews, assessment, issuing the certificate, settling payments, and verifying eligibility for the discount (Article 6(1)(b) GDPR).
• Complying with legal obligations, in particular tax and accounting obligations, and handling withdrawals and complaints (Article 6(1)(c) GDPR).
• Answering enquiries not related to concluding an agreement, establishing, pursuing and defending claims, and keeping the website secure — our legitimate interest (Article 6(1)(f) GDPR).
• Showcasing your project, name, image or testimonial — only with your separate consent (Article 6(1)(a) GDPR), which you can withdraw at any time without affecting the lawfulness of earlier processing.
• We do not send newsletters or marketing messages without your consent.

5. Do you have to provide data?

Providing data is voluntary but necessary to consider your application and to conclude and perform the agreement. Without it we cannot prepare an offer or run the course. Providing details for an accounting document is required by tax law where we issue such a document.

6. Recipients

Your data is available only to authorised members of the reKoncepcja team, to the extent needed for their work (admissions, instructors, mentors, reviewers). Data may also be received by:

• providers of email and website hosting, and the Web3Forms service that forwards form applications,
• providers of tools used in the course (video calls, chat, code repositories) — we name them at the start of the course,
• the bank handling payments, the accounting office and legal advisers — to the extent necessary for settlements and protecting rights,
• public authorities — only where the law requires it.
• Entities processing data on our behalf do so under a data processing agreement and on our instructions. We do not sell personal data.

7. Transfers outside the European Economic Area

Some service providers (such as email or hosting) may process data outside the European Economic Area. In that case data is transferred on the basis of the mechanisms provided in Chapter V GDPR — a European Commission adequacy decision or standard contractual clauses. On request, we will tell you which safeguards apply and how to obtain a copy.

8. How long we keep data

We keep data no longer than necessary:

• Applications and correspondence that did not lead to an agreement — up to 6 months after the last contact. After that we delete them from the mailbox.
• Participant data — for the term of the agreement and then until the limitation periods for related claims expire.
• Accounting documents — for the period required by tax and accounting law (as a rule 5 years from the end of the calendar year in which the tax payment deadline expired).
• Complaints and withdrawal statements — until the limitation periods for claims expire.
• Data processed on the basis of consent — until consent is withdrawn.
• Technical data in server logs — for a short period set by the hosting provider, as needed to keep the website secure.

9. Your rights

Under the conditions set out in the GDPR, you have the right to:

• access your data and receive a copy (Article 15 GDPR),
• rectification (Article 16 GDPR),
• erasure (Article 17 GDPR),
• restriction of processing (Article 18 GDPR),
• data portability for data processed under an agreement or consent (Article 20 GDPR),
• object to processing based on legitimate interest (Article 21 GDPR),
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• To exercise your rights, write to info@rekoncepcja.pl or by post to the Foundation’s address. We reply without undue delay and within one month at the latest; in particular cases this may be extended by two further months, and we will tell you if so. We may ask for information needed to confirm your identity.

10. Complaint to the supervisory authority

If you believe we process your data unlawfully, you can lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or with the supervisory authority in your EU country of residence or work. We encourage you to contact us first — we will try to resolve the matter quickly.

11. Automated decisions and profiling

We do not make decisions based solely on automated processing, including profiling. Admission to a course and assessment of progress are decided by people — instructors and reviewers.

12. Cookies, analytics and external resources

The website does not use analytics tools (such as Google Analytics), advertising pixels or other tracking tools, and it does not itself store cookies or data in browser storage on your device. That is why we do not show a cookie consent banner.

• Fonts and images are served with the website — browsing it does not require connecting to Google Fonts or other external servers.
• The video on the course page loads only after you click the play button. Your browser then connects to YouTube (Google) in privacy-enhanced mode (youtube-nocookie.com), and YouTube may process your data (such as your IP address) and store information on your device under its own privacy policy. Until you click, the website does not connect to YouTube.
• Links to the Foundation’s website and social media (Facebook, Instagram, LinkedIn, YouTube) are plain links — we do not embed those services’ plugins. Once you visit their pages, their privacy rules apply.
• If we introduce analytics or cookies that require consent in the future, we will update this policy and, where required, ask for your consent before using them.

13. Data security

We apply technical and organisational measures appropriate to the risk: only authorised people can access the data, the website runs over encrypted HTTPS. We delete applications from the mailbox in line with the periods in section 8.

14. Changes to this policy

We update this policy when the law, the tools we use or the way we process data change. The current version is always available on this page; we notify participants of material changes by email. Version of 15 October 2026.