1. Data controller
The controller of personal data is Fundacja Rodziny Popielów „Centrum”, ul. Bohaterów Orła Białego 89, 33-300 Nowy Sącz, KRS 0000731520, NIP 7343559561, REGON 380413377. For any matter concerning personal data, write to dariuszpopiela@gmail.com or by post to the foundation’s address.
2. Visiting the website
The website has no user accounts, forms, visitor statistics or advertising. We do not track visitors or build profiles of them.
Each time the site is opened, the server delivering it receives technical connection data: IP address, date and time, the page opened, and the type of browser and device. This is needed to display the site and protect it from attacks. The legal basis is the controller’s legitimate interest (Art. 6(1)(f) GDPR).
3. Contacting the foundation
If you email or call the foundation, we process the data you provide, usually your name, email address or phone number and the content of your message, in order to reply (Art. 6(1)(f) GDPR) and, where the conversation concerns cooperation or an agreement, to prepare and perform it (Art. 6(1)(b) GDPR).
We keep correspondence for as long as needed to handle the matter and then for the limitation period of any claims.
4. Donations and donors
When you transfer money to the foundation’s account, the bank provides us with the payer’s name, account number, amount and transfer title. We keep these for accounting purposes for the period required by law (Art. 6(1)(c) GDPR).
Donations made through Patronite and pomagam.pl are handled by those services as separate controllers under their own privacy policies.
Names of donors and partners are published to thank them for their support, on the basis of consent (Art. 6(1)(a) GDPR) or the foundation’s legitimate interest in thanking donors and keeping fundraising transparent (Art. 6(1)(f) GDPR). Anyone who does not wish to be listed can ask for removal at any time by writing to the foundation, and we will remove the entry without undue delay.
5. People in photos, films and posts
We publish photos, films and reports from the foundation’s work, ceremonies and meetings. If you appear or are named in them and do not wish to, write to the foundation and we will remove or mask the material without undue delay.
6. Lists of victims’ names
The website commemorates by name people murdered in the Holocaust. The GDPR does not apply to the data of deceased persons (Recital 27 GDPR). The lists are based on archival documents and historical studies. If you notice an error or wish to add information about your relatives, please write to the foundation.
7. Third-party services
For some parts of the site your browser connects to servers of other companies, which may then see your IP address:
- Cloudflare, Inc. delivers the site and protects it from attacks, and may set a technical security cookie for this purpose.
- YouTube (Google Ireland Limited). The video player loads only after you click the play button, in privacy-enhanced mode (youtube-nocookie.com). From then on Google processes data under its own privacy policy and may store information in your browser. Covers of some films are loaded from Google servers (i.ytimg.com) when the page is displayed.
- OpenStreetMap Foundation. Map tiles are loaded from its servers when the map appears on screen.
- Links to Facebook, Instagram, YouTube, LinkedIn, X, WhatsApp, Patronite, pomagam.pl and media outlets lead to external sites, which process data only once you visit them, under their own rules.
8. Cookies and browser storage
The site does not use analytics, advertising or tracking cookies, which is why it shows no cookie consent banner. We store only the following in your browser:
- the fact that you closed the strategic partner card, so it is not shown again,
- pages opened from QR codes at memorial sites, so they work without a signal.
This data stays on your device only and is not sent to anyone. It is necessary for features you use, and you can delete it at any time in your browser settings.
9. Content management panel
The panel at /admin is used only by people authorised by the foundation. When logging in, we process the email address of the person logging in to send a one-time code (Resend service). Site content is stored on GitHub. Visitors do not use the panel.
10. Transfers outside the European Economic Area
Cloudflare, Google, GitHub and Resend may process data in the United States on the basis of the European Commission’s adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses approved by the Commission. The OpenStreetMap Foundation operates in the United Kingdom, which is covered by a Commission adequacy decision.
11. Your rights
You have the right to:
- access your data and receive a copy,
- have your data rectified,
- have your data erased or its processing restricted,
- object to processing based on legitimate interest,
- data portability, where provided for by the GDPR,
- withdraw consent at any time,
- lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
To exercise these rights, write to dariuszpopiela@gmail.com. Providing data is voluntary. We do not make decisions based solely on automated processing.
12. Changes to this policy
If the way the site works changes, we will update this policy. The current version is always available on this page.
Effective from 9 November 2026.