Privacy Policy of expeditions.sniegula.com
Effective date: 11 October 2026 | Version: 2.2
§ 1. Personal data controller
The controller of your personal data is:
Sławomir Śnieguła
ul. Czarnieckiego 5, 88-400 Żnin, Poland
Polish Tax ID (NIP): 5213392848
Email: kontakt@sniegula.com
Please use this address for all matters concerning personal data.
§ 2. Definitions and legal framework
GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
UODO – the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).
PKE – the Polish Electronic Communications Law of 12 July 2024 (Prawo komunikacji elektronicznej).
The Controller processes personal data in accordance with the GDPR and the Polish Personal Data Protection Act of 10 May 2018.
§ 3. Categories of data processed, purposes and legal bases
Current status of the website: the website currently announces the 2027 expedition. Bookings and payments through the website are switched off. Applications for the Sarek 2027 expedition are accepted through the qualification questionnaire on the website (§ 3.10), and questions by email (§ 3.5). The website does not collect health data or emergency contact details. Sections 3.2–3.4 describe data that we will collect only from persons who qualify for the expedition – through a separate channel and after giving them separate information.
3.1. Participants of the 2026 expeditions
| Element | Description |
|---|---|
| Scope of data | data provided at sign-up and settlement: first name and surname, email address, telephone number, data needed to settle payments |
| Purpose of processing | settlement of the performed contract, handling of any complaints and claims |
| Legal basis | Article 6(1)(b) GDPR (contract), Article 6(1)(c) GDPR (obligations under tax and accounting law), Article 6(1)(f) GDPR (establishment, exercise or defence of legal claims) |
| Retention period | until the limitation period for claims under the contract expires (as a rule 6 years, Article 118 of the Polish Civil Code); settlement data – until the limitation period for the tax liability expires (as a rule 5 years from the end of the calendar year in which the tax payment deadline fell) |
3.2. Future expedition participants – conclusion and performance of the contract (from sign-ups for the 2027 expedition)
This applies to future sign-ups. We do not collect this data at present.
| Element | Description |
|---|---|
| Scope of data | first name, surname, residential address, email, telephone and identification data where necessary for the contract (the scope will be stated in the participant agreement) |
| How the data is collected | after qualifying on the basis of the questionnaire (§ 3.10): email correspondence and the expedition participation agreement |
| Purpose of processing | conclusion and performance of the expedition participation agreement, ensuring the Participant’s safety during the expedition, settlements |
| Legal basis | Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(c) GDPR (obligations under tax and accounting law) |
| Retention period | as in § 3.1; the participant’s qualification questionnaire – in the website database until 31 December 2027, then in the encrypted contract documentation, as in § 3.1 |
3.3. Participants’ health data (Article 9 GDPR) – from sign-ups for the 2027 expedition
This applies to future sign-ups. We do not collect this data at present. If, before an expedition in remote terrain (Sarek National Park, no GSM coverage), we ask for information about health, it will be special category data within the meaning of Article 9 GDPR, processed as follows:
| Element | Description |
|---|---|
| Scope of data | chronic conditions, medication taken, allergies (food, medication, insect stings), other information relevant to medical safety |
| Purpose | ensuring the Participant’s safety during the expedition, the ability to provide first aid, the guide’s decisions on walking pace and route |
| Legal basis | Article 9(2)(a) GDPR – the Participant’s explicit consent; Article 9(2)(c) GDPR – protection of the Participant’s vital interests where the Participant is unable to give consent (e.g. after an injury) |
| How the data is collected | a separate form (“Participant Health Form”) with separate information and separate consent, completed before the expedition |
| Retention period | until the end of the expedition and 30 days afterwards; in the event of a medical incident – until the limitation period for claims expires (6 years) |
| Security measures | stored in an encrypted file accessible only to the Controller; not sent by ordinary email; not disclosed to third parties, except to rescue services in emergencies |
3.4. Emergency contact person – from sign-ups for the 2027 expedition
This applies to future sign-ups. We do not collect this data at present.
| Element | Description |
|---|---|
| Scope of data | first name, surname, telephone number and, where given, relationship to the Participant |
| Source of data | the data will be provided by the Participant; we will ask the Participant to inform that person about this Policy |
| Purpose | notifying a close person in the event of an accident or another emergency during the expedition |
| Legal basis | Article 6(1)(f) GDPR – the legitimate interest of the Controller and the Participant in ensuring safety; where life or health is at risk – Article 6(1)(d) GDPR (vital interests) |
| Retention period | until the end of the expedition and 30 days afterwards; in the event of an accident – until the limitation period for claims expires (6 years) |
3.5. Preliminary registrations and correspondence (email, telephone, WhatsApp)
| Element | Description |
|---|---|
| Scope of data | first name and surname, email address, telephone number, content of the message, including information about your mountain experience if you provide it |
| Purpose | replying to your message; for a preliminary registration for the 2027 expedition – a conversation about your experience and preparation of the agreement |
| Legal basis | preliminary registration – Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract); other correspondence – Article 6(1)(f) GDPR (the Controller’s legitimate interest in replying) |
| Retention period | preliminary registrations – until recruitment for the 2027 expedition closes and, if you do not conclude an agreement, no later than 31 December 2027; other correspondence – 1 year from its end; if an agreement is concluded – together with the contract documentation (§ 3.2) |
Please do not send information about your health in your registration. If it is needed, we will ask for it before the expedition in a separate form (§ 3.3). We process data from the qualification questionnaire, including when you complete it after exchanging messages with us, in accordance with § 3.10.
