Privacy Policy
Privacy Policy of wrzos.run
Effective date: 3 August 2026
This Privacy Policy describes how personal data are processed in connection with the use of the website https://wrzos.run (the “Service”), including registration for the Wrzos.RUN running event (formerly Cross na Wrzosach).
When registering for the event, the privacy / GDPR notice (PDF, Polish) also applies. This Policy covers the entire Service and supplements the information provided at registration.
In case of discrepancies between language versions, the Polish text prevails.
1. Data controller
The controller of personal data is:
Nadleśnictwo Okonek (Okonek Forest District)
ul. Kolejowa 16
64-965 Okonek, Poland
tel. +48 67 266 91 01
e-mail: okonek@pila.lasy.gov.pl
For matters related to the event and the Service you may also contact:
- Marcelina Hanelt, tel. +48 532 453 738, e-mail: marcelina.hanelt@pila.lasy.gov.pl
- Service e-mail: kontakt@wrzos.run
The controller has not appointed a Data Protection Officer (DPO). For GDPR-related matters, please contact the controller directly using the details above.
2. Scope
This Policy applies to data processed in connection with, among other things:
- visiting and using the Service,
- registering for and taking part in Wrzos.RUN,
- paying the entry fee online,
- issuing an invoice where requested,
- communicating with the Organiser,
- optional image (likeness) consent,
- website analytics (Google Analytics 4) — only after cookie consent.
3. Purposes and legal bases
| Purpose | Examples of data | Legal basis (GDPR) |
|---|---|---|
| Operating the Service, technical security | IP address, server logs, device data | Art. 6(1)(f) (legitimate interest — security and continuity) |
| Event registration, start list, organisation | registration form data | Art. 6(1)(b) (contract / pre-contractual steps) and (f) (organisation and safety) |
| Collecting and settling the entry fee | payment data, transaction ID | Art. 6(1)(b) and (c) (accounting/tax duties where required) |
| Issuing an invoice (if requested) | buyer name, tax ID (NIP), address, invoice e-mail | Art. 6(1)(c) and (b) |
| Contact about the registration / event | e-mail, phone, name | Art. 6(1)(b) and (f) |
| Publishing the start list (name, distance, city, club, bib number) | participant identification data | Art. 6(1)(f) and (b) |
| Vegetarian meal preference | form flag | Art. 6(1)(b) (starter pack / catering organisation) |
| Image consent (optional) | consent statement | Art. 6(1)(a) (consent) |
| Traffic statistics — Google Analytics 4 | cookie IDs, approximate location, usage data | Art. 6(1)(a) (consent via cookie banner) |
Providing registration data is voluntary but necessary to register and pay — without these data registration is not possible.
4. Data collected at registration
Depending on the form, we may process in particular:
- first and last name,
- date of birth, gender,
- e-mail address, phone number,
- city, club (optional),
- chosen distance / category, shirt size,
- vegetarian meal request,
- invoice details (name, NIP, address, invoice e-mail) if an invoice is requested,
- declarations and consents (rules, privacy notice, health, guardian of a minor, optional image),
- communication locale,
- payment status and the payment operator’s transaction identifier.
Data of minor participants are provided by their legal guardian (parent/guardian).
5. Recipients
Data may be entrusted or disclosed (to the extent necessary) to:
- OVH — hosting of the Service and e-mail (SMTP),
- Axepta BNP Paribas — online payments (BLIK, online bank transfer),
- Google Ireland Ltd / Google LLC — Google Analytics 4, only if the user consents to analytics cookies,
- parties supporting the organisation of the event as needed (e.g. timing, start list operations) — in line with the event rules,
- public authorities — where required by law.
6. Transfers outside the EEA
When Google Analytics 4 is used, data may be transferred outside the European Economic Area (in particular to the USA). Such transfers rely on mechanisms provided for under EU law (e.g. adequacy decision / standard contractual clauses), where applicable to the Google service concerned.
Without analytics cookie consent, the GA4 script is not loaded.
7. Cookies and similar technologies
7.1. Essential cookies
The Service may use cookies or similar technologies required for the site to work (e.g. session, security, remembering the cookie consent choice). The legal basis is the controller’s legitimate interest or necessity to provide the service.
7.2. Analytics cookies (Google Analytics 4)
After consent in the banner, the Service loads Google Analytics 4 to analyse traffic and improve the Service. If consent is refused, GA4 is not started.
Consent may be withdrawn by clearing browser data / the local consent choice for wrzos.run, or by contacting the controller. Withdrawal does not affect the lawfulness of processing before withdrawal.
8. Retention
- Event registration data — for the organisation of the relevant edition and for as long as needed to establish, exercise or defend legal claims; invoice/accounting data — for periods required by tax and accounting law.
- Correspondence — for as long as needed to handle the matter, then for limitation periods.
- Technical logs — usually for a short period related to security and diagnostics.
- Google Analytics data — according to GA4 retention settings configured by the controller / Google; cookies — until expiry, deletion by the user, or withdrawal of consent.
9. Your rights
Under the GDPR you have the right to:
- access your data,
- rectification,
- erasure (“right to be forgotten”) — where applicable,
- restriction of processing,
- data portability — where applicable,
- object to processing based on legitimate interest,
- withdraw consent (where processing is based on consent) at any time,
- lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland (https://uodo.gov.pl).
Requests concerning these rights may be sent using the contact details in section 1.
10. Automated decision-making and profiling
The controller does not make automated decisions that produce legal effects concerning you or similarly significantly affect you. Google Analytics is used for aggregate traffic analysis, not for individual decisions on admission to the event.
11. Security
The controller applies technical and organisational measures appropriate to the risk, including HTTPS, restricted access to the CMS, and processing of payment credentials by a specialised payment operator (card / BLIK data are handled in the payment operator’s infrastructure under its rules).
12. External links
The Service may contain links to third-party sites (e.g. payment gateway, social media). Those sites are governed by their own privacy policies.
13. Changes to this Policy
The controller may update this Policy. The current version is always available at https://wrzos.run/en/polityka-prywatnosci. Material changes may be announced in the Service.