1. Who is responsible?
The controller for enquiries concerning Podróże za sztuką (Travel for Art) and its developing community is HEMAJU RCI sp. z o.o.
ul. Szlak 77, lok. 222, 31-153 Kraków, Polska
KRS 0001254891 · NIP 6762724314 · REGON 545290177.
Privacy and data-rights contact: biuro@hemaju.pl, or our postal address marked “Personal data — Podróże za sztuką”. Programme enquiries: contact@futurale.studio. The concept and curatorial direction are by mgr historii sztuki Henryk Tanerowicz / FUTURALE.studio. Brand names do not replace the named controller; group affiliation does not automatically authorise data sharing.
2. What data do we use?
You may provide your name, email address, type of enquiry and optional destinations, interests, travel frequency, timing, group size and message. Confirmed registrations also involve a card number and status, visual finish, and records of notices, consents, confirmations and withdrawals.
Hosting and email systems may process connection data such as IP address, time, requested URL and browser information for operation and security. Registration rate limits use hashed IP and email values. We do not ask for identity-document, national-identification or payment details in this enquiry form.
3. Purposes and legal bases
- Replying and preparing proposals: Article 6(1)(f) GDPR, our legitimate interest in handling correspondence; Article 6(1)(b) where you request steps towards a specific contract.
- Confirmed membership and a personal card, once available: Article 6(1)(b), providing the community service under the terms presented before registration.
- Future programme offers by email: your separate voluntary consent under Article 6(1)(a) GDPR and prior email-marketing consent under Article 398 of the Polish Electronic Communications Law. Enquiries do not require marketing consent.
- Security, consent records and legal claims: Article 6(1)(f), limited to what is necessary and proportionate.
- Specific legal obligations, if applicable: Article 6(1)(c). Paid trips will have separate terms and any additional data information.
4. How enquiries and cards work
We currently collect expressions of interest without payment. The form states how your enquiry will be sent. In email-preparation mode, you review the full message and send it yourself through your own email application. Merely filling the fields does not submit a database registration.
Direct registrations may become available after the service is configured. Club and future-offer registrations then require email confirmation; confirmation links last 48 hours. Opening a link alone does not activate a registration: a separate confirmation action is required.
Sample-card personalisation runs in your browser and does not create membership. You download the file to your own device. Its QR opens the club page. An active-card QR verifies status without revealing the holder’s name or email. Keep a personal active-card access link private. VIZIT ONE is optional and has no automatic data synchronisation with this website.
5. Recipients and international processing
Authorised programme staff and providers of hosting, email, technical support and security may access data as needed for their tasks. Providers processing on our instructions should be covered by appropriate contractual arrangements. Public authorities receive data where required by law.
The private ChatGPT preview uses OpenAI services and platform infrastructure. Account sign-in, technical data and the platform’s own cookies are also covered by OpenAI’s privacy information. External websites and your email provider have their own information.
These technologies may involve processing outside the EEA. Transfers made on the controller’s instructions require an applicable Chapter V GDPR mechanism, such as an adequacy decision or standard contractual clauses, depending on the provider and transfer. Contact us for information about recipients, relevant safeguards and obtaining a copy. HEMAJU group affiliation is not itself a transfer mechanism.
6. Retention
- Sample-card input: remains in the open page’s memory and is not saved in localStorage. Downloaded files remain on your device until you delete them.
- Unconfirmed club or future-offer registrations: up to 30 days after the latest request; confirmation links expire after 48 hours. Temporary rate-limit records expire after one hour.
- Ordinary correspondence: during handling and up to 12 months after contact ends, unless a specific legal duty or claim requires longer.
- Confirmed membership data: for the membership and card service. Contact us to end membership.
- Future-offer email address: until consent is withdrawn. A minimal consent/withdrawal record may be retained only as necessary to demonstrate proper contact and address claims within the applicable limitation period; it is not used for further offers.
- Logs and backups: as necessary for security, recovery and maintenance under the relevant provider’s cycle. Backups are not used for current marketing. Ask us for details concerning your specific record.
7. Your rights and choices
Subject to GDPR conditions, you may request access and a copy, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests; an objection to direct marketing stops that use.
Withdraw future-offer consent at any time through the unsubscribe link in an email or by contacting biuro@hemaju.pl. Withdrawal does not affect prior lawful processing and does not require leaving the club. We normally respond to rights requests within one month; a lawful extension and any identity verification will be explained. You may complain to the President of Poland’s Personal Data Protection Office.
Providing data is voluntary. A name and email are necessary to handle the enquiry; further details are optional. Acknowledging this notice is not marketing consent. We do not make solely automated decisions with legal or similarly significant effects on you; your interests help us plan suitable proposals.