1. Data Controller
The controller of personal data is:
On Tour Poland
Starków 12, 57-362 Starków, Poland
Tax Identification Number (NIP): 8992282507
e-mail: ontourpoland@gmail.com
The Controller has not appointed a Data Protection Officer.
2. Scope of Processed Data
In connection with the organisation of package travel events, recreational events and motorcycle
expeditions, we process the following personal data:
Participant data provided via the contact form:
• full name
• PESEL (national identification number)
• date of birth
• residential address (street, city, postal code, region)
• phone number
• e-mail address
• invoicing details
• motorcycle make and model
• data of passengers and minor participants (if applicable)
• message content
3. Purposes and Legal Bases for Data Processing
Personal data are processed for the following purposes:
• Conclusion and performance of a contract related to participation in a package travel event,
recreational event or motorcycle expedition.
• Organisation of the event, ensuring participant safety and logistical support.
• Registration of participants for insurance provided by the Organiser for the duration of the
event.
• Fulfilment of accounting and tax obligations.
• Communication on organisational matters before, during and after the event.
• Establishment, assertion or defence of legal claims.
4. Data Recipients
Personal data may be shared with entities cooperating with the Controller, in particular:
• accounting offices,
• insurance companies,
• entities providing tourism services (e.g. hotels, local partners),
• IT and hosting service providers,
• public authorities – if required by law.
5. Transfer of Data Outside the EU
In connection with the organisation of expeditions outside the European Economic Area, personal
data may be transferred to entities providing services in the destination country (e.g. hotels, local
operators).
The Controller also uses social media platforms Facebook and Instagram (Meta Platforms Ireland
Ltd.), which may involve the transfer of data to third countries (e.g. the USA) in accordance with
the mechanisms provided for under the GDPR.
6. Data Retention Period
Personal data are stored:
• for the duration of the contract and the implementation of the event,
• for the period required by tax and accounting regulations,
• until the limitation period for potential claims expires,
• in the case of contact enquiries – for the period necessary to respond to the enquiry.
7. Rights of the Data Subject
The data subject has the right to:
• access their data,
• rectify their data,
• erase their data,
• restrict processing,
• object to processing,
• lodge a complaint with the President of the Personal Data Protection Office (UODO).
8. Voluntary Provision of Data
Providing personal data is voluntary; however, it is necessary for the conclusion and performance
of the contract and for participation in organised events.
9. Data of Minors
Personal data of minor participants are processed only to the extent necessary for the
implementation of the event and with the consent of a parent or legal guardian.
10. Changes to the Privacy Policy
The Controller reserves the right to amend this Privacy Policy in the event of changes in legal
regulations or the scope of conducted activities.
