1. Data controller and contact
The data controller is Miejski Ośrodek Sportu i Rekreacji w Radomiu Sp. z o.o., ul. Narutowicza 9, 26-600 Radom.
General contact: sekretariat@mosir.radom.pl, +48 48 385 10 00. Data Protection Officer: Tomasz Paprocki, iodmosir@mosir.radom.pl.
2. What data this website processes
- Technical data processed in server logs: IP address, date and time of request, requested resource, browser and device data necessary for security and technical operation.
- A session identifier (PHPSESSID) used by the gallery editor and the website API. The editor password is used only to authenticate access.
- A language preference stored locally in the browser (lotto-pzt-language).
- Aggregated website traffic statistics. The statistics file does not store the IP address or the full referrer URL; it stores only a cryptographic identifier generated from technical request data, the referrer domain, visited page, time and anonymous session duration.
- The content of an email only if you choose to contact the organiser by email. The website itself does not contain a contact form, newsletter or visitor accounts.
3. Purposes and legal bases
- Website delivery, maintenance, security, preventing abuse and handling logs — Article 6(1)(f) GDPR (the controller’s legitimate interest in operating a secure website).
- Measuring the aggregated audience of the website and improving its content — Article 6(1)(f) GDPR (the controller’s legitimate interest in assessing the reach and usefulness of the tournament website).
- Replying to correspondence — Article 6(1)(f) GDPR; where applicable, Article 6(1)(b) GDPR if the correspondence concerns an agreement or taking steps before entering into one.
- Authentication of authorised editors and gallery administration — Article 6(1)(f) GDPR, for access control and website security.
4. Cookies and local storage
The website does not use advertising, profiling or third-party analytics cookies. Its own aggregate statistics do not use a persistent analytics cookie; a short-lived sessionStorage identifier is used only to calculate the duration of a visit in an open browser tab.
| Storage | Purpose | Duration |
|---|---|---|
PHPSESSID | Technical session for the API and editor login; protected with HttpOnly and SameSite=Strict. | Browser session / expiry of the server session. |
lotto-pzt-language | Remembers the language selected by the visitor; it does not identify the visitor or track activity. | Until removed in browser settings. |
radom-cup-analytics-sessionsessionStorage | A random, temporary identifier used to link technical visit events in one browser tab and calculate session duration. It is not used for advertising or profiling. | Until the browser tab is closed. |
5. External resources and recipients
The website is hosted by SEOHOST Sp. z o.o. The hosting provider processes technical data and server logs on the controller’s behalf. To display the website, it also loads fonts, map tiles and technical libraries from external providers: Google Fonts, OpenStreetMap, cdnjs and unpkg. These providers may receive the visitor’s IP address and technical browser data when the resource is loaded. The link to Google Maps is opened only after the visitor clicks it.
Some external providers may process data outside the European Economic Area. Their own privacy notices and safeguards apply to those services.
6. Retention periods
- Server logs: up to 30 days, unless a longer period is needed to investigate a security incident or assert or defend claims.
- Email correspondence: until the matter is resolved and then no longer than 12 months for evidentiary purposes, unless a longer period follows from the law or claims.
- Session identifier: until the browser session ends, the user logs out, or the server session expires.
- Language preference: until removed by the visitor in browser settings.
- Aggregated visit statistics and their pseudonymous technical identifiers: up to 90 days.
7. Your rights
You may request access to your data, rectification, erasure, restriction of processing, portability where applicable, or object to processing based on legitimate interests. You may also lodge a complaint with the President of the Polish Personal Data Protection Office (UODO). Please contact the controller or the Data Protection Officer to exercise your rights.
8. Automated decisions
The website does not use advertising profiling or automated decisions producing legal or similarly significant effects. Internal aggregate audience statistics are not used to make decisions about visitors.
9. Changes to this notice
This notice will be updated if the website’s functionality, data recipients or legal requirements change.