Privacy policy

1. Data controller

The controller of your personal data is Fundacja Rozwoju Przedsiębiorczości „Twój StartUp”, registered at ul. Żurawia 6/12, lok. 766, 00-503 Warszawa, Polska, KRS 0000442857, NIP 5213641211, REGON 146433467 (the “Foundation”, “we”), within which NextWoo operates. The Foundation owns and operates this website (nextwoocommerce.com). For matters concerning personal data you can contact us:

• Email: info@nextwoocommerce.com
• Postal address: Fundacja Rozwoju Przedsiębiorczości „Twój StartUp”, ul. Żurawia 6/12, lok. 766, 00-503 Warszawa, Polska
• Phone (Foundation office): +48 503 942 413
• Foundation contact page: twojstartup.pl/kontakt/

2. What data we process

We process only the data needed to handle your application, conclude and perform the agreement and run the website:

• Course application: name, phone (if you give it), chosen start date, teaching language, experience level, who pays for the course, a description of your product idea, and the email address (and sender name) from which you send the application.
• Correspondence and the introductory call: the content of messages, the date of the call and information you give us during the call and the entry assessment.
• Agreement and settlement: name, address, email address, phone number (if you give it), the Client’s details and the details for the accounting document (such as company name and tax number), and payment information.
• Course delivery: attendance, session dates, assignment solutions, feedback, assessments, access to the project repository and the details on the certificate.
• Complaints and withdrawal from the agreement: the content of your request and our reply.
• Technical data: IP address, date and time of the visit, the address of the page visited and browser information — processed automatically by the hosting server when the page is displayed.

3. How the application form works

The application form at nextwoocommerce.com/apply/ asks for: name, email address, phone (optional), chosen start date, teaching language, experience level, who pays for the course, and a description of your idea or goal. When you click “Send application”, the data is sent through the Web3Forms service, which forwards it by email to the NextWoo team inbox. We reply to the email address you give.

• Do not include sensitive data (such as health data), passwords, confidential business information or other people’s data in your application.
• Sending an application does not conclude an agreement or reserve a place.

4. Purposes and legal bases of processing

We process data under Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) for the following purposes:

• Handling your application, the introductory call, the assessment and preparing the offer — steps taken at your request before concluding the agreement (Article 6(1)(b) GDPR).
• Concluding and performing the agreement, including running sessions, reviews, assessment, issuing the certificate and settling payments (Article 6(1)(b) GDPR).
• Complying with legal obligations, in particular tax and accounting obligations, and handling withdrawals and complaints (Article 6(1)(c) GDPR).
• Answering questions not related to concluding the agreement, establishing, pursuing and defending claims, and keeping the website secure — our legitimate interest (Article 6(1)(f) GDPR).
• Presenting your project, name, image or opinion — only on the basis of your separate consent (Article 6(1)(a) GDPR), which you can withdraw at any time without affecting the lawfulness of earlier processing.
• We do not send newsletters or marketing information without your consent.

5. Do you have to give us your data

Giving your data is voluntary but necessary to consider your application and to conclude and perform the agreement. Without it we cannot prepare an offer or run the course. Giving the details for an accounting document is required by tax law if we issue such a document.

6. Recipients of data

Your data is available only to authorised members of the NextWoo team, to the extent needed for their tasks (enrolment, instructors, mentors, reviewers). Data may also be received by:

• email and website hosting providers and the Web3Forms service, which forwards applications from the form,
• providers of tools used in the course (video calls, chat, code repositories) — we name them at the start of the course,
• the bank handling payments, the accounting office and legal advisers — to the extent needed for settlement and the protection of rights,
• public authorities — only where the law requires it.
• Entities processing data on our behalf do so under a data processing agreement and in line with our instructions. We do not sell personal data.

7. Transfers outside the European Economic Area

Some service providers (such as email or hosting) may process data outside the European Economic Area. In that case data is transferred on the basis of the mechanisms provided for in Chapter V GDPR — a European Commission adequacy decision or standard contractual clauses. On request, we will tell you which safeguards apply and how to obtain a copy of them.

8. How long we keep data

We keep data no longer than necessary:

• Applications and correspondence that did not lead to an agreement — up to 6 months from the last contact. After that we delete them from the mailbox.
• Participant data — for the duration of the agreement and then until the limitation periods for claims arising from it expire.
• Accounting documents — for the period required by tax and accounting law (as a rule 5 years from the end of the calendar year in which the tax payment deadline passed).
• Complaints and withdrawal statements — until the limitation periods for claims expire.
• Data processed on the basis of consent — until consent is withdrawn.
• Technical data in server logs — for a short period set by the hosting provider’s settings, needed to keep the website secure.

9. Your rights

Under the GDPR you have the right to:

• access your data and receive a copy (Article 15 GDPR),
• rectify your data (Article 16 GDPR),
• erase your data (Article 17 GDPR),
• restrict processing (Article 18 GDPR),
• data portability for data processed on the basis of the agreement or consent (Article 20 GDPR),
• object to processing based on legitimate interest (Article 21 GDPR),
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• To exercise your rights, write to info@nextwoocommerce.com or by post to the Foundation’s address. We reply without undue delay and no later than within one month; in specific cases this period may be extended by two further months, and we will tell you if so. We may ask for information needed to confirm your identity.

10. Complaint to the supervisory authority

If you believe we process your data unlawfully, you can lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or with the supervisory authority in the EU country where you live or work. We encourage you to contact us first — we will try to resolve the matter quickly.

11. Automated decisions and profiling

We do not make decisions based solely on automated processing, including profiling. Admission to the course and assessment of progress are decided by people — instructors and reviewers.

12. Cookies, analytics and external resources

The website does not use analytics tools (such as Google Analytics), advertising pixels or other tracking tools, and does not itself store cookies or data in browser storage on your device. That is why we do not show a cookie consent banner.

• Fonts and images are served with the website — browsing it does not require connecting to Google Fonts or other external servers.
• Links to external websites (such as the Foundation’s contact page) are ordinary links — we do not embed social media or other plugins. Once you go to their pages, their privacy policies apply.
• If we introduce analytics or cookies that require consent in the future, we will update this policy and — where required — ask for your consent before using them.

13. Data security

We use technical and organisational measures appropriate to the risk: only authorised people have access to data, and the website uses an encrypted HTTPS connection. We delete applications from the mailbox in line with the periods in section 8.

14. Changes to the privacy policy

We update this policy when the law, the tools we use or the way we process data change. The current version is always available on this page; we inform participants of significant changes by email. Version of 2 September 2026.