Privacy and cookie policy

This is a translation for your convenience. In case of any discrepancy, the Polish version prevails.

This policy explains what personal data clubwch2026.com – the official website of the FIVB Men’s Volleyball Club World Championship 2026 in Poland – collects, why, how long we keep it and what your rights are.

1. Data controller

The controller of your personal data is Aluron CMC Warta Zawiercie S.A., ul. Blanowska 40, 42-400 Zawiercie, NIP: 649 230 95 09, REGON: 367894183, KRS: 0000688817 (Sąd Rejonowy w Częstochowie, XVII Wydział Gospodarczy KRS), tel. (+48) 602 620 700, e-mail: [email protected] (“we”, “us”).

You can contact our Data Protection Officer by e-mail: [email protected].

2. Hospitality form

When you send a hospitality enquiry, we process:

• your company name, full name and e-mail address,
• the number of guests and the selected arena and day,
• the page language and the date and time of sending.

Purpose: to answer your enquiry and prepare an offer.

Legal basis: your consent (Art. 6(1)(a) GDPR). If you accept the offer – steps needed to conclude and perform the contract (Art. 6(1)(b) GDPR). Establishing, exercising or defending legal claims – our legitimate interest (Art. 6(1)(f) GDPR).

Providing the data is voluntary, but without it we cannot answer your enquiry. The enquiry is sent by e-mail to the team that handles hospitality sales. A copy is stored on the server so that it is not lost if e-mail delivery fails.

How long: until you withdraw your consent, and no later than 31 December 2027. If we conclude a contract – for its duration and the period required by law (e.g. tax law) or until claims become time-barred.

3. Spam protection

We protect the form without CAPTCHA-type tools and without cookies. To limit the number of submissions from one device, we store on the server a one-way hash of the IP address and the times of submission – not the IP address itself.

Legal basis: our legitimate interest in keeping the website secure (Art. 6(1)(f) GDPR).

How long: the hash is only needed for one hour after the last submission and is then deleted automatically.

4. Server logs and Cloudflare

Like any web server, ours records technical information about connections: IP address, date and time, the page visited and browser information. We use it to keep the website running and to detect attacks.

All traffic to the website passes through the Cloudflare network, which speeds up and secures the website. On our behalf, Cloudflare processes the same technical data and the content being transmitted, including hospitality form data on its way to our server.

Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

How long: as long as necessary for security, in line with the rules of the hosting provider and Cloudflare.

The service is provided by Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA). Data may be processed outside the European Economic Area, including in the USA. The transfer is based on the European Commission’s adequacy decision of 10 July 2023 (EU–US Data Privacy Framework), in which Cloudflare, Inc. participates, and on standard contractual clauses.

5. Cookies and Google Analytics

Cookies are small files stored in your browser. We use them for two purposes only:

Strictly necessary cookies are always on, because without them the website cannot remember your choice. Legal basis: the exemption for strictly necessary cookies in Art. 399 of the Polish Electronic Communications Law and our obligation to demonstrate consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

The website picks a suggested language version in your browser, from the languages set there. We do not send them anywhere for this purpose, and kms_lang_hint holds only a marker, with no data about you.

Analytics cookies are used only with your consent (Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law). Until you consent, the website does not connect to Google. We use Google Analytics 4, which shows us:

• which pages and sections are viewed,
• which ticket buttons are clicked (arena, day, ticket type),
• whether the hospitality form was sent (without its content),
• language version choices and whether the language suggestion was accepted or closed,
• approximate location (country, city), the type of device and browser, and the browser language.

We have switched off Google signals and ad personalisation – we do not use this data for advertising or profiling. Google Analytics does not store the IP addresses of visitors from the European Union. We keep data in Google Analytics for up to 14 months.

Google Analytics is provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Data may be transferred to Google LLC in the USA. The transfer is based on the European Commission’s adequacy decision of 10 July 2023 (EU–US Data Privacy Framework), in which Google LLC participates, and on standard contractual clauses.

Changing your choice: click “Cookie settings” in the page footer at any time. If you withdraw consent, we delete the Google Analytics cookies from your browser. You can also delete or block cookies in your browser settings.

6. Links to other websites

Tickets are sold by Eventim. When you click a ticket button, you go to the Eventim website, which processes your data under its own rules and as a separate controller. We add campaign tags (UTM parameters) to the links; they contain no personal data.

The website also links to the host club’s social media profiles (Instagram, Facebook, TikTok, X) and to Google Maps. We do not embed their plug-ins, maps or fonts – you connect to these services only when you click a link, and their privacy policies apply from then on.

7. Who receives the data

Data may be received only by providers who help us run the website and act on our behalf: the hosting and e-mail provider, Cloudflare, the company that built and maintains the website, and Google (Google Analytics – only with your consent). We do not sell data.

8. Your rights

You have the right to:

• access your data and receive a copy,
• have your data rectified,
• have your data erased,
• restrict processing,
• data portability,
• object to processing based on our legitimate interest,
• withdraw consent at any time – this does not affect the lawfulness of processing before withdrawal.

To exercise these rights, write to our Data Protection Officer: [email protected]. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).

We do not make automated decisions about you and do not profile you.

9. Security and changes

The connection to the website is encrypted (HTTPS) and only authorised persons have access to the data. If we change how we process data, we will update this policy and the date at the top of the page.