Privacy and Cookie Policy – lasertagpoznan.pl (games section)

Version 1.2 · effective 1 October 2026. This is an English summary of the Polish Polityka prywatności i polityka cookies, which is the binding version and is available at lasertagpoznan.pl/polityka-prywatnosci/.

1. Who is the controller

The controller of personal data processed in connection with laser tag games and related services (bookings, participants, contact, photos, results, CCTV, social media profiles) is Vanguard Arsenal sp. z o.o., ul. Szarych Szeregów 39 lok. 8, 60-462 Poznań, Poland, registered in the National Court Register kept by the District Court Poznań – Nowe Miasto i Wilda in Poznań, 8th Commercial Division, KRS 0001263783, NIP 7812116848, REGON 545588770. Contact for data protection matters: [email protected] (bookings and games: [email protected]), phone +48 570 931 931, or by post to the registered office. We have not appointed a data protection officer (Article 37 GDPR does not apply to us).

Since 1 October 2026 Vanguard Arsenal sp. z o.o. organises the games under the “Laser Tag Poznań” brand in its own name and is the service provider and the party to contracts with customers.

2. Important: the equipment sales section is run by a separate entity

The section available at /en/equipment-sales/ (Polish: /sprzedaz-sprzetu) and all its sub-pages are not operated by Vanguard Arsenal sp. z o.o. and are not part of our services. They are operated by a separate business: Olivier Śmigielski, trading as LASER TAG Olivier Śmigielski, ul. Stobnicka 53, 60-480 Poznań, NIP 7811882078 – the owner of the “LASER TAG POZNAŃ” trade mark (R.323055) and the holder of the lasertagpoznan.pl domain, who also maintains the technical infrastructure of this website. In respect of equipment sales he is an independent controller and his own terms and privacy policy apply. Our analytics and marketing tools are not run on that section, and we do not combine data of the two businesses.

3. What we process and why

• Bookings and games – name, phone, e-mail, date, number and age of participants, package, notes; for business customers also company data and contact person. Basis: Article 6(1)(b) GDPR (contract). Kept for the duration of the service and then until claims are time-barred.
• Enquiries (form, phone, e-mail, Messenger/Instagram) – Article 6(1)(b) and (f) GDPR; kept for 12 months after the last contact, or as for the contract.
• Invoices and accounting – Article 6(1)(c) GDPR; 5 years from the end of the tax year.
• Claims and complaints – Article 6(1)(c) and (f) GDPR; until claims are time-barred.
• Website analytics and marketing (Google Analytics 4, Google Ads, Meta Pixel, YouTube) – only with your consent given in the cookie banner (Article 6(1)(a) GDPR); you can withdraw it at any time via “Cookie settings” in the footer.
• Photos and videos from games – published only on the basis of consent (Article 81 of the Polish Copyright Act; for minors – the parent’s consent). You can withdraw consent or ask us to take a material down at any time; we do so without asking why.
• Results service (wyniki.lasertagpoznan.pl) – first name or nickname, date, results; Article 6(1)(b) and (f) GDPR; we recommend using a nickname and will anonymise an entry on request.
• CCTV at Fort Va – images only, no sound, for the safety of persons and property (Article 6(1)(f) GDPR); recordings are kept for no longer than 60 days or until the memory card is full, whichever comes first. Recordings are stored on memory cards in the cameras and are not stored in the cloud. Remote live view and remote playback by authorised persons are, however, carried out via the camera manufacturer’s infrastructure (Xiaomi), which relays the encrypted video stream between the camera and the authorised person’s device; in this respect the manufacturer acts as a processor and does not permanently store recordings; for the “Europe” region its servers are located in the European Union. The corridors, common rooms and grounds are also covered by cameras of the property manager, Stowarzyszenie Miłośników Fortyfikacji “Kernwerk” (KRS 0000384806), which is a separate controller with its own notice; the two systems are not connected and neither party has access to the other’s cameras or recordings.

Providing data is voluntary, but without name, phone and e-mail we cannot confirm a booking.

4. Data received from the previous operator (Article 14 GDPR)

Until 30 September 2026 the games were organised by Olivier Śmigielski (LASER TAG Olivier Śmigielski). To ensure continuity we received from him and became the controller of: future bookings (for games after 30 September 2026) with related e-mail correspondence – Article 6(1)(b) GDPR; the archive of photos and videos with consent forms, the history of game results and the history of Messenger/Instagram conversations – Article 6(1)(f) GDPR (our legitimate interest in continuity of service and of the brand). We use this historical data only to continue serving customers and the brand. We do not use it for direct marketing; any newsletter would require your separate consent given to us. You may object at any time (Article 21 GDPR) or ask for erasure by writing to [email protected]. A plain-language notice about the change of operator is published at lasertagpoznan.pl/zmiana-operatora/.

