This policy explains what data the schtomy.pl website collects, why we collect it, how long we keep it and what you can do about it. We try to write plainly and to keep legal jargon where it cannot be avoided, not everywhere.
Who is responsible for your data
The controller of your personal data is Kościół Chrystusowy w RP Społeczność Chrześcijańska Tomy w Tomaszowie Mazowieckim, ul. Jerozolimska 1E, 97-200 Tomaszów Mazowiecki, Poland, NIP (tax identification number) 7732368944, REGON (statistical number) 100247772.
For anything to do with personal data, write to biuro@schtomy.pl or to the postal address above. We have not appointed a data protection officer, so the church office handles this correspondence.
What we collect and why
Contact form
When you write to us through the form, we collect your name, e-mail address and the message itself. We use them for one thing only: to reply. Messages are stored in the website’s admin area and sent to the office mailbox, which runs on Google Workspace.
The legal basis is our legitimate interest, namely answering someone who approached us of their own accord (Article 6(1)(f) GDPR). We delete correspondence 24 months after the last message in a given matter, unless it concerns something we have to keep longer, accounting records for instance.
Online donations
When you donate through the website you give your first name, surname and e-mail address, and the form records the amount, the date and the payment status. The transfer itself is handled by PayU, and it is PayU, not us, that receives your card or banking details. We never see them.
We process this data in order to accept and account for the donation (Article 6(1)(b) GDPR) and because tax and accounting law requires us to keep accounting records (Article 6(1)(c) GDPR). Accounting data is kept for 5 years, counted from the end of the year in which the tax payment deadline fell.
The donation itself is described in the separate Donation terms.
Server logs
The server the website runs on automatically records the IP address, the date and time of the visit, the address of the page opened and the browser type. This is the ordinary record of a server’s work, needed to spot failures and abuse. The basis is our legitimate interest in keeping the website secure (Article 6(1)(f) GDPR).
The logs are kept and overwritten by the hosting provider on its own schedule. We do not analyse them, do not combine them with other data and do not build visit statistics from them.
Visit statistics
If you agree to analytics cookies, the website uses Google Analytics 4. The tool shows us, in aggregate, how many people visit the site, which content they read and what devices they use. What interests us is the overall picture, not any individual person.
The basis is your consent (Article 6(1)(a) GDPR). You can withdraw it at any time, and data collected until then remains lawfully processed. Data in Google Analytics is retained for 14 months.
Until you click to agree, the Google script does not run at all: your browser makes no connection to Google’s servers and stores no analytics cookie.
The record of your consent
When you make a choice in the cookie window, we store it together with a shortened IP address (without its last part, so it does not point to a particular device), your browser name, the date and the wording of the consent. The law requires us to be able to demonstrate that consent was given (Article 6(1)(c) GDPR). We keep the record for 12 months after the consent expires.
Cookies
Cookies are small files the website stores in your browser. Some of them are necessary for the site to work the way you expect: to remember your campus, your language and your decision in the cookie window. These cannot be switched off, because without them the site stops responding to your own choices.
We reach for analytics cookies only once you agree to them. We use no advertising cookies and pass no data to anyone for marketing purposes.
You can change your decision at any time:
You can also delete cookies yourself in your browser settings. Bear in mind that clearing them also erases the record of your decision, so the cookie window will appear again.
The cookies we use
No cookies listed under the "" category.Sermon recordings
We publish sermons on YouTube and embed them on the website. In most browsers you first see a thumbnail and the player loads only once you click it. On an iPhone and an iPad the player is on the page from the start: Safari will only start a recording when you tap a control inside the player itself, so with a thumbnail you would have to tap twice.
We use YouTube’s privacy-enhanced mode, so merely loading the player stores no cookie. YouTube cookies appear only once you start playback, and from that moment Google’s rules apply. The thumbnail is fetched from a Google server, which passes your IP address there, but it too stores no cookie.
If you would rather not contact Google’s servers at all, listen to the audio version of the sermon. It sits under the player and plays from our own server.
Who we share data with
We do not sell data and we do not make it available to anyone for their own purposes. We do rely on companies that help us run the website:
- LH.pl Sp. z o.o., with its registered office in Poznań, as the provider of the server the website runs on;
- PayU S.A., with its registered office in Poznań, which handles online payments and is a separate controller of that data;
- Google Ireland Limited: the church’s mail runs on Google Workspace, and on the website Google provides visit statistics and the YouTube player;
- our accounting office and bodies we are required by law to submit documents to, the tax office for instance.
Transfers outside Europe
Google also processes data outside the European Economic Area, mainly in the United States. This happens on the basis of the European Commission’s adequacy decision (Data Privacy Framework) and standard contractual clauses. The rest of the data stays in Europe.
Your rights
At any time you may:
- find out what data we hold about you and receive a copy of it;
- correct data that is wrong or out of date;
- ask us to delete data, as long as we are not required to keep it by law;
- ask us to restrict processing;
- object to processing based on our legitimate interest;
- move your data to another organisation;
- withdraw consent you gave earlier, without giving a reason.
A message to biuro@schtomy.pl is enough. We reply within one month.
If you believe we process data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland.
Do you have to give us your data
No. Giving data is voluntary. Without an e-mail address, though, we cannot answer a message sent through the form, and without the data PayU requires an online donation cannot go through. Browsing the site, reading and listening to sermons requires nothing at all.
Automated decisions and profiling
We make no automated decisions and do not profile visitors. We look at statistics in aggregate.
Children
The website is not aimed at children and we do not knowingly collect their data. Sign-ups for children’s activities are handled away from the website, directly with parents and guardians.
Changes to this policy
When we change the way we process data, we will change this document too and give a new date below. Worth a look if you use the site regularly.
Version of 01.10.2026.