Privacy policy

This is an English translation for information purposes. In case of any discrepancy, the Polish version prevails.

Data controller
The controller of your personal data is Custom-Made Monika Sarapa, a sole proprietorship operating as „Custom-Made”, NIP (tax ID) 8212478006, REGON 363901785, registered in Warsaw (address: ul. Ogińskiego 11/9).
Contact: e-mail: [email protected], phone: (+48) 721 142 488.

Scope and purposes of processing
The controller processes the personal data of individuals in connection with its training activities: language courses for companies and their employees, language and culture workshops, training for individuals under the Development Services Database (BUR), language classes for medical university students, as well as marketing and the recruitment of clients and participants. The purposes of processing include in particular:

  1. Performance of the training contract (e.g. running the course, scheduling, keeping records, issuing invoices) – legal basis: Art. 6(1)(b) GDPR (performance of a contract) and, where applicable, Art. 9(2)(h) if special categories of data are processed in connection with educational activities.
  2. Contact with clients and prospective participants (enquiries, forms) – legal basis: Art. 6(1)(b) (steps prior to entering into a contract) or Art. 6(1)(f) (the controller's legitimate interest – marketing), or Art. 6(1)(a) (consent) for newsletters and surveys.
  3. Marketing and promotion of services (e.g. newsletters, remarketing ads on Facebook/LinkedIn, analysis of user behaviour on the website) – legal basis: Art. 6(1)(f) GDPR (legitimate interest in promoting services) or Art. 6(1)(a) GDPR (consent), depending on the solution used.
  4. Compliance with legal obligations (e.g. archiving documents, accounting) – legal basis: Art. 6(1)(c) GDPR.
  5. Protection of the controller's rights (e.g. pursuing claims) – legal basis: Art. 6(1)(f) GDPR.

Categories of personal data
Depending on the type of cooperation, the controller may process the following categories of data:

  • Identification and contact data: first name and surname, maiden name (where applicable), e-mail address, phone number, job title, employer's name, company address.
  • Training data: language profile, course choice, language level, test materials and results, attendance, notes on engagement, image (photos/videos from classes) – if the participant has consented.
  • Payment and billing data: NIP/PESEL (where applicable), company/client, invoices, bank details.
  • Marketing and analytics data: IP address, cookie/pixel identifiers, data on behaviour on the website, server logs, referrer.
  • For medical university students or participants in BUR projects – student and university data, sometimes health status (if required) or other special categories of data – processed only on the basis of consent or to fulfil a legal obligation.

Recipients of data
Personal data may be disclosed to the following categories of recipients:

  • Subcontractors and service providers (e.g. e-learning platforms, IT and CRM providers) acting under a data processing agreement.
  • Payment, invoicing and accounting providers.
  • Analytics and advertising services (e.g. Facebook Inc., Meta Platforms, LinkedIn Corporation) for remarketing and advertising pixels.
  • Public authorities or courts, where required by law or in connection with pursuing claims.
    The controller does not transfer personal data outside the European Economic Area (EEA). Should a transfer outside the EEA become necessary, it will take place only with appropriate safeguards (e.g. standard contractual clauses).

Retention period
Personal data will be stored for:

  • Prospective clients/leads: up to 2 years from the last contact or until an objection is raised.
  • Business clients/billing: for the period required by tax and archiving regulations (e.g. 5 years), or longer if the contract so requires.
  • Course participants/lessons: 2 years from the end of the service or until an objection is raised, unless the contract or the law requires a longer period (e.g. for BUR projects).
  • Marketing data/cookies: until an objection is raised or 2 years from the last activity.
    Criteria for setting retention periods: archiving for billing purposes, limitation periods for claims, project requirements.

Rights of data subjects
Every data subject has the right at any time to:

  1. access their data and obtain a copy,
  2. rectify their data,
  3. erasure (the „right to be forgotten”), unless there is a legal basis for further processing,
  4. restrict processing,
  5. data portability (where processing is based on consent or a contract and is carried out by automated means),
  6. object to processing – in particular processing based on Art. 6(1)(f) (legitimate interest) and profiling,
  7. withdraw consent at any time (where processing is based on consent) – withdrawal does not affect the lawfulness of processing before it.
    To exercise these rights, contact us at [email protected] or by post at our registered address.

Cookies, advertising pixels and processing for marketing
The custommade.pl website uses cookies/identifiers and marketing tools, including the Facebook/Meta Platforms pixel and the LinkedIn Insight Tag, which enable: traffic analysis, remarketing (showing ads to people who have visited the website) and profiling for marketing purposes (creating user segments).
Types of cookies/identifiers used:

  • Necessary cookies (required for the website to work) – processed on the basis of the controller's legitimate interest;
  • Analytics cookies – collecting statistics on how the website is used (e.g. Google Analytics) – legal basis: Art. 6(1)(f);
  • Marketing cookies/pixels – enabling ads tailored to the user and the creation of audience profiles – legal basis: consent (Art. 6(1)(a)) or legitimate interest (Art. 6(1)(f)), depending on the consent mechanism in place.
    You can change your cookie settings at any time in your browser settings and use the consent/withdrawal mechanism available on the website. More information is available in the separate Cookie Policy.

Automated decision-making / profiling
The controller does not use automated decision-making within the meaning of Art. 22 GDPR or profiling that produces legal effects or similarly significantly affects data subjects – except for the advertising mechanisms (pixels) described above, which constitute profiling for marketing purposes. In such cases you have the right to object to profiling.

Data security
The controller uses appropriate technical and organisational measures to protect personal data – in particular: data backups, encryption of data in transit and at rest, restricted access to data, data processing agreements with subcontractors, internal security procedures, and regular reviews and audits. In the event of a personal data breach, the controller will notify the data subject and the competent supervisory authority (the President of the Personal Data Protection Office, UODO) as required by law.

Changes to this privacy policy
This privacy policy may be updated from time to time. We will announce the latest change on this page, stating the „last updated” date. Using the website after changes have been made means accepting the new version.

Last updated: 12 November 2025
Contact regarding personal data protection: [email protected].