Privacy Policy

Data controller

The controller of your data is Eryk Panter, who publishes the game as 5lamp. For anything about your personal data, write to kontakt@hosanna.pl.

Purpose and legal basis

We process the e-mail address from a blog form to send the printable file you ask for (GDPR Art. 6(1)(b)); if you tick no box, we send one e-mail with the link to the file and add the address to no list. When you join the list, the waitlist or „Adwent ze świętymi”, we send the messages described next to that form on the basis of your consent (GDPR Art. 6(1)(a)), given by clicking the confirmation link in the e-mail (double opt-in); without that click the address joins no list. We process your e-mail message and address to answer your question — on the basis of the controller’s legitimate interest (GDPR Art. 6(1)(f)) in handling correspondence.

If you tick the consent boxes under the address field, we also process your e-mail address to send you the messages you chose: printables for the coming feasts, news about the HOSANNA! game and commercial information (offers and promotions). The basis is your consent (GDPR Art. 6(1)(a)) and, for commercial information sent by e-mail, consent within the meaning of Art. 398 of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej). You confirm it by clicking in the e-mail, and we record which categories you consented to and when. You can withdraw any consent at any time with one click in the footer of every e-mail ("Unsubscribe from offers" or "Unsubscribe from everything") or by writing to kontakt@hosanna.pl. Withdrawal does not affect the lawfulness of sending before it. Consent is voluntary — you get the printable file without it too.

Data you give when ordering (full name, e-mail, phone, locker code, billing address) is processed to perform the sales contract and deliver the parcel (art. 6(1)(b) GDPR), and sales records are kept because tax and accounting law requires it (art. 6(1)(c) GDPR).

If you tick "E-mail me my link for recommending the game and news about the print run" in the cart, we send you three e-mails at most: a link for recommending the game to friends and two messages about how the presale is going (Art. 6(1)(a) GDPR). Withdraw that consent with the "Unsubscribe" link in the e-mail footer. Data in the referral promotion is described in its terms, linked from that e-mail.

Recipients of data

We share data with these service providers — Resend and Railway process it on our behalf as processors, Stripe and InPost as recipients needed for payment and delivery:

Resend — sending e-mail

Resend, Inc. is based in the United States and participates in the EU–US Data Privacy Framework (DPF), which is the legal basis for transferring data outside the European Economic Area. Resend sends the e-mail with the printable file, the sign-up confirmation and the messages you sign up for, stores the addresses on our lists together with the record of consent.

Railway — hosting

Railway runs the server this site is served from, and keeps the technical logs (IP address, timestamp) needed to operate and secure the service.

Stripe — payments

Stripe Payments Europe Ltd. (Ireland) handles BLIK, Przelewy24 and card payments and the order page. We never see card or account details — only Stripe does, acting as a separate controller for payments under its own privacy policy.

InPost — delivery

InPost sp. z o.o. receives your name, phone, e-mail and locker code in order to deliver the parcel.

After you click “Do kasy” (checkout) in the cart you can pick a parcel locker on the InPost map: only then is it loaded from the servers of InPost sp. z o.o., which process your IP address when the map loads (Art. 6(1)(b) GDPR — delivering the order).

Analytics

We measure site traffic in two ways. Umami always runs: without cookies and without data that could identify a person, it counts visits, scrolling, time and clicks. Microsoft Clarity (Microsoft Corporation, USA) runs only after you accept the banner: it sets cookies (_clck, _clsk and related) and records the course of a visit — scrolling, clicks, pointer movement — to produce session recordings and click maps. Text typed into forms is masked. On the same consent we run the Meta Pixel (Meta Platforms Ireland Ltd.): it sets cookies (_fbp and related) and tells Meta which pages you visited and whether you added to cart, went to checkout, signed up or bought (with the amount, never the data you typed into forms), so we can measure our Facebook and Instagram ads; Meta may link this to your account on its services under its own privacy policy. The legal basis is your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time with “Cookie settings” in the site footer. Microsoft participates in the EU–US Data Privacy Framework. Recordings are kept for 30 days, click maps and click data for up to 9 months. The HOSANNA! game (Circle of Saints) carries no analytics at all. The question app (/zasady/) runs Umami only — without cookies and without data that could identify a person, it counts in aggregate which saints and levels are chosen and which questions are answered right, wrong or skipped, so we can improve the questions. Neither Clarity nor the Meta Pixel ever runs there.

Conversation assistant (ElevenLabs)

On the home page, the presale page and "About us" you can talk to an assistant — by voice or in writing. The chat panel may open by itself, but nothing from ElevenLabs loads until you send a message or click "Talk". From then on your voice (if you turn on the microphone — the browser always asks first) and the content of the conversation go to ElevenLabs, Inc. (USA), which processes them on our behalf: it turns speech into text, prepares the answer and reads it aloud.

The legal basis is our legitimate interest in answering questions about the game and orders (Art. 6(1)(f) GDPR); you start the conversation yourself and can end it at any time. Data is transferred to the USA under the standard contractual clauses in our data processing agreement with ElevenLabs. We create no identifier that links your visits and do not use conversations for marketing. Conversation records are deleted after 30 days. Please do not share sensitive data or data about children in the conversation.

Music player (Spotify)

On the "About us" page you can listen to the music this game was made to. Nothing from Spotify loads until you click the play button or an artist name. After that click the player loads from the servers of Spotify AB (Sweden), which may set their own cookies and receive your IP address, under Spotify’s privacy policy. If you are logged in to Spotify in this browser you hear full tracks, otherwise 30-second previews.

Retention period

We keep an e-mail address that joined a list or gave consent to messages until you unsubscribe (link in every e-mail’s footer) or withdraw consent, and after that only as long as needed to prove that consent was given and when it was withdrawn. An address to which we sent only a printable file is not kept on any list. We keep a contact-form message as long as we need it to handle the matter it concerns.

Order data is kept for 5 years from the end of the year of sale (tax law) and, in case of a complaint or dispute, until it is resolved.

Your rights

You have the right to access your data, to have it rectified or erased, to restrict its processing, to data portability, and to object to processing. You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (uodo.gov.pl). You can exercise any of these rights by writing to the address below.

Contact

For anything concerning personal data, write to kontakt@hosanna.pl.