If you write via WhatsApp, your messages pass through the WhatsApp service (WhatsApp Ireland Limited), which processes data under its own privacy policy.
3.6. Newsletter – currently inactive
The website does not currently collect newsletter subscriptions, and the “Gear checklist” form on the home page is switched off. If we launch a newsletter, we will update this Policy before we start collecting subscriptions.
Data previously submitted through the “Gear checklist” form (first name, email address) has been deleted and is not used to send any information. If you write to kontakt@sniegula.com yourself, § 3.5 applies.
3.7. Website statistics – Google Analytics 4 (only with your consent)
| Element | Description |
|---|---|
| Scope of data | a random identifier stored in a cookie, pages visited and time of visit, source of the visit, clicks on contact links, device type, operating system and browser, approximate location (country, region, city) derived from the IP address |
| IP address | according to Google, the service does not log or store IP addresses of users in the EU; they are used only to derive approximate location on servers in the EU and are then discarded |
| Purpose | website visit statistics and improving the website content; the data is not used for advertising or profiling |
| Legal basis | your consent – Article 6(1)(a) GDPR; storing and reading cookies – Article 399(1) PKE |
| Retention period | user-level and event-level data – 14 months, after which Google deletes it automatically; aggregated statistical reports may be kept longer; cookies in your browser – as set out in § 4 of the Cookie Policy |
| Service settings | Google signals is switched off |
Consent is voluntary. Not giving it has no consequences other than your visit not being included in the statistics. You can withdraw your consent at any time using the Cookie settings link in the website footer.
3.8. Website operation and security (server logs)
| Element | Description |
|---|---|
| Scope of data | access logs: IP address, date and time of the request, address of the page visited, browser type; server mail sending log: recipient’s email address, date and time of sending and technical headers of the message (without its content); log of the plugin that sends mail from the website: sender and recipient addresses, subject, message content and sending status; web application firewall log (Wordfence): IP address, date and time, address of the page, browser type and, for a request blocked as suspicious, its full content (up to 47.5 KB), including the values of form fields |
| Purpose | ensuring website security, protection against attacks and email abuse, troubleshooting, including message delivery problems |
| Legal basis | Article 6(1)(f) GDPR – the Controller’s legitimate interest in ensuring network and information security (Recital 49 GDPR) |
| Retention period | access logs – 6 months; server mail sending log – up to 10 days (daily rotation set by the hosting provider); mail plugin log – up to 1 month; firewall log – up to 30 days; all these logs are stored only on the website server |
3.9. Record of cookie choices
| Element | Description |
|---|---|
| Scope of data | a random identifier of the choice (also stored in the sn_consent cookie), date and time, version of the banner texts, the choice (consent to or refusal of analytics cookies), language version, the website on which it was made (expeditions.sniegula.com or sniegula.com); the register contains no IP address or browser data and is not linked to the Google Analytics identifier; the IP address of the connection goes only to the server logs (§ 3.8), which we do not link to the register |
| Purpose | demonstrating that consent to analytics cookies was given, and that we respect refusals and withdrawals of consent |
| Legal basis | record of consent – Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR (obligation to demonstrate consent); record of refusal and withdrawal – Article 6(1)(f) GDPR (the Controller’s legitimate interest in demonstrating that it respects visitors’ choices, Article 5(2) GDPR) |
| Retention period | 13 months from the record, after which the entry is deleted automatically |
| New consent | if we materially change the purpose or scope of cookies that require consent (a new tool, recipient or data transfer), we ask again; editorial changes do not require a new decision |
3.10. Qualification questionnaire for the Sarek 2027 expedition
| Element | Description |
|---|---|
| Scope of data | first name and surname, email address, telephone number and town of residence (if you provide them), answers to questions about your motivation, outdoor and camping experience, navigation, physical activity, first aid, communication, equipment, food and teamwork, information about insurance (without the policy number), declarations that you are at least 20 years old and that you know the requirements of the expedition, the date of submission and the version of the form texts, the status of the application and the date of the decision |
| Health data | we do not collect it in the questionnaire and ask you not to enter it; if it appears, we do not take it into account and we remove it from the questionnaire within 7 days of reading it |
