Legal

Privacy policy of the Debesis ticketing system

Last updated: 23 September 2026

This is a translation provided for convenience. In case of any discrepancy, the Polish version of this document prevails.

This Privacy Policy describes matters related to the use of the website www.systemticketowy.pl (the “Portal”).

Our aim is to make you feel safe on our Portal, which is why your privacy and the protection of your data matter to us. Please read the summary below carefully to learn how our Portal works. We assure you that your data will be processed transparently and fairly, and that we will take every care to treat it responsibly.

This Privacy Policy is intended to inform you how we use your personal data, in respect of which we meet all the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”).

1. Controller

The controller of your personal data within the meaning of the GDPR is Debesis Sp. z o.o., ul. Geodetów 176, 05-500 Piaseczno, Poland (the “Controller”). On matters concerning the protection of personal data you may also contact the Controller at biuro@debesis.pl.

2. Purposes and legal bases of processing

Your personal data may be processed by the Controller on the basis of:

a) necessity for the performance of a contract or to take steps prior to entering into it (Article 6(1)(b) GDPR), separately for the purpose of:

providing the newsletter service;
using the contact forms;
providing access to materials related to the subject matter of the Portal;

b) consent (Article 6(1)(a) GDPR), for the purpose of marketing of entities cooperating with the Controller;

c) the legitimate interest of the Controller (Article 6(1)(f) GDPR), separately for the purpose of:

marketing of the Controller’s own products and services, including analytics and profiling, where the Controller’s legitimate interest is direct marketing of its own products and services. Profiling is intended to prepare an offer of Debesis Sp. z o.o. products that takes into account the preferences of Portal users;
using the contact forms made available by the Controller on the Portal, where the Controller’s legitimate interest is caring for Portal users and answering the questions they ask;
defence against potential claims, where the Controller’s legitimate interest is pursuing or defending claims.

3. Transfer of personal data

Data may be transferred to entities processing it on our instruction under agreements concluded with the Controller, but only for the purpose and to the extent necessary to achieve the purposes above, including entities providing IT services or other services ensuring the proper functioning of the Portal, whereby such entities process the data on the basis of an agreement with the Controller and only in accordance with our instructions. Recipients of the data may include, among others:

the hosting provider of the Portal;
Google Ireland Limited — in respect of the reCAPTCHA service, where the contact form is secured with it;
postal service operators — in respect of handling enquiries sent through the contact form.

A full list of current providers may be obtained on request sent to biuro@debesis.pl.

We transfer your data only to entities located within the European Economic Area and therefore subject to strict EU data protection rules, or bound by an adequate security standard. Transfers of data to third countries are not currently practised or planned by us.

4. Retention period

We process your personal data only for the period necessary to fulfil the purpose of storing it, or for as long as required of us by law — in particular until any claims become time-barred or the archiving obligation arising from legal provisions expires, including the obligation to retain accounting documents.

Where personal data is processed in order to provide the newsletter service, to use the contact forms and to provide access to materials related to the subject matter of the Portal, your personal data will be processed for the period necessary to provide that service, until you withdraw from it.

Where personal data is processed on the basis of your consent, your data will be stored until that consent is withdrawn. Consents given on the website may be withdrawn at any time, including consent to the processing of data for marketing purposes of entities cooperating with the Controller. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Where your data is processed on the basis of the Controller’s legitimate interest, the Controller will cease processing earlier if you effectively object to the processing.

5. Your rights

a) Right of access

You have the right to obtain information about the personal data we hold about you, including a copy of that data.

b) Right to rectification

You have the right to request rectification of personal data concerning you which is inaccurate. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by providing a supplementary statement.

c) Right to erasure

You have the right to request the erasure of your personal data stored by us in the following cases:

your personal data is no longer necessary for the purposes for which it was collected,
you have withdrawn the consent on which the processing is based and there is no other legal ground for the processing,
you have objected to the processing and there are no overriding legitimate grounds for the processing, or the objection concerns processing for direct marketing purposes,
the personal data has been processed unlawfully,
the personal data must be erased in order to comply with a legal obligation under Union or national law,
the personal data was collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

d) Right to data portability

You have the right to receive, in a structured, commonly used and machine-readable format, the personal data concerning you which you have provided to us, where the processing is based on consent or a contract and is carried out by automated means.

If you request that this data be transmitted to another controller, this will be done where technically feasible.

e) Right to restriction of processing

You have the right to request that the processing of your personal data be restricted in the following cases:

you contest the accuracy of the personal data — for a period enabling us to verify its accuracy,
the processing is unlawful and you oppose the erasure of the personal data, requesting the restriction of its use instead,
we no longer need the personal data for the purposes of the processing, but you need it for the establishment, exercise or defence of legal claims,
you have objected under Article 21(1) to the processing — pending verification whether the legitimate grounds of the controller override your grounds.

f) Right to object

Where your personal data is processed on the basis of the controller’s legitimate interest, you have the right to object at any time to the processing, in accordance with Article 21 GDPR.

g) Right to withdraw consent

You have the right to withdraw consent to the processing of personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

If you wish to exercise your rights, please send us a message at biuro@debesis.pl or by post to: 05-500 Piaseczno, ul. Geodetów 176, Poland.

The security of personal data is our priority; however, if you consider that we infringe the GDPR when processing your personal data, you have the right to lodge a complaint with the President of the Personal Data Protection Office (Poland).

6. Cookies

a) What cookies are and what they are for

Cookies are small text files saved on your device when you visit the Portal. They are sent by the website to your browser. Each cookie has an anonymous identifier and makes it possible to identify the device in whose memory it was saved for a given period (the time after which the cookie is deleted). Cookies are saved in order to recognise your device, learn your preferences and collect information about your earlier activity on the Portal.

b) How to manage cookies

The simplest way is the “Cookie settings” link in the footer, which opens the consent banner where you can switch individual categories on or off. Please note that if you do not consent to cookies, you will not be able to use some elements of the Portal in full — for example the personalisation features.

Remember to configure every browser on each of your devices (tablets, smartphones, computers). Browsers are configured in different ways, so please consult the “Help” section of the browser you use to learn how to configure it and what options are available.

Details of our cookies, their names and retention periods are set out in the cookie policy.

7. Changes to the Privacy Policy

In order to ensure that the Portal’s Privacy Policy meets the requirements imposed by law at all times, we reserve the right to amend it at any time. The same applies where the Privacy Policy requires changes in order to cover new or amended products or services of the Portal.