Privacy Policy

The data controller is Atium Sp. z o.o., registered at: ul. Franciszka Rakoczego 9/55, 80-288 Gdańsk, Poland. Tax ID (NIP): 957-119-17-07, Court Registry (KRS): 0001189153, Statistical ID (REGON): 542471493. Contact: kontakt@urbgames.com, phone: +48 505 910 707.

Personal data is processed for the following purposes: a) Handling contact inquiries — based on Art. 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract) and Art. 6(1)(f) GDPR (legitimate interest of the controller). b) Processing bookings and selling tickets/vouchers — based on Art. 6(1)(b) GDPR (performance of a contract). c) Preparing corporate and school event offers — based on Art. 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract). d) Web analytics — based on Art. 6(1)(a) GDPR (user consent given via the cookie banner). e) Marketing and remarketing — based on Art. 6(1)(a) GDPR (user consent). f) Fulfilling legal obligations (accounting, taxes) — based on Art. 6(1)(c) GDPR.

Personal data is stored for the following periods: a) Contact form data — 12 months from the date of last contact, or until consent is withdrawn. b) Transaction data (bookings, purchases) — 5 years from the end of the tax year in which the transaction took place, in accordance with tax law requirements. c) Configurator offer data — 6 months from the date the offer was generated. d) Analytics data (cookies) — in accordance with the retention periods of individual cookies described in the Cookie Policy. e) Marketing data — until consent is withdrawn.

Personal data may be shared with the following categories of recipients: a) Stripe, Inc. (USA) — online payment processing (credit cards, BLIK, Przelewy24). Stripe acts as an independent data controller for payment processing. Data transfers to the USA are based on Standard Contractual Clauses (SCCs). Stripe privacy policy: https://stripe.com/privacy b) Resend, Inc. (USA) — transactional email delivery (booking confirmations, inquiry responses). Data transfers to the USA are based on Standard Contractual Clauses (SCCs). Resend privacy policy: https://resend.com/legal/privacy-policy c) Vercel, Inc. (USA) — website hosting. Data processed as part of hosting services. Data transfers to the USA are based on Standard Contractual Clauses (SCCs). d) Google LLC (USA) — analytics services (Google Analytics 4) and maps (Google Maps), only with user consent. Data transfers to the USA are based on Standard Contractual Clauses (SCCs). e) Hotjar Ltd (Malta/EU) — user behavior analytics on the website, only with user consent. f) Meta Platforms, Inc. (USA) — Facebook Pixel for marketing purposes, only with user consent. Data transfers to the USA are based on Standard Contractual Clauses (SCCs).

Under GDPR (Articles 15-22), you have the following rights: a) Right of access to your personal data (Art. 15 GDPR). b) Right to rectification (Art. 16 GDPR). c) Right to erasure — "right to be forgotten" (Art. 17 GDPR). d) Right to restriction of processing (Art. 18 GDPR). e) Right to data portability (Art. 20 GDPR). f) Right to object to processing (Art. 21 GDPR). g) Right to withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR). To exercise any of these rights, please contact us at: kontakt@urbgames.com or by post to our registered address. You also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, https://uodo.gov.pl

Due to the use of data processors based in the USA (Stripe, Resend, Vercel, Google, Meta), personal data may be transferred to the United States. Data transfers are carried out on the basis of Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of personal data protection.

Providing personal data is voluntary but necessary to: - send an inquiry via the contact form, - make a booking or purchase a ticket/voucher, - generate an offer using the configurator. Failure to provide the required data will prevent us from providing the above services.

The controller does not make automated decisions, including profiling, within the meaning of Art. 22 GDPR.