Privacy Policy and Cookies
This Policy sets out the rules for processing personal data of users of www.baltic-digital.org and the use of cookies. We apply it in line with GDPR (Regulation 2016/679) and the Polish Act on the Provision of Electronic Services.
Data controller
Foundation Baltic Digital Institute, ul. Hołdu Pruskiego 6, 80-321 Gdańsk, Poland, KRS 0000890019, NIP 5213924185, REGON 388560706.
Data Protection Officer
Contact: iodo@baltic-digital.org or dpo@baltic-digital.org.
Scope and purposes of processing
- Contact forms and course sign-ups — handling enquiries, follow-up, registration.
- Newsletter — information about activities and events (based on consent).
- Site statistics and traffic analytics (Google Analytics 4 via Google Tag Manager) — only after consent in the cookies banner (Consent Mode v2).
- Donations — handling written payment confirmations for BDI statutory activity.
- Mandatory registers (accounting, reporting) — required by law.
Legal bases
Art. 6(1)(a), (b), (c) or (f) GDPR — respectively: consent (newsletter, analytical/marketing cookies), contract performance (course sign-up), legal obligation (accounting), legitimate interest (site security, anonymous statistics).
Your rights
You have the right to: access, rectification, erasure (right to be forgotten), restriction of processing, data portability, objection, withdrawal of consent at any time (without affecting lawfulness of processing before withdrawal) and a complaint to the President of the Polish Personal Data Protection Office (uodo.gov.pl).
Cookies, Google Analytics and hosting
The site uses cookies: technical (essential), analytical (Google Analytics 4 via Google Tag Manager) and functional. Analytical and marketing cookies are loaded only after consent in the banner (Consent Mode v2). You can withdraw consent at any time via the banner settings or browser settings. The site is hosted on Vercel (USA) — data transfers to the USA are based on Standard Contractual Clauses (SCC) approved by the European Commission.
Recipients and data processors
Your data may be shared with the following processors: Vercel Inc. (hosting), Google LLC (Analytics 4, Tag Manager, Fonts), Cloudflare Inc. (CDN, DNS), Zoho Corporation (CRM for lead handling). All processors ensure an adequate level of protection in line with GDPR.
Retention periods
Contact enquiries: up to 2 years from last contact. Course participant data: up to 5 years (project reporting obligations). Accounting documents (donation confirmations): 5 years from the end of the year of issue. Analytical cookies: max 26 months. Marketing consents: until withdrawal.
Use of image
Photos/video may be taken at events for informational and promotional purposes. We ask for separate consent where required. You can at any time request removal of your image from the BDI site.
Last updated: 22 May 2026. This version is an operational summary — full internal documents (Personal Data Policy, Records of Processing Activities, Information Notices) are available on request.