Privacy Policy

1. Data controller

The above entity is the data controller within the meaning of Regulation (EU) 2016/679 (GDPR) and the Polish Act on Personal Data Protection (Ustawa z dnia 10 maja 2018 r. o ochronie danych osobowych, Dz.U. 2018 poz. 1000).

For all privacy-related requests and questions, contact us at info.highrisktactics@gmail.com. We aim to respond within 30 days.

2. What data we collect

Inquiry forms and correspondence: name, e-mail address, phone number, country, training preferences, message content.

Course registrations: additionally, legal-status data required by Polish firearms range regulations (Ustawa z dnia 21 maja 1999 r. o broni i amunicji, Dz.U. 1999 Nr 53 poz. 549 with amendments), including any firearms permit details and identity documents you voluntarily submit.

Website cookies and analytics: see Section 7 (Cookies) below.

3. Purpose and legal basis

We process your personal data only for specific, lawful purposes:

• Art. 6(1)(b) GDPR — contract performance: processing your booking, communicating course details, issuing certificates, processing payments.
• Art. 6(1)(c) GDPR — legal obligation: compliance with Polish range and firearms regulations, tax and accounting obligations (retention up to 5 years per accounting law), and any requests from competent authorities.
• Art. 6(1)(a) GDPR — consent: sending training news and promotional updates by e-mail (newsletter). Consent can be withdrawn at any time by replying "UNSUBSCRIBE" or writing to info.highrisktactics@gmail.com.
• Art. 6(1)(f) GDPR — legitimate interests: responding to inquiries, improving course quality, fraud prevention. Our legitimate interests do not override your fundamental rights.

4. Retention

Inquiry and correspondence data: up to 24 months after the last contact, then deleted.

Course registration and training records: minimum 5 years from the course date, as required by Polish accounting law (Ustawa o rachunkowości) and regulations applicable to licensed range operators. Records relating to firearms handling may be retained for up to 10 years where required by applicable regulations.

Newsletter / consent records: until withdrawal of consent, plus 3 years thereafter for compliance purposes.

Cookie and analytics data: see Section 7.

5. Your rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): request a copy of the data we hold about you.
• Right to rectification (Art. 16): ask us to correct inaccurate data.
• Right to erasure (Art. 17): request deletion where data is no longer needed (subject to legal retention obligations).
• Right to restriction (Art. 18): ask us to restrict processing in certain circumstances.
• Right to portability (Art. 20): receive your data in a structured, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent (Art. 7(3)): where processing is based on consent, you may withdraw at any time without affecting the lawfulness of prior processing.

To exercise any right, send a written request to info.highrisktactics@gmail.com. We will respond within 30 days (extendable by 2 months for complex requests). The service is free of charge. We may ask you to verify your identity before processing the request.

If you believe your data is processed unlawfully, you may lodge a complaint with the Polish supervisory authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

6. Data sharing and processors

We do not sell or share your data for third-party marketing. Data may be shared with:

• Cloudflare, Inc. — website hosting, CDN, DDoS protection, and e-mail routing (data processed in EU/EEA under Standard Contractual Clauses).
• Resend, Inc. — transactional e-mail delivery. Data processed under a Data Processing Agreement (DPA).
• Competent authorities: Polish law enforcement, courts, or tax authorities, only when legally required.

All processors are bound by Data Processing Agreements ensuring compliance with GDPR Art. 28.

7. Cookies and tracking

This website uses cookies and similar tracking technologies. A consent banner is shown on your first visit — analytics and marketing cookies are activated only after you grant consent (GDPR Art. 6(1)(a)).

• Strictly necessary cookies: session management, GDPR consent record. No consent required.
• Analytics cookies (with consent): Google Analytics 4 — anonymised traffic statistics to improve the website. Retention: 14 months.
• Marketing cookies (with consent): Meta Pixel — advertising effectiveness measurement. Data may be transferred to the USA under Meta's Standard Contractual Clauses.

You can change or withdraw your cookie consent at any time by clicking "Cookie settings" in the page footer.

8. International data transfers

Where data is transferred outside the EU/EEA (e.g. to US-based processors), we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission, or other appropriate safeguards under GDPR Chapter V.

9. Data breach notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the UODO within 72 hours (GDPR Art. 33) and, where the risk is high, notify you directly without undue delay (GDPR Art. 34).

This document does not constitute legal advice. For questions write to info.highrisktactics@gmail.com.