Privacy policy

In force from 7 October 2026 · Wersja polska

Contents: Controller · Browsing this website · E-mail · Families of people with an FBXO28 variant · Research Library form · Donations · Social media · Backups · Recipients · Transfers outside the EEA · Your rights · Other information

1. Who is the controller

The controller of your personal data is FBXO28 Research Foundation (the Foundation), registered office in Głowaczów, Mazowieckie Province, Poland, entered in the Polish National Court Register under KRS number 0001261586, NIP (tax ID) 8121931960, REGON 545569270. Our full registration details, including the address of the registered office, are public in the National Court Register.

For anything concerning personal data, please write to contact@fbxo28.org. The Foundation has not appointed a data protection officer because it is not required to (Art. 37 GDPR).

GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

2. Browsing this website

Cookies. This website does not store cookies on your device and does not use any other browser storage (such as localStorage). Cookies needed to sign in are used only in the administration panel, by the people who run the website.

No third-party services. We do not use analytics (such as Google Analytics), advertising tools or social media plug-ins. Fonts and images are served from our own server, so opening a page does not connect your browser to any other company. Links to YouTube, Facebook, LinkedIn, pomagam.pl or publication databases are ordinary links: only when you click one do you go to another service, which applies its own privacy rules.

Server logs. The server that hosts this website (our hosting provider, LH.pl) automatically records technical data about each request in its logs: IP address, date and time, the page requested, the referring page, browser and operating system details, and the server response code. We need this to keep the website secure and working, to detect abuse and to fix errors; the legal basis is our legitimate interest in the secure operation of the website (Art. 6(1)(f) GDPR). The hosting provider keeps the logs for a limited period set by its server configuration and then deletes them. We do not combine logs with other data or use them to identify visitors, unless this is necessary to investigate an attack or abuse — in that case we keep the relevant part until the matter is closed.

3. E-mail

When you e-mail us (for example at contact@fbxo28.org), we process your e-mail address, your name if you give it, the content of your message and any attachments, and our reply.

• Purpose and legal basis: replying to you and keeping our correspondence — our legitimate interest (Art. 6(1)(f) GDPR); where the correspondence concerns entering into or performing an agreement (for example on collaboration, sponsorship or a restricted donation) — Art. 6(1)(b) GDPR.
• Retention: up to 24 months after the last message on the matter. Longer only if the correspondence concerns an agreement or a donation (then for the period required by law, see section 6) or is needed to establish, exercise or defend legal claims.
• Where messages are kept: the Foundation’s mailboxes run on LH.pl servers. The President of the Management Board also reads and handles the Foundation’s correspondence through Gmail (Google), so copies of messages are kept in that service as well (see sections 9 and 10).

4. Families of people with an FBXO28 variant

On our For families page we ask you to give only your name, your country and how to reach you in your first message — nothing medical. Health information, including the mere fact that someone in your family has an FBXO28 variant, is a special category of personal data (Art. 9 GDPR).

• We process it only on the basis of your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR), only to the extent you choose to share it, and only to reply to you and to stay in touch.
• On the For families page, a short window with a consent box appears before your e-mail opens. Consent is voluntary — you can also write without it. If you tick the box, a consent sentence with the date is added to your message, so your consent is recorded only in our correspondence; the website stores nothing.
• If a message contains health information without such consent, we will ask you to confirm consent in our reply. Until then we use it only to reply. If we do not receive your consent within 3 months of our reply, we will delete the messages that contain it.
• You can withdraw your consent at any time by writing to contact@fbxo28.org. Withdrawal does not affect the lawfulness of processing carried out before it.
• We keep this information until you withdraw consent or our contact ends. We never pass it to anyone, including research partners, without your separate, explicit consent to that specific transfer.

We accept information about a child only from the child’s parents or legal guardians.

5. “Suggest a resource” form in the Research Library

The form in the Research Library asks for the type of resource, a link, a title or description, why it belongs there, an optional file (PDF, DOC or DOCX up to 10 MB) and, optionally, your name and e-mail address.

• The form does not store anything on the website. Your suggestion is sent by e-mail to contact@fbxo28.org together with the file, and the file is deleted from the web server straight away. From then on, section 3 applies.
• Purpose and legal basis: reviewing your suggestion and, if you leave an e-mail address, replying; our legitimate interest in maintaining the library (Art. 6(1)(f) GDPR).
• Retention: up to 24 months. If a resource is added to the library, we publish the resource itself, never the details of the person who suggested it, unless they agree.
• Spam protection uses a hidden field checked on our own server — no reCAPTCHA and no third-party service.

6. Donations

Bank transfer to the Foundation’s account

From our bank statement (BNP Paribas Bank Polska S.A.) we receive the donor’s name, their address if the bank passes it on, the account number, the amount, and the date and reference of the transfer.

Fundraiser on pomagam.pl

The Foundation is the organiser of the fundraiser on pomagam.pl. The platform is run by Crowding sp. z o.o., Warsaw, which is a separate controller of donors’ data (see the pomagam.pl privacy policy, in Polish). As the organiser, we receive from pomagam.pl and its payment operator the donor’s first name, surname and e-mail address, the amount, and the transaction identifier and number.

Rules for all donations

• Purpose and legal basis: recording the donation and settling the fundraiser under the Polish Accounting Act and tax law (Art. 6(1)(c) GDPR); answering questions about a donation, thanking donors, and establishing, exercising or defending legal claims — our legitimate interest (Art. 6(1)(f) GDPR).
• Retention: accounting records are kept for 5 years from the beginning of the year following the financial year in which we received the donation (Art. 74 of the Polish Accounting Act), and longer only where tax law requires it.
• We do not publish donors’ names without their consent, we do not add donors to mailing lists, and we do not e-mail them asking for further donations.

7. Social media

The Foundation runs these profiles: Kierunek: lek on Facebook, @kierunek.lek on Instagram and FBXO28 Research Foundation on LinkedIn. This website does not embed content from these services — it only links to them.

• When you follow our profiles, react, comment or message us, we process the data visible to us on that service: your profile name and picture and the content of your comments and messages. Purpose: running the profiles, informing people about the Foundation’s work and answering messages. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
• This data stays on the service until you or we delete it; how long the operator keeps it is governed by the operator’s own rules.
• The operators — Meta Platforms Ireland Limited (Facebook, Instagram) and LinkedIn Ireland Unlimited Company — process data under their own policies: Meta Privacy Policy, LinkedIn Privacy Policy.
• These services give us aggregated statistics about visits to our profiles. For the statistics of our Facebook Page and LinkedIn Page we are joint controllers with the operator (Art. 26 GDPR); the operator takes on most of the obligations, including handling your rights — see Meta’s Page Insights information and the LinkedIn Page Insights Joint Controller Addendum. You may also exercise your rights with us.

8. Backups and security

Backups of the website (its content, settings and the accounts of the two people who run it) are made automatically and stored in Google Drive: a database backup every day (we keep the latest 14) and a file backup every week (we keep the latest 4). Backups contain no form submissions, because the website does not store them. Connections to the website are encrypted (HTTPS), and only the people who run the website on the Foundation’s behalf have access to the administration panel.

9. Recipients

• LH.pl sp. z o.o., Poznań — website hosting, e-mail and server logs;
• Google (Google Ireland Limited and, for transfers to the US, Google LLC) — e-mail (Gmail) and website backups (Google Privacy Policy);
• BNP Paribas Bank Polska S.A. — the Foundation’s bank account; the bank is a separate controller of transfer data;
• Crowding sp. z o.o. (pomagam.pl) — donations to the fundraiser; a separate controller;
• Meta Platforms Ireland Limited and LinkedIn Ireland Unlimited Company — for our social media profiles;
• the people or firm keeping the Foundation’s accounts, and legal or tax advisers if we use them — all bound by confidentiality;
• public authorities where the law requires.

We do not sell personal data and do not share it with anyone for marketing.

10. Transfers outside the European Economic Area

LH.pl, our hosting and e-mail provider, does not transfer data outside the European Economic Area. The bank and pomagam.pl, as separate controllers, apply their own rules, described in their privacy policies. Google, Meta and LinkedIn may also process data in the United States. Such transfers are based on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection under the EU-US Data Privacy Framework, in which these companies participate, and additionally on standard contractual clauses approved by the European Commission. List of participants: dataprivacyframework.gov.

11. Your rights

You have the right to:

• access your data and receive a copy (Art. 15 GDPR),
• rectification (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20) — where we process data on the basis of consent or a contract,
• object to processing based on our legitimate interest (Art. 21),
• withdraw consent at any time, without affecting the lawfulness of earlier processing (Art. 7(3)),
• lodge a complaint with the Polish supervisory authority, Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa (uodo.gov.pl), or with the supervisory authority where you live or work.

Just write to contact@fbxo28.org. We reply without undue delay and within one month at the latest; for complex requests this may be extended by two further months, and we will tell you if so. Exercising your rights is free of charge. We may ask for information needed to confirm your identity. We cannot delete donation accounting records before the period required by law has passed.

12. Other information

• Voluntary. Giving us data is voluntary. Without an e-mail address we cannot reply to your message or to a library suggestion. Donation data reach us from the bank or pomagam.pl, and processing them for accounting is required by law.
• No profiling. We make no automated decisions and do no profiling (Art. 22 GDPR).
• Children. This website is not directed at children.
• Changes. We update this policy whenever the way we process data changes, for example when we add a new tool or form. The current version is always on this page, dated at the top; earlier versions are available on request.
• Language. This policy is also published in Polish. If the two versions differ, the Polish version prevails.