| Purpose and legal basis | assessing your application, contacting you about the expedition and keeping a waiting list – Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract); the answer to the question how you heard about the expedition – Article 6(1)(f) GDPR (the Controller’s legitimate interest in assessing the effectiveness of sources of information); the note on the decision and the participant’s questionnaire as part of the contract documentation – Article 6(1)(f) GDPR (the Controller’s legitimate interest in the establishment, exercise or defence of legal claims) |
| IP address | we do not store your IP address or browser data with the questionnaire; the IP address is used only to protect the form against abuse: it is recorded in the server logs (§ 3.8), and to limit the number of submissions we use its cryptographic hash, which changes every day, is not linked to the questionnaire and is deleted automatically within one day at the latest – Article 6(1)(f) GDPR (the Controller’s legitimate interest in protecting the form against abuse) |
| Whether providing data is required | completing the questionnaire is voluntary, but without it we cannot accept your application; fields marked with an asterisk are mandatory |
| Where the data goes | the website database on the hosting provider’s server (§ 4); the kontakt@sniegula.com mailbox receives only a notification of a new questionnaire with its number, without your data or answers; the email address to which we send you messages from the website and the content of those messages are briefly recorded in the mail sending logs (§ 3.8); only the Controller has access to the questionnaires |
| Retention period | while it is being assessed – up to 30 days after the day on which applications close (applications are accepted until 1 July 2027), i.e. no later than 31 July 2027; if we decline your participation – the questionnaire up to 30 days after our reply is sent, and the note on the decision (name, email, dates, reason) until 30 September 2027; a requirement to be met (e.g. insurance policy or equipment) – if it is not met, up to 30 days after the deadline set for meeting it, no later than 30 September 2027; waiting list – up to 30 days after the list is closed or after you withdraw, no later than 30 September 2027; withdrawal before the contract is concluded – up to 30 days after you withdraw, no later than 30 September 2027; participants – as in § 3.2 |
| Backups | after deletion, the data may still remain in backups: in the Controller’s own backups for up to 30 days, and in the hosting provider’s backups for the length of its backup cycle (according to the provider: daily backups for at least 7 days, full backups for at least 30 days), after which they are deleted automatically; we use backups only to restore the website after a failure, and after a restore we delete again any data whose retention period has expired |
| Decision on participation | taken personally by the Controller after reading the questionnaire, using the same criteria for everyone (experience, equipment, insurance, acceptance of the group rules); we do not make decisions by automated means (§ 8) |
| Party to the contract | if the expedition participation agreement is concluded by a company, we will inform you before the agreement is concluded, and the company will provide its own information on data processing; the questionnaire is not passed to the company automatically |
You may object to processing based on legitimate interest (§ 6). You may also withdraw your questionnaire at any time by writing to kontakt@sniegula.com – we will delete it within 30 days.
§ 4. Data recipients
| Recipient | Role | Data |
|---|---|---|
| IQGroup Adam Buhl (IQhost.pl brand), ul. Luboszycka 36/1, 45-128 Opole, Poland | website and email hosting provider – processor (data processing agreement, Article 28 GDPR) | data stored on the server (including the record of cookie choices, § 3.9, and qualification questionnaires, § 3.10) and in the kontakt@sniegula.com mailbox |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | provider of Google Analytics 4 – processor; only with your consent | data described in § 3.7 |
| Microsoft (Microsoft Ireland Operations Limited, Ireland, and Microsoft Corporation, USA) | provider of the Outlook email program in which the Controller handles the kontakt@sniegula.com mailbox; the program stores a copy of the messages in the mailbox in the Microsoft cloud | email correspondence in the kontakt@sniegula.com mailbox (§ 3.5), including replies to messages concerning the qualification questionnaire (§ 3.10); the questionnaires themselves do not go to the mailbox |
| The Participant’s insurer | applies to expeditions: only when a claim is reported; the Participant buys the policy independently and is the party to the insurance contract | where necessary – medical data (Article 9 GDPR) with the Participant’s consent |
| Swedish rescue services (Fjällräddningen, Polismyndigheten, medical services) | applies to expeditions: in emergencies threatening the Participant’s life or health | identity, contact details, medical data – Article 9(2)(c) GDPR (vital interests) |
| Garmin International / IERCC | applies to expeditions: handling of the inReach satellite communicator in an emergency (transfer of data to the USA – § 5) | location, contact details |
| Provider of the Controller’s accounting services | if the Controller engages one | settlement data (invoices), no health data |
| Public authorities | where required by law | to the extent required by law |
Payments through the website are currently switched off. If we enable them, we will add the payment provider here before launch.
