Privacy policy and GDPR

1. Personal data controller

The controller of your personal data is the Polish Chamber of Exhibition Industry (PCEI), with its registered office in Poznań.

2. Definitions

For the purposes of this Privacy Policy, the following definitions shall apply:

• GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
• Personal data – any information relating to an identified or identifiable natural person.
• Processing – an operation or set of operations performed on personal data, such as collecting, recording, organizing, storing, adapting, retrieving, consulting, using, disclosing, deleting, or destroying.
• Website – the website available at polfair.pl and its subpages.
• User – any natural person visiting the Website or using services provided through the Website.
• Cookies – text files stored on the User’s device for the purpose of identifying the browser during a subsequent visit to the Website.

3. Legal bases for processing

Personal data is processed on the following legal bases:

• Article 6(1)(a) GDPR – consent of the data subject (e.g., consent to receive a newsletter, consent to analytical and marketing cookies).
• Article 6(1)(b) GDPR – necessity for the performance of a contract or for taking steps at the request of the data subject prior to entering into a contract (e.g., handling the PCEI membership process).
• Article 6(1)(c) GDPR – necessity for compliance with a legal obligation to which the Controller is subject (e.g., tax and accounting obligations).
• Article 6(1)(f) GDPR – legitimate interests pursued by the Controller (e.g., direct marketing of the Controller’s own services, pursuing claims, and ensuring the security of the Website).

4. Purposes of data processing

Your personal data may be processed for the following purposes:

5. Scope of data collected

Depending on how you use the Website, we may collect the following categories of data:

Data provided voluntarily

• First and family name
• Email address
• Telephone number
• Company name and position
• Correspondence address
• Content of the message submitted via the contact form

Data collected automatically

• IP address
• Browser type and version
• Operating system
• Screen resolution
• Referring page (referrer)
• Time of visit and pages visited
• Data from cookies (in accordance with the consent given)

6. Cookies

The Website uses cookies – small text files stored on the User’s device. We use cookies for the following purposes:

Types of cookies used

Cookie management

Upon the first visit to the Website, a banner informing the User about the use of cookies is displayed. The User may:

• Accept all cookies
• Reject optional cookies
• Customize settings by selecting specific cookie categories

You can change your cookie preferences at any time:

Managing cookies in your browser

Regardless of the settings available on the Website, you can manage cookies directly in your web browser. Every browser allows you to block, delete, or restrict cookies through its settings. Please note that disabling necessary cookies may affect the proper functioning of the Website.

7. Data recipients

Your personal data may be disclosed to the following categories of recipients:

• IT service providers – companies providing hosting, email servers, CMS systems, and analytics tools.
• Analytics service providers – e.g., Google LLC (Google Analytics), solely after consent has been given for analytics cookies.
• Marketing service providers – mailing platforms and campaign management tools, solely after consent has been given.
• Public authorities – on the basis of applicable law and in response to a justified request from authorized authorities.
• PCEI partners – cooperating organizations (e.g., UFI, CENTREX), solely to the extent necessary to carry out joint projects and where an appropriate legal basis has been established.

The Controller does not transfer personal data to third countries (outside the European Economic Area), unless this is necessary for the provision of services (e.g., Google Analytics) and is carried out on the basis of appropriate safeguards provided for under the GDPR (standard contractual clauses or adequacy decisions).

8. Data retention period

Personal data is retained for the period necessary to fulfil the purposes for which it was collected:

9. Rights of data subjects

Under the GDPR, you have the following rights:

• Right of access (Article 15 GDPR) – you may obtain information about whether and what personal data we process about you, and receive a copy of such data.
• Right to rectification (Article 16 GDPR) – you may request the correction of inaccurate data or the completion of incomplete data.
• Right to erasure (Article 17 GDPR) – you may request the deletion of your data where there are no grounds for further processing ("right to be forgotten").
• Right to restriction of processing (Article 18 GDPR) – you may request the restriction of data processing in certain circumstances.
• Right to data portability (Article 20 GDPR) – you may receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object (Article 21 GDPR) – you may object to the processing of your data where such processing is based on the Controller’s legitimate interests.
• Right to withdraw consent – you may withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal of consent.
• Right to lodge a complaint – you have the right to lodge a complaint with the supervisory authority, i.e., the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

10. Data security

The Controller implements appropriate technical and organizational measures to ensure the security of processed personal data, including:

• Encryption of data transmission (HTTPS / SSL protocol)
• Regular backups
• Access control for IT systems
• Employee training in personal data protection
• Use of up-to-date software security measures

11. Changes to the privacy policy

The Controller reserves the right to make changes to this Privacy Policy. Users will be informed of significant changes through an appropriate notice published on the Website.

This Privacy Policy has been effective since 11 February 2025.

We recommend reviewing the Privacy Policy regularly.

12. GDPR contact information

If you have any questions regarding the processing of your personal data or the exercise of your rights, please contact us: