Your data in Akademia GTR
Privacy Policy
Version dated 29 October 2026.
1. Data controller
The controller of your personal data is GTR ENGINEERING Spółka z ograniczoną odpowiedzialnością, ul. Obrońców Westerplatte 11, 09-400 Płock, Poland, VAT ID PL7743275034, KRS 0001014987, REGON 524255214.
Privacy contact: office@gtr-engineering.com, phone +48 577 661 005.
2. Data we process
Depending on how you use the Academy, we may process:
- your name, email address and optional phone number,
- Account data and information about access to training,
- order data, selected training date, payment plan, balance status and purchase history,
- discount-code and partner-source data assigned to an order, without disclosing the buyer’s identity in the partner’s monthly report,
- optional invoice details: company name, VAT or tax ID and address,
- Participant data supplied by a company or another buyer: name, email, assigned training and invitation or access status,
- training enquiry data: selected course, number of participants, contact details, company, tax ID and message,
- course progress, test results and certificate data,
- technical data required for security and operation, including IP address, event time and session identifier,
- the traffic source stored with an order (UTM campaign parameters, ad click identifier, landing page and referring domain) and, after consent, analytics and marketing cookie identifiers together with information about pages visited and purchases,
- transactional email delivery, bounce and complaint events recorded to keep messages reliable and prevent repeated delivery to invalid addresses.
3. Purposes and legal bases
| Purpose | Legal basis | Scope |
|---|---|---|
| Account, order and training access | performance of a contract, GDPR Article 6(1)(b) | identity, contact, order and progress data |
| Online payment | performance of a contract, GDPR Article 6(1)(b) | name, email, amount and order identifier |
| Balance payments and payment reminders | performance of a contract, GDPR Article 6(1)(b) | email, training, date, amount, link and payment status |
| Invoices and accounting | legal obligation, GDPR Article 6(1)(c) | billing and sales records |
| Company Seat purchase, Participant invitation and training access | performance of a contract, GDPR Article 6(1)(b), and for Participant data supplied by the buyer, legitimate interests in organising and delivering training, Article 6(1)(f) | name, email, assigned training, invitation and access status |
| Response to a training or date enquiry | steps before entering into a contract, GDPR Article 6(1)(b), or legitimate interests in handling correspondence, Article 6(1)(f) | contact data, training, participant count and message |
| Public certificate verification: anyone who knows a certificate number can check its authenticity on the verification page | legitimate interests in enabling confirmation that a certificate is genuine, GDPR Article 6(1)(f) | holder’s name, course title, issue date and certificate number |
| Complaints, security and legal claims | legitimate interests, GDPR Article 6(1)(f) | correspondence, technical data and event history |
| Protecting course materials: the Account email address is shown on videos being played and an Account can be signed in on one device at a time | legitimate interests in protecting copyright in the materials, GDPR Article 6(1)(f) | email address, session data and the number of sign-outs caused by another device |
| Discount settlement and partner-source reporting | performance of the order and legitimate interests in correct settlement and fraud prevention, GDPR Article 6(1)(b) and (f) | code, order status, seat count, refund status and commission amount; the partner report excludes names, email addresses and phone numbers |
| Website visit and purchase statistics (Google Analytics 4) | consent, GDPR Article 6(1)(a) | cookie identifiers, pages visited, approximate location, device and browser, traffic source and purchase events (course, amount, order number) |
| Measuring the effectiveness of ads on Meta services (Facebook, Instagram) and ad matching (Meta Pixel) | consent, GDPR Article 6(1)(a) | cookie and device identifiers, pages visited and purchase events (course, amount, order number) |
| Recording the source of an order (for example a campaign or partner link) from website address parameters | legitimate interests in assessing the effectiveness of sales activities, GDPR Article 6(1)(f) | UTM parameters, ad click identifiers (gclid, fbclid), landing page and referring domain, stored with the order |
A purchase does not require consent to analytics or marketing cookies. You give or refuse that consent in the cookie banner and can change or withdraw it at any time through the “Cookie settings” link in the page footer.
4. Data recipients
Data may be disclosed only to recipients required to operate the Academy under a contract or applicable law:
- LH.pl as hosting and email provider, including delivery of transactional messages, and technical maintenance providers,
- Krajowy Integrator Płatności S.A. as Tpay operator for PLN payments,
- Stripe entities involved in processing EUR payments, including Stripe Payments Europe Limited where applicable,
- Amazon Web Services EMEA SARL and its sub-processors for transactional email through Amazon SES,
- email, accounting and office-service providers,
- Slack Technologies as the GTR team communication tool, for handling sign-ups and enquiries (name, contact details, selected training, payment status); Slack may process data outside the EEA with the safeguards required by law,
- Google Ireland Limited (Google Analytics 4), only after analytics consent; Google may process data outside the EEA, including in the USA, with the safeguards required by law,
- Meta Platforms Ireland Limited (Meta Pixel), only after marketing consent; GTR Engineering and Meta are joint controllers for collecting and transmitting this data to Meta, and Meta processes it further as a separate controller under its own privacy policy; data may be processed outside the EEA with the safeguards required by law,
- accountants, legal advisers and authorised public authorities where required.
Tpay acts as a separate controller of Payer data for payment services and its regulatory duties. Depending on the processing activity, Stripe may act as a processor or a separate controller under its contractual terms. Their own privacy notices provide details. Stripe may process data outside the EEA using safeguards required by applicable data protection law.
For Polish invoice details, the Academy may query the public VAT taxpayer register operated by the Polish Ministry of Finance using the tax number entered by the buyer. The buyer can correct the returned details before ordering.
Where a company or another buyer provides Participant data, that buyer is the source of the name, email address and training assignment. The Participant receives this information and a link to this Policy with the invitation.
5. Retention periods
Account and access data are stored while the service is provided. Order, invoice and payment data are retained for periods required by tax and accounting law. Data needed for complaints or legal claims may be retained until the relevant limitation periods expire.
Participant data supplied by a company are retained while the invitation is handled and, after acceptance, while training is provided. A Seat invitation link is valid for 7 days. When an unaccepted invitation expires, the Participant’s name, email and stored token are automatically removed from the Seat. The buyer may withdraw an assignment earlier.
Training enquiry data are retained while responding, preparing an offer and conducting related discussions. If no contract is concluded, identifying data are deleted or anonymised no later than 12 months after the enquiry is closed. Closed enquiries are reviewed monthly. Data required for an ongoing complaint or legal claim may be retained until that matter or the relevant limitation period ends.
Inactive technical data and activation tokens are removed or invalidated when no longer required. Account setup links have a limited validity period.
6. Your rights
Subject to the GDPR, you may request access, a copy, rectification, erasure, restriction, data portability or object to processing.
Where processing relies on consent, you may withdraw that consent at any time without affecting prior lawful processing.
You may also lodge a complaint with the President of the Polish Personal Data Protection Office or the competent supervisory authority in your country. We may ask for information needed to verify the identity of a person making a request and normally respond within one month, subject to the GDPR.
7. Whether providing data is required
Name and email are required to conclude and perform the contract. Without them, we cannot match payment, send confirmation or provide training. Company purchases require company details and the Participant’s name and email to assign a Seat and send an invitation. A phone number is required in the training enquiry form to arrange the scope and date, while company details remain optional. For an individual purchase, the phone number is optional and company details are required only for a company invoice.
8. Cookies and external technologies
The Academy uses an essential session cookie to maintain the cart, sign-in state and form security. Purchasing and Account functions would not work correctly without it.
With your consent the Academy also uses analytics cookies from Google Analytics 4 (for example _ga and _ga_*, stored for up to 2 years) to measure visits and purchases, and marketing cookies from Meta Pixel (for example _fbp, stored for up to 90 days) to measure the effectiveness of ads. Without consent these scripts are not loaded. Your choice is saved in your browser’s local storage. You can change or withdraw consent at any time through “Cookie settings” in the page footer; withdrawal does not affect the lawfulness of earlier processing. Data in Google Analytics is kept for up to 14 months.
When the Customer continues to Tpay or Stripe, that provider operates its own website and may use cookies under its own notice. The Academy does not read payment-provider cookies set on the provider’s domain.
9. Security and automated decisions
We apply safeguards appropriate to the risk, including encrypted connections, access control, one-time tokens, form protection and data minimisation.
Balance reminders are sent automatically based on the training date and payment status. The mechanism does not decide whether an order is cancelled or whether a Participant may attend.
Your data are not used for solely automated decisions that produce legal or similarly significant effects.
10. Contact and updates
Send privacy questions and requests to office@gtr-engineering.com. This Policy may be updated when Academy functions, providers or legal requirements change. The current version will always be available on this page.