← HomePL

USE BRICKS / Legal information

Privacy Policy

§ 1 · General provisions

LassoBrain Sp. z o.o. places particular importance on protecting your privacy and the personal data you provide through our website. This document sets out the rules for collecting, processing and protecting personal data in accordance with applicable law, including Regulation (EU) 2016/679 (GDPR).

This Privacy Policy also covers the processing of personal data in connection with registration for events and workshops organised under the useBRICKS brand, ticket purchases, payments, organisational communications, complaints and refunds. External platforms, in particular Luma, may be used for event registration, and payments may be handled by Stripe.

§ 2 · Personal data controller

  1. The controller of your personal data is LassoBrain Sp. z o.o., with its registered office at ul. Chorzowska 6, 40-101 Katowice, Poland, entered in the National Court Register by the District Court Katowice-Wschód in Katowice, 8th Commercial Division of the National Court Register, KRS: 0001213418, NIP: 6343065120, REGON: 543561420.
  2. The coordinator for personal data protection matters is Paweł Sałajczyk, address: ul. Chorzowska 6, 40-101 Katowice, Poland; email: pawel@lassobrain.com.
  3. You may also contact the Controller by email at kontakt@lassobrain.com.

§ 3 · Scope, purposes and legal bases of data processing

  1. The Controller may process personal data provided directly by users through www.usebricks.pl, contact forms, email correspondence and platforms used for workshop and event registration.
  2. The data processed may include: first name and surname; email address and telephone number; company name and details required for sales documents, including address and tax identification number; booking and attendance details; payment and refund amount, currency, identifier and status; correspondence and complaints; technical data, IP address and cookie identifiers to the extent of the technologies actually used.
  3. Personal data is processed for the following purposes:
    a) handling enquiries — Article 6(1)(b) GDPR for steps taken before entering into a contract, or Article 6(1)(f) for the legitimate interest in handling correspondence;
    b) registration, ticket sales and delivery of workshops — Article 6(1)(b) GDPR;
    c) handling payments, refunds and complaints — Article 6(1)(b), (c) or (f) GDPR, as appropriate to the particular activity;
    d) accounting and tax records — Article 6(1)(c) GDPR;
    e) establishing, exercising and defending legal claims — Article 6(1)(f) GDPR;
    f) organisational communications about the event — Article 6(1)(b) GDPR;
    g) marketing the Controller’s own services — Article 6(1)(f) GDPR to the extent permitted by law, or Article 6(1)(a) GDPR where consent is the legal basis.
  4. Commercial communications are sent through electronic channels in accordance with applicable law and subject to any required consents.
  5. Providing the data necessary for registration is voluntary, but is required to enter into and perform the contract. Providing data for marketing purposes is voluntary.
  6. Payments may be processed through Stripe, including by card, BLIK, Przelewy24 or other methods available during checkout. As a rule, the Controller receives information needed to confirm and handle the transaction, rather than the full payment instrument details entered in the payment provider’s interface.
  7. Personal data is processed only on an appropriate legal basis and, where processing is based on consent, within the scope of that consent.

§ 4 · Personal data retention periods

  1. Personal data is retained no longer than necessary for the purposes of processing, taking legal requirements into account.
  2. Booking and attendance data is retained for the duration of the contract and subsequently for the period necessary to handle complaints and legal claims.
  3. Accounting and tax records are retained for the period required by law, generally five years calculated under applicable tax legislation, taking into account any suspension or interruption of limitation periods.
  4. Correspondence data is retained for the time necessary to handle the enquiry and any related legal claims.
  5. Marketing data is processed until an effective objection is made, consent is withdrawn or the purpose no longer applies.
  6. Technical data and cookies are retained according to the purposes and periods applicable to the tools actually used.
  7. Withdrawing consent does not affect the lawfulness of earlier processing or processing carried out on other legal bases.
  8. Following withdrawal of consent or an objection, data will no longer be processed for the purpose covered by that consent or effective objection. It may, however, be retained on another appropriate legal basis, in particular to comply with legal obligations or to establish, exercise or defend legal claims. Data is erased in the circumstances provided for by law.

