Privacy policy

What data we collect

When you submit an event through the form, we process:

• the content of the submission (name, description, date and place of the event),
• your contact email address,
• a hashed (irreversible) fingerprint of your IP address — solely to limit abuse and spam; we do not store your IP address in plain form,
• a record of the consent given and the version of this policy,
• the text of the licence granted for publishing the event description.

When you submit a witacz photo, we additionally process:

• the uploaded photo and the information provided with it (village, year, description),
• the full name (or nickname) of the photo’s author — published next to the photo,
• your email address — used to confirm the submission (verification link) and for possible contact; it is not published,
• the text of the licence granted for publishing the photo and description.

When you write to us through the contact form, we process:

• the name you give us, your email address, the subject and the message,
• the photo you attach, if you choose to attach one,
• a hashed (irreversible) fingerprint of your IP address — solely to limit abuse and spam.

The content of your message (subject, text, attachment) is not stored in the Service database — it is delivered to our mailbox and kept there only for as long as handling the matter requires. What stays in the database is a technical record of the consent given: the sender’s email address, the hashed IP address, browser information and the version of this policy — which we need to demonstrate consent and to limit spam.

When you vote in the Witacz of the Year contest, we process:

• an irreversible fingerprint of your email address — it keeps one mailbox to one vote per witacz; the address itself is never stored in our database,
• an irreversible fingerprint of your IP address — solely to limit abuse.

That is all. The form asks you to tick that you know the contest rules, but the tick itself is never recorded.

You give us the address so that we can send a confirmation link to it. The link opens a page with a button, and only pressing that button counts the vote — opening the link alone changes nothing, because mail scanners visit links in messages automatically. The message goes out through Brevo (see below), and all that stays with us is the fingerprint. The link is valid for 48 hours; after that the vote can no longer be confirmed, and we delete its record when we clean up the database. We use the address for that one message and nothing else, and we never add it to any mailing list.

If you win a contest prize, we ask you for a postal address. You send it to us by email after the results are announced, and it stays in our mailbox only — it never reaches the Service database. We keep it until the parcel is delivered and then delete the correspondence containing it. We use the address for that one parcel and nothing else, and we never pass it on to the funders of the prizes: we send the parcels ourselves, as the contest terms promise.

When you leave your address asking for a reminder before contest submissions close, we process your email address, an irreversible fingerprint of your IP address and a record of your consent together with the version of this policy. This time we store the address itself, because we are going to write to it; a fingerprint cannot receive mail. First we send a request to confirm it: without a click on that link we delete the entry after 7 days. A confirmed address serves one message, sent before submissions close, and we delete it once the contest is over. You can unsubscribe using the link at the foot of either message — it deletes the address at once and leaves it on no suppression list.

The witacz submission form and the contact form are protected by the Cloudflare Turnstile service, which distinguishes humans from bots. For this purpose Cloudflare may process technical data of your browser. We do this on the basis of our legitimate interest (protecting the Service against abuse).

Photo submissions not confirmed via the email link are removed during periodic clean-ups after 7 days, and submissions rejected by a moderator — after 30 days.

Purpose and legal basis

We process the data on the basis of your consent (Article 6(1)(a) GDPR) in order to consider your submission and possibly contact you about it, and on the basis of our legitimate interest (Article 6(1)(f) GDPR) in protecting the Service against abuse. The email address is not published. We publish only the approved event content.

Descriptions sent through the forms — the event description and the description attached to a witacz photo — are published under the licence you grant by ticking the declaration on the form. The licence is free of charge and non-exclusive: the text stays yours and you may use it wherever you like, while we get the right to show it on the Service. If you change your mind, write to us and we will remove the description.

Contest votes are counted on the basis of the consent you give when you accept the contest rules, and we process the email and IP fingerprints on the basis of our legitimate interest in keeping the vote fair.

We process an address left when asking for a reminder before submissions close solely on the basis of your consent (Article 6(1)(a) GDPR). You can withdraw that consent with the unsubscribe link at the foot of the message, or by writing to our contact address.

We process a prize delivery address under Article 6(1)(b) GDPR — to perform the contract that the contest terms constitute, since without the address we cannot deliver your prize.

Your rights

You have the right to access your data, to rectify or erase it, and to withdraw your consent at any time (without affecting the lawfulness of processing before its withdrawal). For these matters, write to us at the address below.

Cookies and analytics

We use cookies and similar technologies. We group them into categories:

• Necessary (functional) — required for the site to work, including remembering your consent choice (dozynki_consent) and your language choice after you click the PL/EN switcher (dozynki_lang, valid 365 days; and dozynki_lang_hint, valid 30 days — prevents repeating the automatic redirect on the home page). During the contest dozynki_glosujacy is added — it holds the same irreversible fingerprint of your email address that we keep in the database, together with a signature that protects that value from being swapped, so that further votes need no email confirmation. It expires when voting closes. No consent is needed.
• Analytics — Google Analytics and Vercel Analytics; used to build anonymous traffic statistics that help us improve the site. We load them only after you give consent.
• Marketing — currently unused; the category is reserved for future sponsored content.

You can give or withdraw consent to analytics and marketing cookies at any time using the “Cookie settings” option in the site footer. We store your choice in a cookie in your browser (we do not link it to your identity).

Recipients and processors

We use trusted providers that process data on our behalf only to the extent needed to run the site:

• Vercel — website hosting and Vercel Analytics (traffic statistics);
• Google — Google Analytics (traffic statistics, after consent);
• Cloudflare R2 — storage of the site’s image files;
• Brevo — sending emails (event and witacz submission confirmations, contest vote confirmation links); the address appears in Brevo’s delivery log, though only its fingerprint stays in our database;
• Neon — hosting of the site’s database.

Contact

For matters concerning personal data, contact us at kontakt@dozynki.org.pl.