events.

Privacy Policy

Website: https://events.zuzka.pl Last updated: 25 October 2026

1. Controller and contact

The operator of this website and controller for the processing described below is Zuzanna Wala, acting in her own name as an individual.

Contact address: Irlandzka 1, 54-402 Wrocław, Poland Email: events@zuzka.pl

The organizer, ticket seller and experience provider for a particular event may be different parties. Their identities and respective privacy information must be checked in the event details and booking flow.

2. Information covered by this notice

  • Website delivery and security: network and request information, including IP addresses, timestamps, requested URLs, browser information and errors, to the extent recorded by the hosting infrastructure.
  • Event booking alerts: if you request an alert, we store your email address, the selected event, request/confirmation timestamps and the version of the consent wording in private website storage. We send a confirmation email, then one email when booking opens for that event after you confirm. This is separate from registration and newsletters.
  • Contact form and email correspondence: your name, email address, message and information you choose to send. The contact form emails the message to events@zuzka.pl; it does not create a separate message archive in the website CMS. You can also contact us directly by email.
  • Event administration through Luma: information made available to us as an event host or other responsible party, including first names, surnames, email addresses and telephone numbers collected in registration, together with chosen events/sessions, registration or attendance status and ticket/transaction status where applicable. The information available depends on the event and platform settings. It is not imported automatically into this website's CMS.
  • Payment confirmation, where an event offers it: payer details, payment reference, amount, date and payment/refund status made available to the seller through the payment service or supplied by the participant.
  • Private administration: the administrator's email, password hash, session identifiers, login timestamps and security records. Administrator rate-limiting records use keyed hashes of submitted email addresses and client IP addresses. The public contact form uses a short-lived signed form token, a spam-trap field and sending limits. Its security records contain keyed hashes of client IP addresses and form tokens, counters and timestamps; they do not contain the message or sender details.

This website does not provide attendee accounts or its own payment checkout. Payment-card details are not entered on events.zuzka.pl. Please do not send card details or sensitive personal information by ordinary email.

3. Purposes and legal bases

We process information to provide a functioning, secure website, investigate faults and prevent unauthorized access, relying on our legitimate interest in operating and protecting the service (Article 6(1)(f) GDPR).

We handle correspondence to answer your request. The basis is our legitimate interest in communicating with you, or steps requested before a contract where relevant (Article 6(1)(b) or (f)).

Zuzanna Wala normally sells the event tickets and settles with the relevant partner. Where we are responsible for an event, participant data is used to manage registrations, communicate practical information, administer attendance and handle booking issues. Telephone numbers are used to contact participants to confirm payment and participation. Article 6(1)(b) applies where necessary for a contract with us or steps you request; where we help coordinate an event without being the contracting party, our legitimate interest in handling the requested registration and practical arrangements applies (Article 6(1)(f)). Legally required records rely on Article 6(1)(c).

Optional booking alerts: we process your address to provide the event-specific alert you actively request and confirm, based on consent (Article 6(1)(a)). You can cancel using the unsubscribe link in the confirmation or alert email. Confirmation links expire after 24 hours. Subscribing is optional, does not reserve a place and does not subscribe you to a newsletter or other events. Withdrawing consent does not affect earlier lawful processing.

We do not treat registration or a general inquiry as consent to unrelated marketing. Any future consent-based use will be explained separately.

4. Luma and other external links

Booking buttons lead to Luma, an external platform operated by Luma Labs, Inc. Luma states that it shares registration information with the event host and relevant purchase information with its payment processor. We receive attendee information where it is made available to our organizer account; this is why our handling of participant data is covered here.

Read the privacy information for the specific booking, including the identified organizer and seller, and Luma's Privacy Policy. This notice does not replace Luma's notice or the notices of other responsible parties. We do not describe every provider as our processor: the role depends on the service and actual arrangement.

Where an event offers payment by Revolut or PayPal after registration, the payment takes place through that external service, not on this website. We use the payment information available to the seller to match and confirm payment, manage the booking and handle refunds. The payment provider processes information under its own applicable notice: Revolut privacy information and PayPal privacy information. The provider and terms applicable to your account or transaction may depend on your location and product. Event-specific payment instructions explain the available method.

Google Maps and partner/social links, when present, open external services. Maps, social feeds and Luma checkout are not embedded in this website's current frontend. The external service's practices apply when you visit it.

5. Hosting and recipients

The website uses Zenbox hosting, provided by cyber_Folks S.A., ul. Wierzbięcice 1B, 61-569 Poznań, Poland. Hosting support and infrastructure may involve access to information needed to provide and secure the service. Zuzanna Wala personally manages the contact mailbox. The contact mailbox is provided by Zenbox; its infrastructure processes messages as needed to deliver email.

The DM Sans and Libre Caslon Display fonts are served from this website's own domain. Loading them does not require your browser to contact Google Fonts. The website does not include Google Analytics, advertising pixels or embedded social feeds/maps. A link to an external service is different from loading that service in the page.

Zuzanna Wala has access to participant information in the organizer account. This does not exclude processing by Luma or its service providers. We may share the minimum necessary event information with the relevant organizer, seller or experience provider where needed for the stated event purpose and lawful basis. Information may also be disclosed where legally required. We limit access to people who need it for these tasks.

6. International processing

External booking platforms, including Luma, may process information outside the European Economic Area. Visiting an external map or social service may also involve processing outside the EEA. We do not claim that all processing remains in Poland or the EEA. The applicable provider notice explains its international processing and safeguards. The hosting of this website in Poland does not mean that a separate service you choose to use processes information only in Poland. Contact us for information about any international transfer for which we are responsible.

7. Retention

Different information is retained for different purposes:

  • Booking alerts: unconfirmed requests expire after 24 hours; confirmed subscriptions expire after 180 days if no alert has been sent. The address is removed from active alert storage after the SMTP server accepts the booking alert, or when you unsubscribe. Minimal event/consent/delivery metadata, including a keyed address fingerprint, is retained for up to 30 days after sending to prevent repeated alerts. Expired alert records are cleaned by the notification worker; access-restricted backups can retain earlier copies for up to 30 days. Confirmation and alert emails processed by the mailbox provider follow its service lifecycle.
  • Ordinary correspondence: while a matter is open and for up to 12 months after it is closed.
  • Operational participant lists and exports: until the event and related booking issues have been handled, then deleted or anonymized within 90 days after the later of the event or resolution of those issues. A separate record is kept only where needed for a specific legal obligation or claim. Information retained by Luma under its own notice is not necessarily erased by deleting our exported copy.
  • Legal, accounting and dispute records: only the information necessary for the specific obligation or dispute, retained separately for the period required by the relevant law or concrete need. These exceptions do not justify keeping every participant list indefinitely.
  • Managed application backups: a 30-day retention limit. Copies are created and expired copies removed through manual maintenance; automatic daily backups are not currently enabled. Backup copies are access-restricted. Restoring a copy does not restart the retention periods for correspondence or participant data; any required deletions must be reapplied. The host's independent recovery copies, if any, follow its service lifecycle, which must be checked separately.
  • Hosting access/error logs: retained under the hosting service's log-rotation and security procedures. The 30-day application-backup limit does not describe hosting logs or the provider's independent recovery copies. Contact us for information about logs relevant to a particular request.
  • Administration and security: administrator rate-limiting uses 15-minute windows; unlocked buckets older than 24 hours are removed during later login activity. Contact-form and booking-alert request limits use one-hour windows and replay-prevention tokens last up to two hours. Expired contact security records older than 24 hours are removed during later contact or administrator login activity. The administrator record is retained while the account is in use. Authentication expires after 30 minutes of inactivity or eight hours in total; cleanup of underlying session files follows the server's configured lifecycle.

We apply these periods to the copies we control, including correspondence and downloaded participant lists. Deleting a copy does not automatically delete records held independently by a platform or payment provider. Contact events@zuzka.pl about retention relevant to your information.

8. Your rights

Depending on the processing and legal conditions, you may request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent where it is the basis. Contact events@zuzka.pl. We may need proportionate information to verify the requester's identity.

You may complain to a competent supervisory authority, including the authority where you live, work or believe an infringement occurred. Examples are UODO in Poland and AEPD in Spain, as applicable.

Providing information for an inquiry is voluntary. The contact form requires your name, email address and message to identify and respond to your inquiry. You can also write directly by email. Required booking information and the consequences of not providing it are specified in the relevant registration flow. This website does not make automated decisions about attendees with legal or similarly significant effects.

9. Cookies and browser storage

The current public frontend does not itself set analytics/marketing cookies or use localStorage/sessionStorage. The contact form works without a public session cookie. Ordinary browser caching of CSS, fonts, JavaScript and images is separate from tracking functionality. Fonts are hosted locally; public page assets do not require an external Google Fonts request. Hosting request logs and external services you choose to visit are separate from browser tracking cookies.

The private `/admin` area uses the necessary first-party events_admin session cookie for authentication and security. It is scoped to `/admin`, marked Secure, HttpOnly and SameSite=Strict, and has no persistent expiry specified. Authentication expires after 30 minutes of inactivity or eight hours in total. Browser session restoration and server-file cleanup are separate from these login limits. Blocking this cookie prevents use of the private administration area.

This description covers this website, not cookies or storage added by an external booking service after you leave this website. New optional technologies require reassessment and, where needed, prior consent before loading.

10. Updates

We will revise this notice when the website, providers or data practices change. The date above identifies the latest version.