§ 5 · Data recipients and transfers outside the EEA

  1. Data may be shared with entities supporting the Controller in operating the website, events and payments and complying with legal obligations.
  2. Recipients may include: hosting and website-building providers, including Landingi; Luma (registration and tickets); Stripe (payments, refunds and fraud prevention); accounting firms; email and customer support providers; analytics and marketing tools actually used; and authorised public authorities.
  3. Depending on the services involved, providers may act as processors or independent controllers. Luma describes these roles in its DPA, and Stripe in its DPA.
  4. Data may be transferred outside the European Economic Area to the extent resulting from how the providers actually operate. Luma states that its data is hosted in the United States, while Stripe describes processing in the United States and India, among other locations.
  5. Transfers outside the EEA require a lawful basis under Chapter V GDPR. Luma’s public DPA provides for Standard Contractual Clauses for the transfers specified in it, while Stripe’s documentation describes the EU–US Data Privacy Framework and Standard Contractual Clauses where applicable. The application of these mechanisms depends on the particular transfer and the contractual arrangements with the provider.
  6. You may contact the Controller for information about the mechanisms applicable to a particular transfer and how to obtain copies. Provider information: Luma privacy policy, Stripe privacy policy, Stripe data transfers.

§ 6 · Cookies and similar technologies

  1. The website may use cookies and similar technologies for website functionality, security, statistics and marketing. Cookies are small files stored on the user’s device.
  2. The technologies involved are those actually activated on the website. Scripts for Google Tag Manager, Google Analytics, Cookiebot and Landingi statistics are loaded on the page. Loading a script alone does not establish what data is collected or confirm how consent is obtained.
  3. Using technologies that are not necessary to provide the service and require consent by law requires that consent to be obtained beforehand. Merely using the website must not be treated as giving such consent.
  4. The website does not currently provide users with a panel for changing or withdrawing cookie consent. Users can delete and block cookies in their browser settings and contact the Controller about personal data processing. Browser settings do not replace the service provider’s obligation to obtain any required consent. Restricting cookies may affect website functionality.
  5. When using the embedded Luma registration form or navigating to external platforms, those providers’ own cookie policies may also apply.

§ 7 · Rights of data subjects

  1. You have the right to:
    a) access your personal data;
    b) rectify inaccurate data;
    c) have your personal data erased (the “right to be forgotten”);
    d) restrict the processing of your data;
    e) data portability to another controller;
    f) object to the processing of your data;
    g) withdraw consent to the processing of personal data (where processing is based on consent);
    h) lodge a complaint with the President of the Personal Data Protection Office if you consider that the processing of your personal data infringes applicable law.
  2. Consent to personal data processing may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
  3. Data subjects may object at any time to the processing of their personal data for direct marketing purposes. Following an effective objection, the Controller will stop processing data for that purpose.

§ 8 · Protection of personal data

  1. We respect your right to privacy and take care to protect your data. To this end, we use, among other measures, a secure protocol to encrypt communications when you use this website.
  2. Personal data provided on the website is treated as confidential and is not visible to third parties, except for the Controller, entities working with the Controller and persons authorised on behalf of the Controller.
  3. Personal data is processed only by persons authorised to do so or by processors with whom we work closely.
  4. The Controller may entrust personal data to providers of IT services or server storage, including CRM, CMS, email, payment processing and analytics providers, to the extent of the services actually used.
  5. We declare that we provide sufficient guarantees that appropriate technical and organisational measures have been implemented so that processing meets the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”), and protects the rights of data subjects.
  6. We declare that we:
    a) The Controller processes personal data on the legal bases set out in this Privacy Policy and applies appropriate technical and organisational measures to ensure data security, including protection against unauthorised access, loss, destruction and unlawful processing.
    b) ensure that persons authorised to process personal data have committed themselves to confidentiality;
    c) take all measures required pursuant to Article 32 GDPR;
    d) comply with the requirements of Article 28 GDPR when engaging processors.

§ 9 · Final provisions

  1. This Privacy Policy applies from the date of its publication on our website.
  2. The Controller reserves the right to amend this Privacy Policy in response to changes in applicable law or in the website services offered.
  3. The current version of the Privacy Policy is always available on the website.

Last updated: 29 October 2026.