Privacy Policy
Information on the processing of personal data on nihili.com, wzmocnia.com, wzmocnia.pl and wzmocnia.org and in WZMOCNIA Rooms, provided under Articles 13 and 14 of the GDPR.
Version 1.4 of 13 October 2026. In force from the date of publication on the website.
§ 1. Controller and contact
The controller of personal data is NIHILI Prosta Spółka Akcyjna with its registered office in Warsaw, ul. Piękna 49, 00-672 Warsaw, Poland, KRS 0001244757, NIP 7011316302, REGON 544879583 (“NIHILI”, “we”). Contact for data protection matters: e-mail mail@wzmocnia.com, postal address as above. NIHILI has not appointed a data protection officer; requests and questions are handled by the management board.
For stays bought at a hotel reception and for hotel services the controller is the hotel (Site Host) and its privacy notice applies. For employees' contact details provided by an employer, the employer is the controller and NIHILI is a processor — see § 4.
§ 2. Who this policy concerns and where the data come from
| Who | What data | Source |
|---|---|---|
| wzmocnia.pl Customer | first name, e-mail, password (hashed only), language; date, version of the Terms and content of consents; orders, tickets, Codes, payments (no card data); WZMOCNIA Online playback history; correspondence | from you and from your use of the website |
| Person running a pilot at an employer, and person sending a pilot order without an account | name, position, work e-mail and phone; organisation data (name, tax ID, address, sector, headcount band); region, chosen dates, remarks, language, order number and status; in a group purchase — data of the other Employers (name, tax ID, address, billing e-mail), session schedule and cost split; for an account: identifier, role, link to the organisation, hashed password; for a block order — the people concluding the contract (first name, surname, position or basis of authority), the body and rule of representation, the wording, date and version of the declarations, the status of the deposit and the agreement files sent via the order page | from you or your organisation; in a group purchase the companies' data and billing addresses are provided by the Coordinator; after you enter a tax ID, the entity's name and address may be retrieved from the public VAT Taxpayer Register of the Ministry of Finance (§ 5); the body, rule of representation and composition of the body — from the Polish National Court Register (§ 5) |
| Person preparing a facility specification in the specification form | tax ID, company name and address, delivery location, the contact person's name, position, phone and e-mail, chosen equipment and form of financing — only in your browser, for printing or a PDF; the website does not save them, and our server transiently receives only the tax ID and the fragments of the delivery address you type (§ 5) | from you; after you enter a tax ID, the company's name and address may be retrieved from the public VAT Taxpayer Register of the Ministry of Finance (§ 5) |
| Site host contact person | name, position, work e-mail and phone; facility and calendar data; for an account: identifier, role, hashed password | from you or your organisation |
| Pilot participant (employee with a Code) | phone number or e-mail (to send the Code); Code; facility entry times; voluntary answers to three survey questions saved under the Code, without a name | number or e-mail from the employer (§ 4); the rest from your use |
| Person submitting an enquiry, complaint or withdrawal statement | data provided in the message and data of the contract concerned | from you |
| Person within range of monitoring at the facility | image in the exterior zones of the facility | from cameras operated by NIHILI on the employer's premises or by the host on its premises (§ 3) |
| wzmocnia.org reader, website visitor | IP address, browser data and request content in server logs; cookies described in § 9; no accounts and no analytics | from your browser |
§ 3. Purposes, legal bases and retention periods
| Purpose | Legal basis (GDPR) | How long |
|---|---|---|
| Running a Customer Account, selling and fulfilling tickets and WZMOCNIA Online access, handling withdrawals and refunds | Art. 6(1)(b) — contract with you | for the duration of the contract; after it ends, data needed to defend claims until they become time-barred (6 years from the end of the year), the rest deleted within 30 days |
| Handling pilot orders, employer and host accounts, contact with people representing organisations | Art. 6(1)(b) — where you are a party to the contract; Art. 6(1)(f) — where you represent an organisation (our interest: concluding and performing the contract with the organisation) | for the duration of the contract; an order without a contract — 12 months from sending; after the contract ends until business claims become time-barred (3 years from the end of the year) |
| Retrieving the company's name and address by tax ID and suggesting the delivery address in the specification form | Art. 6(1)(b) — where you prepare the specification in your own name (steps taken at your request before entering into a contract); Art. 6(1)(f) — where you act on behalf of an organisation (our interest: preparing the specification you request) | nothing reaches our database; responses of the register and the address services — in the server cache for up to 24 hours |
| Issuing invoices, tax settlements | Art. 6(1)(c) — legal obligation (Accounting Act, Tax Ordinance) | 5 years from the end of the calendar year in which the tax payment deadline expired |
| Handling complaints, answering enquiries, defending and pursuing claims | Art. 6(1)(b) and (f) — contract, legitimate interest | until the matter is closed, then until claims become time-barred |
| Sending Codes to pilot participants | processing on the employer's behalf (Art. 28) — the employer is the controller of the contacts; the employer's basis: Art. 6(1)(f) | until the end of the pilot plus 30 days; then contacts are deleted and Codes are unlinked from numbers and addresses |
| Opening the Room with a Code, entry log, surveys under a Code, aggregate report for the employer | Art. 6(1)(f) — NIHILI's legitimate interest: performing the pilot, facility safety and evaluating the pilot without identifying people | entry log 90 days; answers under a Code 12 months from the end of the pilot, then in aggregate only |
| Website security, logs, abuse prevention | Art. 6(1)(f) — legitimate interest | server logs up to 30 days |
| Video monitoring of the facility's exterior zones | Art. 6(1)(f) — safety of people and property | 30 days, longer only as evidence in proceedings |
| Remembering the language, maintaining the session, password access to wzmocnia.org | Art. 6(1)(f); storage on the device under Art. 399(3) of the Polish Electronic Communications Law (necessary for the service you request) | language 12 months; session until sign-out, at most 400 days; wzmocnia.org access 30 days |
| Information about new programmes and locations by e-mail | Art. 6(1)(a) — consent given in a separate field, also within the meaning of Art. 398 of the Electronic Communications Law | until consent is withdrawn (link in every message) |
Providing the data marked as required is a condition of creating an Account, making a purchase or placing an order; without them we cannot conclude a contract. Providing data in optional fields (for example remarks) and taking part in the survey are voluntary. Invoice data are required by tax law.
We do not ask for health data and ask you not to include them in messages to us. The three survey questions in the pilot concern perceived overload, ability to focus and clarity of thinking, on a self-assessment scale; they are voluntary, saved under a Code without a name, and do not serve to draw conclusions about health or to assess a person. We have carried out a data protection impact assessment for the processing of pilot participants' data.
§ 4. Pilot participants — data the employer does not see
The employer provides NIHILI with a list of phone numbers or e-mail addresses of people invited to the pilot. The employer is the controller of these contacts and informs the employees of their transfer before sending the list; NIHILI processes them solely to send Codes, under the entrustment described in § 10(9) of the Terms. The first message with the Code contains a link to this policy — that is our information under Article 14 GDPR.
From the moment a Code is used, NIHILI is the controller of the data saved under the Code: the entry log and survey answers. These are pseudonymised data: after the pilot ends the Code is not stored together with the number or address, and NIHILI returns no information about individuals to the employer — who activated a Code, who entered the Room and when, what anyone answered.
The report for the employer contains aggregate data only (use of the pool, number of entries and returns, distribution of answers). Breakdowns are shown when they cover at least 8 people, and the report contains no entry times or breakdowns by department, position or date that would allow a person to be recognised. There is no export of individual data from the system. Participation is voluntary and has no effect on employment.
§ 5. Recipients of data and public sources
| Recipient | Role | Scope |
|---|---|---|
| Supabase, Inc. (database and authentication; servers in the European Union region, Frankfurt) | processor | accounts and sign-in data, pilot orders, reservations, tickets, Codes, playback history, surveys under a Code |
| Vercel, Inc. (website hosting; servers in the EU and USA) | processor | server logs, IP addresses, content of form requests (processed transiently while handling the request) |
| BunnyWay d.o.o. (Bunny.net; content delivery network, Slovenia) | processor | images are fetched by our server, so Bunny does not see your IP address; audio programmes are streamed directly to your browser, so Bunny sees the IP address in delivery logs |
| Stripe Payments Europe, Ltd. (Ireland) — online payments, including the deposit for blocks | separate controller | payment data; NIHILI does not see card data |
| PILOT P.S.A. (Poland) — holder of the Stripe account to which, until further notice, the deposit paid online is credited | accepts the deposit in the name and on behalf of NIHILI | amount and date of payment, order number, payer's e-mail address |
| Providers of e-mail and SMS delivery services | processor | phone numbers and e-mail addresses for sending Codes, confirmations and messages |
| Site Host (hotel) | separate controller | dates and Codes needed to admit you to the facility; for blocks at its facility — the reservation record (organisation, date, set-up location, remarks, status); no survey data |
| Coordinator and the other Employers in a group purchase | separate controllers | organisation and billing data from the order, session schedule, payment status; no Codes, entries or surveys of other Employers' employees |
| Accounting firm, legal advisers, insurer | processor or separate controller | invoice data, correspondence in disputes and claims |
| Public authorities | separate controller | where required by law |
NIHILI concludes a data processing agreement with every processor. We do not sell data and do not share them for third-party advertising.
Public source: when you enter a tax ID in the pilot order form and choose “Search”, our server sends the tax ID to the public VAT Taxpayer Register of the Ministry of Finance (wl-api.mf.gov.pl) and retrieves the entity's name and address, which you can correct before sending. The register's response is kept in the server cache for up to 24 hours; only what you send in the order reaches our database. When you choose “Fetch from KRS”, our server asks that register for the entity's KRS number, and the open API of the National Court Register of the Ministry of Justice (api-krs.ms.gov.pl) for the body authorised to represent the entity, the rule of representation and the composition of the body; in that API the register provides masked first names and surnames, so you enter them yourself. The register's response is kept in the server cache for up to one hour. In the facility specification form (in Polish) the “Pobierz dane” button works the same way, but nothing reaches our database — the form ends with a printout or a PDF in your browser. Address suggestions for the delivery location in that form are fetched by our server: it sends the fragments of the town and street names and the number you type to the public Photon address search (photon.komoot.io; OpenStreetMap data) and to the geocoding service of the Polish Head Office of Geodesy and Cartography (services.gugik.gov.pl), and keeps their responses in the cache for up to 24 hours.
§ 6. Transfers outside the European Economic Area
The database and authentication operate in the European Union region (Frankfurt). The websites are hosted by Vercel in EU regions, and Stripe settles payments in Ireland. Providers established in the United States (Supabase, Inc. and Vercel, Inc.) may access data as part of technical support and maintenance; transfers take place on the basis of the European Commission's standard contractual clauses contained in the data processing agreements with these providers, and in the case of Vercel also on the basis of its certification under the Data Privacy Framework. A copy of the safeguards can be obtained by writing to the address in § 1.
§ 7. Your rights
- access to your data and a copy of them; rectification; erasure; restriction of processing; data portability (data processed on the basis of a contract or consent);
- objection to processing based on legitimate interest — on grounds relating to your particular situation; to commercial information — at any time;
- withdrawal of consent at any time, without affecting the lawfulness of processing before withdrawal;
- a complaint to the President of the Personal Data Protection Office (ul. Stanisława Moniuszki 1A, 00-014 Warsaw, uodo.gov.pl).
- A pilot participant may request deletion of the data saved under their Code by writing from the phone number or e-mail address to which the Code was sent — we do not ask for a name in that case.
We handle requests within one month. In complex cases we may extend this period by two months; we inform you of the extension and its reasons within one month of receiving the request. Erasure does not cover data we must keep to comply with a legal obligation (for example invoices) or to defend claims — in that case we restrict their processing to that purpose. Before handling a request we may ask you to confirm your identity in a proportionate way, for example by sending the request from the e-mail address assigned to the Account.
§ 8. Data requests, evidence of consents and data contact
For every contract we record the date, language and version of the Terms you accepted, and the content and date of consents (for example consent to start playback before the withdrawal period expires). On request we provide these data together with a copy of the confirmation sent by e-mail.
We accept data requests by e-mail at mail@wzmocnia.com and by post at the registered office. A person whose data were provided by an employer may contact us directly; if the request concerns contacts for which we are a processor, we forward it to the employer and inform the requester.
§ 9. Cookies and similar tools
The websites use only cookies necessary to provide the service you request (sign-in, language choice, password access) — storing and reading such information does not require consent (Article 399(3) of the Electronic Communications Law). We do not use analytics or advertising cookies or third-party tracking tools, so we do not display a consent banner. If this changes, we will ask for consent before enabling such tools.
| Name | Purpose | Duration |
|---|---|---|
| wzmocnia-jezyk | remembering the chosen language (pl/en) | 12 months |
| sb-<project>-auth-token (may be split into parts .0, .1) | maintaining the signed-in session on wzmocnia.com and wzmocnia.pl; contains the session token refreshed on activity | until sign-out, at most 400 days |
| sb-<project>-auth-token-code-verifier | secure completion of sign-in with a one-time link (PKCE) | a few minutes, until sign-in is completed |
| wzmocnia-org-dostep | password access to wzmocnia.org (a hash of the password, not the password) | 30 days |
Cookies can be deleted in the browser settings; without the necessary cookies it is not possible to sign in or open wzmocnia.org. The websites set no other cookies, including technical cookies of the translation library.
§ 10. Security
Data are encrypted in transit (TLS) and at rest at our providers. Only individually authorised persons have access to production data, to the extent needed for their tasks, with two-factor authentication. Data of different organisations are isolated from each other at database level (row-level access policies). Passwords are stored as hashes. Database backups are kept for 30 days in the same region. In the event of a personal data breach likely to result in a high risk to your rights, we will inform you without undue delay; we report breaches to the President of the Personal Data Protection Office within 72 hours of becoming aware of them, unless the breach is unlikely to result in a risk to people's rights.
§ 11. Automated decisions, profiling, children
We do not make decisions about you based solely on automated processing which would produce legal effects or similarly significantly affect you, and we do not profile users. The website's automated actions are limited to checking the availability of dates and the correctness of form data. We do not direct services to persons under 18 and do not knowingly process their data; if we learn of such an Account, we will delete it.
§ 12. Changes to this policy
We update the policy when the law, providers or the scope of services change. The current version is always available in the footer of every page of the websites, and its number and date are stated at the beginning of the document; earlier versions are available on request. We inform Account holders of significant changes by e-mail.
This document is available in Polish and English. A contract is concluded in the language in which the Customer used the website, and the Customer may rely on it in that language; the Polish version resolves only doubts about the meaning of the translation and never to the Consumer's detriment.