5. Social media profiles – joint controllers (Article 26 GDPR)

For data of visitors to the brand’s Facebook page, Instagram account, YouTube channel and Google Business Profile, Vanguard Arsenal sp. z o.o. and LASER TAG Olivier Śmigielski are joint controllers. Essence of the arrangement: Vanguard Arsenal sp. z o.o. performs all operational and information duties, handles all data-subject requests (a request received by the other controller is forwarded to us within 3 working days) and is the controller responsible under Meta’s Page Insights Controller Addendum; contact point: [email protected] or [email protected]. Regardless of this, you may exercise your rights against either joint controller. Meta and Google are independent controllers for their own processing. We do not run lead-ads campaigns collecting contact data.

5a. Equipment enquiries – handled on behalf of LASER TAG Olivier Śmigielski

Our phone line (+48 570 931 931) and our e-mail addresses also handle enquiries directed to LASER TAG Olivier Śmigielski (ul. Stobnicka 53, 60-480 Poznań, NIP 7811882078), who carries out the sale, distribution and servicing of laser tag equipment. For such enquiries the controller of your personal data is LASER TAG Olivier Śmigielski. We process the data solely on his documented instructions as a processor within the meaning of Article 28 GDPR, under a data-processing agreement concluded between us, for the sole purpose of receiving your enquiry and forwarding it to him for further handling. Scope of the entrusted data: name or company name, contact details (phone, e-mail), the contents of the enquiry and correspondence, and — if provided — equipment details (model, serial number, fault description). We do not combine this data with data of the games-section customers, do not use it for our own marketing or analytics and do not disclose it to third parties other than the licensor. Full information about processing by the licensor — purposes, legal bases, retention periods and your rights — is available in his privacy policy at lasertagpoznan.pl/en/equipment-sales-privacy-policy/. Data-protection contact for the licensor: [email protected]. Rights requests concerning equipment enquiries should be addressed directly to him; if received by us, we forward them within 3 working days.

6. Recipients and transfers outside the EEA

Data may be disclosed to processors acting on our behalf (Google Ireland Ltd – analytics, ads, e-mail and calendar; Meta Platforms Ireland Ltd; CookieYes Ltd – consent management; Web3Creative (Web3Forms, India) – delivery of contact and booking form submissions to our mailbox; the results-service platform provider; Olivier Śmigielski – hosting and backups of this website as our processor, with his sub-processors LH.pl, Cloudflare, Google Ireland and SOLMEDIA), to independent service providers (accountants VESPA POZNAŃ sp. z o.o., Fakturowo.pl, Nest Bank S.A., iPOS S.A. payment terminal, insurers, lawyers) and to public authorities where required by law. Transfers to the USA are based on the EU–US Data Privacy Framework or standard contractual clauses; transfers to the UK (CookieYes) on the European Commission’s adequacy decision; transfers to India (Web3Forms), for which there is no adequacy decision, on standard contractual clauses forming part of the data processing agreement. We do not sell data.

7. Your rights

You have the right of access, rectification, erasure, restriction, data portability, objection (unconditional for direct marketing) and to withdraw consent at any time. Write to [email protected] or to the registered office; we reply within one month. You may lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

8. Cookies

We use strictly necessary cookies (WordPress, CookieYes consent record) without consent, and functional, analytics and marketing cookies (Google Analytics 4, Google Ads, Meta Pixel, YouTube) only with your consent given in the CookieYes banner, separately for each category. The location map in the footer is a static image stored on our server (map data © OpenStreetMap contributors); it uses no cookies and does not connect to Google or any other external map service. The “Open in Maps” button opens Google Maps in a new tab only when you click it – from then on Google Ireland Limited processes data under its own terms. Refusing is as easy as accepting and does not limit access to the site. Change or withdraw your choice at any time via “Cookie settings” in the footer. Our tools are not run on the equipment sales section; cookies used there are governed by its operator’s own policy. Full list and storage periods: see the Polish policy, § 21–26.

9. Changes

We may update this policy; the current version with its date is always published here. This policy replaces, for the games section, the previous privacy policy of lasertagpoznan.pl which named Olivier Śmigielski as controller.