Privacy Policy

In accordance with Article 37 GDPR, the Controller has appointed a Data Protection Officer (DPO), who may be contacted on any matter relating to the processing of personal data and the exercise of rights under the GDPR.

The Data Protection Officer is available for consultation on business days. Every enquiry will be treated with full confidentiality.

We process personal data exclusively for purposes arising from our educational activities, on the legal bases set out in the GDPR. The table below presents the main processing purposes:

Where data is processed on the basis of consent (Article 6(1)(a) GDPR), you have the right to withdraw your consent at any time without affecting the lawfulness of processing carried out before its withdrawal.

The school uses the Google Workspace for Education suite, with Google LLC acting as a processor of the personal data of students and staff — Google LLC is not a joint controller of the data, but processes it solely on the instructions of, and on behalf of, the School, on the basis of a data processing agreement (Data Processing Amendment, DPA).

The following Google Workspace for Education services are used at the school:

• Gmail — official e-mail accounts on the @podstawowa.piwoni.pl domain for staff and students,
• Google Classroom — a platform for managing classes and assignments,
• Google Drive — storage and sharing of school documents,
• Google Meet — video conferencing and remote lessons,
• Google Calendar — organisation of school schedules and events,
• Google Forms — surveys, tests and admission forms.

Transfers of data to Google LLC (USA) take place on the basis of Standard Contractual Clauses (SCCs) approved by the European Commission (Article 46(2)(c) GDPR) and Google's certification under the EU–US Data Privacy Framework. Google undertakes not to use student data for advertising purposes.

More information: Google Workspace for Education Privacy Notice.

The school's website (podstawowa.piwoni.pl) uses the Firebase platform (Google LLC, USA) as a processor. The individual Firebase services and the scope of data processed are as follows:

• Firebase Hosting — serves the static website files; does not process users' personal data.
• Cloud Firestore — a database storing: school news items (title, content, photos), cookie consents and preferences, push notification (FCM) tokens — see section 6 for details.
• Firebase Authentication — sign-in via Google SSO for staff and parents; stores the UID, e-mail address and display name.
• Cloud Functions — backend functions handling the proxy to Gemini AI (LeoAI) and text-to-speech; chatbot conversations are not stored.
• Cloud Storage — photos for news articles; TTS audio files generated on demand.
• Firebase Cloud Messaging (FCM) — infrastructure for delivering push notifications; see section 6 for details.

Data centre: europe-west (Belgium) — all Firestore and Storage data is stored within the European Union. Firebase processes data under a data processing agreement (Google Cloud DPA) based on Standard Contractual Clauses (SCCs) — the same legal basis as for Google Workspace for Education (section 4).

The school's website functions as a Progressive Web App (PWA) — it can be installed on a mobile device or desktop and, once consent has been given, can send push notifications about new school news items.

How does the subscription work?

• The browser displays a system prompt asking for consent to notifications. Consent is voluntary and is given by the user through an active action (clicking "Allow").
• Once consent has been given, the browser generates an FCM token — a unique, random string of characters identifying the browser/device subscription (it does not contain personal data such as a name or e-mail address).
• The FCM token is transmitted to and stored in the Cloud Firestore database (europe-west region, Belgium).
• The school uses the tokens solely to send notifications about news items — school announcements, events and important information.

Data processed in connection with push notifications:

Legal basis: Article 6(1)(a) GDPR — consent of the data subject. FCM tokens do not enable the direct identification of a natural person; however, they constitute personal data within the meaning of the GDPR as pseudonymised data linked to a device.

How to withdraw consent?

• Browser settings — go to the site settings (the padlock icon in the address bar → Notifications → Block). The token will automatically be treated as invalid on the next attempt to deliver a notification.
• Operating system settings — disable notifications for the browser or the installed PWA in the system settings (Android, iOS, Windows, macOS).
• Uninstalling the PWA — removing the app from the device's home screen automatically cancels the subscription.

Once consent has been withdrawn, the FCM token is deleted from Firestore no later than 30 days afterwards (on the first attempt to send a notification, the system detects the invalid token and automatically deletes it).

The school uses the Google BigQuery service for educational analysis based on aggregate data. Data is stored in the classroom_data dataset in the Google Cloud project psp-piwoni-2026, region europe-central2 (Warsaw).

Data is fully anonymised before being loaded into BigQuery — the dataset does not contain students' names or national identification (PESEL) numbers. Processing purposes:

• analysis of attendance and absence trends,
• grade distributions and educational progress on an aggregate basis,
• planning of pedagogical interventions at class level (without individual identification).

Access to the data in BigQuery is granted solely to the school's management staff. Data is retained for 3 years on a rolling basis (data older than 3 years is automatically deleted). Legal basis: Article 6(1)(f) GDPR — legitimate interest (improving the quality of teaching).

The school's website uses cookies in accordance with the Polish Telecommunications Law Act of 16 July 2004 and the GDPR. We use the following categories of cookies:

You can manage your cookie preferences using the cookie banner available on the website or through the settings of your web browser. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Information about cookie choices is stored in the Cloud Firestore database for a period of 12 months from the date consent was given or refused.

A student's image constitutes personal data within the meaning of Article 4(1) GDPR. Processing of a student's image is based on the written consent of a parent or legal guardian (Article 6(1)(a) GDPR), collected when the child is enrolled at the school. For students over 16 years of age, the consent of the student themselves is also required.

Consent covers the publication of photos and video materials in the following channels:

• the school's website (podstawowa.piwoni.pl),
• the school's Facebook profile (facebook.com/PSPPIWONI),
• printed promotional materials and school chronicles.

A parent or guardian may withdraw consent at any time by submitting a written statement to the school office at sekretariat@podstawowa.piwoni.pl. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Photos will be removed from the school's active channels within 30 days of receipt of the statement — this does not apply to materials that have already been printed or archived in school chronicles.

Students' images are never made available to third parties for commercial purposes. Photos are stored on Google Cloud Storage servers in the European region.

If video monitoring is used on school premises, information about the scope of the monitoring, the purposes of processing, the retention period of recordings and the rights of persons recorded will be included in this section and on information signs at the entrances to monitored areas.

Any monitoring in place is carried out on the basis of Article 108a of the Education Law Act and Article 6(1)(f) GDPR in order to ensure the safety of students and staff and to protect the school's property.

Under the GDPR, you have the following rights:

• Right of access (Article 15 GDPR)
  The right to obtain confirmation as to whether we process your data and, if so, to obtain a copy of that data.
• Right to rectification (Article 16 GDPR)
  The right to request the prompt rectification of inaccurate data or the completion of incomplete data.
• Right to erasure (Article 17 GDPR)
  The right to request the deletion of data ("the right to be forgotten") in the cases specified in the GDPR.
• Right to restriction of processing (Article 18 GDPR)
  The right to request the restriction of data processing in specific situations provided for by law.
• Right to data portability (Article 20 GDPR)
  The right to receive data in a structured, commonly used, machine-readable format.
• Right to object (Article 21 GDPR)
  The right to object to the processing of data carried out on the basis of a legitimate interest.
• Right to withdraw consent (Article 7(3) GDPR)
  Where processing is based on consent — the right to withdraw it without affecting processing carried out prior to the withdrawal. This applies, among other things, to push notification subscriptions (section 6) and consent for analytics cookies.
• Right to lodge a complaint with the supervisory authority
  The right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

To exercise the above rights, please contact the Data Protection Officer at d.makus@liceum.piwoni.pl. We respond to requests without undue delay, no later than within 30 days of receiving the request (with the possibility of extension by a further 60 days in justified cases).

We retain personal data for the period necessary to achieve the purposes for which it was collected, taking into account legal requirements and the need to defend against claims:

Once the retention period has elapsed, data is permanently deleted or anonymised in such a way that identification of the individual is no longer possible.

In connection with the use of Google LLC services (Firebase, Google Workspace), personal data may be transferred to the United States of America — outside the European Economic Area (EEA). This transfer takes place on the basis of:

• Standard Contractual Clauses (SCCs) approved by the European Commission under Article 46(2)(c) GDPR,
• Google LLC's certification under the EU–US Data Privacy Framework (since 10 July 2023),
• Additional technical and organisational measures described in the Google Cloud Data Processing Amendment.

Other than Google LLC, no other personal data is transferred outside the EEA. Firebase and BigQuery data is stored in European regions (europe-west — Belgium; europe-central2 — Warsaw). FCM tokens (section 6) are stored exclusively in the European Firestore region.

You have the right to obtain a copy of the SCCs applied. To do so, please contact the Data Protection Officer at d.makus@liceum.piwoni.pl.

Detailed terms of the Google Cloud DPA: privacy.google.com/businesses/processorterms/.

The Controller reserves the right to introduce changes to this Privacy Policy. Any changes take effect on the day they are published on podstawowa.piwoni.pl/polityka-prywatnosci.

We will inform you of significant changes affecting the rights of data subjects (new processing purposes, new data recipients, changes to legal bases) at least 14 days in advance, by sending an e-mail to the school office address (sekretariat@podstawowa.piwoni.pl) to the parents and staff listed in our records, as well as by:

• a notice on the school's homepage (podstawowa.piwoni.pl),
• an announcement in the Librus electronic register.

Continued use of the school's website after the changes take effect constitutes acceptance of them. The date of the last update of this document is shown in the header of this page. We recommend that you review the privacy policy regularly.

For any matters related to the processing of personal data, please contact us:

Supervisory authority responsible for handling complaints regarding the processing of personal data: