Privacy policy
What we collect, why, on what basis, and what you can do about it.
Last updated:
Who the controller is
The data controller is GANGSTA LASERS spółka z ograniczoną odpowiedzialnością (a Polish limited liability company), registered office at ul. Kornela Ujejskiego 10, 51-141 Wrocław, Poland, entered in the Polish National Court Register (KRS) under number 0000956758, tax number (NIP) 8952238865, statistical number (REGON) 521387180, share capital PLN 5,000.00, registered on 25 February 2022.
For anything about your data: contact@gangstalasers.com, +48 519 184 772. We answer every request, including a request for erasure.
The same company is the seller of the programme and the issuer of invoices. These details come from the National Court Register and the Polish VAT register.
What we collect
For the checklist, a webinar or the notes: your first name and email address. For a webinar you may also give a phone number — it is optional.
When you buy: your full name, email address, country and invoice details (address, and for a business purchase the company name and VAT number). We never see or store your card details — the payment provider handles them.
When you write through the contact form: your first name, email address, optionally a phone number, and your message.
With every consent we store its wording, the privacy policy version, a timestamp and the page it was given on. Without that we could not show what you actually agreed to.
Why, and on what basis
Sending the material you asked for — the checklist, the webinar link — on the basis of your consent. That delivery happens whether or not you accept marketing.
News about the programme and future cohorts, on the basis of a separate, optional marketing consent. You can decline it and still receive the material. One click unsubscribes from any message.
Processing your purchase and giving you access to the programme — to perform the contract (Art. 6(1)(b) GDPR).
Issuing invoices and keeping accounting records — to meet a legal obligation (Art. 6(1)(c) GDPR).
Answering a message sent through the contact form — on the basis of our legitimate interest (Art. 6(1)(f) GDPR).
Measuring how our ads perform on Meta's services (Facebook, Instagram) — based on the consent you give in the cookie banner (Art. 6(1)(a) GDPR). Details in the cookie policy.
Who processes it for us
Your data is processed on our behalf by the service providers we use for hosting, database, email delivery, payments and invoicing — only as far as needed to provide those services.
How long we keep data
Sign-up data is kept until you withdraw consent or unsubscribe. The record of the consent itself is kept until the limitation period for claims expires, so that we can show it was given.
Order and invoice data is kept for as long as tax and accounting law requires — 5 years from the end of the calendar year in which the tax payment was due.
Messages from the contact form are kept for as long as needed to answer them and continue the correspondence.
Your rights
You have the right to access your data, correct it, erase it, restrict processing, object, and port it. You may withdraw consent at any time; withdrawal does not affect processing that was lawful before it.
You may also lodge a complaint with a supervisory authority; in Poland that is the President of the Personal Data Protection Office (UODO).