§ 5. Transfers of data outside the European Economic Area (EEA)
In certain situations data may be transferred to third countries:
- USA – Garmin International / IERCC (International Emergency Response Coordination Center, Houston, Texas) – during an expedition, when the SOS function of the Garmin inReach satellite communicator is activated. Legal basis: Article 49(1)(f) GDPR (protection of the vital interests of the Participant or another person who is unable to give consent).
- USA – Google LLC – Google Ireland Limited may transfer Google Analytics data to Google LLC. Legal basis: Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection under the EU–US Data Privacy Framework, in which Google LLC participates; in addition, the standard contractual clauses (Article 46(2)(c) GDPR) included in Google’s data processing terms: business.safety.google/adsprocessorterms. You can obtain a copy of these safeguards by writing to kontakt@sniegula.com.
- USA – Microsoft Corporation – the copy of the correspondence in the kontakt@sniegula.com mailbox stored in the Microsoft cloud may be located in the USA. Legal basis: Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 (Data Privacy Framework), in which, according to Microsoft’s statement, Microsoft Corporation participates; Microsoft also uses standard contractual clauses (Article 46(2)(c) GDPR).
The website, its database and the kontakt@sniegula.com mailbox run on the hosting provider’s server in Poland, and a copy of the messages in the mailbox is stored by Microsoft (§ 4). The hosting provider uses the DirectAdmin control panel; its producer, DirectAdmin Inc. (USA), may obtain remote access to the server as part of technical support. Such a transfer is based on standard contractual clauses (Article 46(2)(c) GDPR), as indicated by the hosting provider. You can obtain a copy of these safeguards by writing to kontakt@sniegula.com.
The Controller applies data minimisation (Article 5(1)(c) GDPR) – only the data necessary for the given purpose is transferred outside the EEA.
§ 6. Rights of the data subject
| Right | Legal basis | Description |
|---|---|---|
| Access to data | Article 15 GDPR | information about the data processed and a copy of it |
| Rectification | Article 16 GDPR | correction of inaccurate data |
| Erasure (“right to be forgotten”) | Article 17 GDPR | subject to the Controller’s legal obligations (e.g. tax data) |
| Restriction of processing | Article 18 GDPR | temporary suspension of processing |
| Data portability | Article 20 GDPR | receiving data in a machine-readable format (applies to data processed on the basis of consent or a contract) |
| Objection | Article 21 GDPR | to processing based on the Controller’s legitimate interest (Article 6(1)(f) GDPR) |
| Withdrawal of consent | Article 7(3) GDPR | at any time, without affecting the lawfulness of processing carried out before the withdrawal; applies to Google Analytics and, in future, health data (Article 9 GDPR) |
To exercise your rights, write to kontakt@sniegula.com. We will reply within one month (Article 12(3) GDPR).
§ 7. Right to lodge a complaint
You may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych)
ul. Stawki 2, 00-193 Warszawa, Poland
www.uodo.gov.pl
If you live in another EU or EEA country, you may also lodge a complaint with the supervisory authority in the country of your habitual residence or place of work.
§ 8. Automated decision-making and profiling
The Controller does not make decisions about you by automated means and does not carry out profiling within the meaning of Article 22 GDPR. The Controller makes every decision on your participation in an expedition, including one based on the qualification questionnaire (§ 3.10), personally and individually. Google Analytics statistics are used only to assess visits to the website.
§ 9. Whether providing data is required
Providing personal data is voluntary, but it is necessary to:
- receive a reply to your message (§ 3.5),
- apply for the Sarek 2027 expedition – completing the qualification questionnaire (§ 3.10),
- in future: conclude and perform the expedition participation agreement (§ 3.2) and ensure medical safety during the expedition (§ 3.3).
Without the basic data, the agreement cannot be concluded. If, when signing up in future, you do not provide health data or do not consent to its processing, the Controller may refuse to start the expedition for safety reasons. Consent to Google Analytics is voluntary.
§ 10. Record of processing activities
The Controller keeps a record of processing activities in accordance with Article 30 GDPR.
§ 11. Data security (Article 32 GDPR)
The Controller applies appropriate technical and organisational measures, including:
- encryption of the connection to the website (SSL/TLS),
- an application firewall (Wordfence) and regular software updates,
- backups,
- access to data only for authorised persons,
- in future: storage of health data in an encrypted file outside email,
- a data processing agreement with the hosting provider (Article 28 GDPR).
§ 12. Cookies
The website uses strictly necessary cookies and, only with your consent, Google Analytics 4 analytics cookies. Details are set out in the Cookie Policy.
§ 13. Changes to this Privacy Policy
The Controller may update this Policy. Material changes will be announced on the website and, for persons whose data is currently processed under an agreement, also by email to the address given in the agreement.
Version 2.2 of 11 October 2026. Previous versions: 2.1 of 6 October 2026, 2.0 of 5 May 2026 (Polish), 1.0 of 16 April 2026. This English version corresponds to the Polish version of the Privacy Policy.