Skip to content
TOO
About usWho we are, who leads us and how we work. Working groupsNine sectors, each with its own group. NewsTOO's work, law, calls and industry matters. ProjectsEvents, training and initiatives we run. ContactOffice, branches and the membership form. Training · free of charge Accessible Tourism 2026 Łódź · 21 October Join us

GDPR

INFORMATION ON THE PROCESSING OF PERSONAL DATA

Data controller

The data controller is Turystyczna Organizacja Otwarta (Open Tourism Organization) with its registered office in Warsaw, at ul. Tyniecka 12 lok. 11, 02-630 Warsaw, entered in the National Court Register (Krajowy Rejestr Sądowy) under KRS number 0000850798, NIP 5223186926, REGON 386592493 (hereinafter referred to as "TOO").

Contact details: e-mail: office@tooorganizacja.org,

Purposes and legal bases of data processing

TOO processes personal data only for specific purposes and on lawful bases. Personal data is processed when:

  1. It is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR).
  2. Processing is necessary for compliance with a legal obligation to which the Controller is subject, e.g. issuing invoices, fulfilling accounting obligations or archiving documents (Article 6(1)(c) GDPR).
  3. Processing is necessary for the purposes of the legitimate interests pursued by TOO, e.g. conducting correspondence, responding to inquiries, establishing or pursuing claims, or defending against claims (Article 6(1)(f) GDPR).
  4. Processing is based on the consent of the data subject, given for the processing of personal data for one or more specific purposes (Article 6(1)(a) GDPR). Consent may be withdrawn at any time.

Recipients of personal data

Personal data may be disclosed only to entities and authorities entitled to receive it under the law. In addition, data may be disclosed to entities processing data on behalf of TOO under appropriate data processing agreements (in accordance with Article 28 GDPR), e.g. IT service providers or hosting companies.

Personal data is not transferred to a third country or an international organization, unless this is required for technical or organizational reasons, in which case the transfer is carried out in accordance with the GDPR and with appropriate safeguards in place.

Data retention period

Personal data is stored for the time necessary to achieve the purpose for which it was collected, and for the period required by law (e.g. tax regulations) or until the limitation period for potential claims expires.

Rights of data subjects

Data subjects have the right to:

  • access their data and obtain a copy of it,
  • rectify data that is incorrect or out of date,
  • erase data ("right to be forgotten") in cases provided for by law,
  • restrict the processing of data in certain cases,
  • object to the processing of data where the legal basis for processing is the legitimate interest of TOO,
  • data portability, where processing is based on consent or a contract and is carried out by automated means,
  • lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO) if they consider that the processing of data infringes the law (UODO address: ul. Stawki 2, 00-193 Warsaw).

Data protection principles

TOO applies appropriate technical and organizational measures to protect the personal data it processes, in accordance with the requirements of the GDPR, so that the data is secure and protected against unauthorized access.

Contacting the data controller

In matters relating to the processing of personal data, you can contact TOO at the e-mail address: office@tooorganizacja.org or by post: Turystyczna Organizacja Otwarta, ul. Tyniecka 12 lok. 11, 02-630 Warsaw.

PDF
Klauzula informacyjna RODO
Pobierz