← Back to C.U.D. ENPL

Legal

Privacy Policy

Effective 4 September 2026

This Privacy Policy explains how personal data is collected, used and protected when you visit cudexperience.com ("the Site").

1. Who is responsible for your data

The Site is operated by Piotr Kamiński, based in Poland, acting as an individual rather than through a registered company. For the purposes of the EU General Data Protection Regulation (GDPR), Piotr Kamiński is the data controller.

You can reach the controller directly at: contact@cudexperience.com

2. What data I collect

Data collected automatically. When you visit the Site, my analytics provider, Google Analytics 4, automatically collects general device and browser information, an approximate location derived from your IP address (Google Analytics does not store the full IP address), which sections of the page you view and for how long, and specific interactions such as clicking a button, opening a trip card, or following a link. This data is pseudonymous and is not linked to your name unless you separately provide it to me.

Data you provide voluntarily. If you sign up to my newsletter or contact me directly, I collect the email address (and, where relevant, name) you provide, solely to respond to you or send the updates you asked for.

Data you provide when applying to join an experience. If you submit an application form (for example, to apply for C.U.D. Origins™), I collect your name, email address, phone number, age range, travel details and your answers to the application questions. This is collected only when you submit the form and is used solely to review your application and, if relevant, to contact you about it.

3. Cookies and consent

The Site uses cookies and similar technologies set by Google Analytics and by my consent management platform, Secure Privacy. On your first visit you are shown a consent banner where you can accept or decline non-essential cookies, including analytics cookies. No analytics cookies are set until you give consent, and you can change your choice at any time using the consent settings shown on the Site.

4. Legal basis for processing

I process your data on the following legal bases under Article 6(1) GDPR:

5. Who I share data with

I use the following processors to run the Site:

I do not sell your personal data, and I do not share it with anyone for their own marketing purposes.

6. International data transfers

Google Analytics is provided by Google, which may process data outside the European Economic Area, including in the United States. Google is certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection for such transfers.

My hosting provider, GitHub, Inc., is also based in the United States. Transfers of data to GitHub are covered by Standard Contractual Clauses approved by the European Commission, which GitHub makes available as part of its data protection documentation and which require GitHub to protect your data to a standard equivalent to the GDPR.

If you submit an application or sign up to the newsletter, that data is stored using Airtable, Inc., also based in the United States. Transfers of data to Airtable are likewise covered by Standard Contractual Clauses, made available through Airtable's Data Processing Addendum, which require Airtable to protect your data to a standard equivalent to the GDPR.

7. How long I keep your data

Analytics data collected via Google Analytics 4 is retained for 14 months from collection, after which it is automatically deleted, in line with Google's default retention setting. Newsletter or contact email addresses are kept only for as long as needed to respond to you or until you unsubscribe, whichever is sooner. Application data is kept for up to 24 months from submission, or until the relevant experience has concluded plus a reasonable follow-up period, whichever is longer, after which it is deleted — unless you become a guest on an experience, in which case it may be retained for longer as part of your booking records.

8. Your rights

Under the GDPR, you have the right to:

To exercise any of these rights, contact contact@cudexperience.com. You also have the right to lodge a complaint with the Polish supervisory authority:

Urząd Ochrony Danych Osobowych (UODO)
ul. Stawki 2, 00-193 Warszawa, Poland
uodo.gov.pl

9. Automated decision-making and profiling

I do not use your personal data for any form of automated decision-making, including profiling, that produces legal effects concerning you or otherwise significantly affects you.

10. Children

The Site is not directed at children, and I do not knowingly collect personal data from children.

11. California residents (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you rights similar to those described above, including the right to know what personal information I collect and the right to request its deletion.

I do not sell your personal information, and I do not share it for cross-context behavioural advertising. I have not sold or shared personal information in the preceding 12 months and have no plans to do so.

To exercise your CCPA rights, contact contact@cudexperience.com.

12. Changes to this policy

I may update this Privacy Policy from time to time. The effective date at the top of this page shows when it was last revised.