1. General Information
This Privacy Policy applies to the website https://berserk.com.pl/en/, as well as to pages and profiles related to BERSERK's activities on social media.
This Privacy Policy sets out the rules for the processing and protection of personal data of website users, clients, training participants, persons who contact us through forms, e-mail, messengers and social media, as well as persons using the services and payment forms available on the website.
Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR/RODO), as well as applicable provisions of the laws of the Republic of Poland.
We pay particular attention to the protection of personal data. Data is used only for purposes related to the operation of the website, handling enquiries, organizing and conducting training, providing services, processing payments, fulfilling legal obligations, ensuring security and protecting legitimate interests.

2. Joint Controllers of Personal Data
The joint controllers of personal data (współadministratorzy) are:
1. CENTRUM ROZWOJU I BEZPIECZEŃSTWA Sp. z o.o.
ul. Grzybowska 87, 00-844 Warszawa
NIP: 5272982764
REGON: 520820798
E-mail: centrum.sbz@gmail.com
2. Dmytro Sviridov Berserk
NIP: 9452258919
ul. Jana Kazimierza 50/23, 01-248 Warszawa
E-mail: dmytrosviridov@gmail.com
The Joint Controllers jointly determine the purposes and means of processing personal data in connection with the operation of the website https://berserk.com.pl/en/, interactions with users and clients, organization and sale of training and services, handling enquiries, communication with clients and related processes.
The Joint Controllers have established a division of responsibilities relating to the processing of personal data and compliance with GDPR/RODO requirements.
In particular, the Joint Controllers ensure the proper fulfilment of information obligations towards data subjects, the handling of user requests, the exercise of their rights and the security of personal data.
A user may contact either of the Joint Controllers regarding the processing of their personal data. The request will be handled in accordance with applicable GDPR/RODO provisions regardless of which Joint Controller it was submitted to.

3. Sources of Personal Data
We may obtain personal data:

• directly from the user through forms available on the website;
• when registering for training, a course or another event;
• when placing an order and making a payment;
• by e-mail;
• through messengers, including WhatsApp and Telegram;
• through messages on social media, including Instagram Direct;
• as a result of the user's public activities on social media;
• automatically through cookies and similar technologies;
• through analytics and marketing tools used on the website, to the extent permitted by applicable law and the consents provided by the user.

4. Purposes and Legal Bases for Processing Personal Data
Personal data may be processed for the following purposes:
Responding to User Enquiries and Communication
Legal basis: Article 6(1)(f) GDPR – the legitimate interest of the controller consisting in processing and responding to user enquiries.
Conclusion and Performance of a Contract
Data is processed for registration for training, courses and events, arranging participation, providing services, processing orders and fulfilling contractual obligations.
Legal basis: Article 6(1)(b) GDPR.
Payment Processing
Data may be processed in connection with payments for training, courses and services through the payment systems available on the website.
Legal basis: Article 6(1)(b) GDPR, as well as Article 6(1)(c) GDPR in relation to obligations imposed by law.
Compliance with Legal Obligations
Data may be processed for the purpose of fulfilling accounting, tax and other obligations required by law.
Legal basis: Article 6(1)(c) GDPR.
Protection of Rights and Legitimate Interests
Data may be processed for the establishment, exercise or defence of potential claims, as well as to ensure security and prevent abuse.
Legal basis: Article 6(1)(f) GDPR.
CRM and Client Interaction History
Data may be processed to organize client relations, maintain contact history, process enquiries and improve customer service.
Legal basis: Article 6(1)(f) GDPR.
Recording of Telephone Calls
If telephone calls are recorded, such recording is carried out in accordance with applicable legal requirements and may be used, in particular, to document the content of communications, ensure security, resolve disputes and monitor the quality of service.
The legal basis is determined depending on the specific purpose of processing and applicable law.
Analytics and Marketing
Analytics and marketing technologies that require user consent are used on the basis of Article 6(1)(a) GDPR – the user's consent.

5. Retention Period for Personal Data
Personal data is stored for the period necessary to achieve the purposes for which it was collected, as well as for the period required by applicable law.
In particular:

• data processed on the basis of consent – until the consent is withdrawn, unless another legal basis exists for further processing;
• data necessary for the performance of a contract – for the duration of the contract and thereafter for the period necessary to fulfil legal obligations and protect against potential claims;
• data related to accounting and tax documents – for the period required by applicable law;
• data necessary for the defence against claims or the exercise of claims – until the expiry of the applicable limitation periods;
• data processed on the basis of legitimate interests – until the exercise of the right to object, unless there are overriding legitimate grounds for further processing.

6. Recipients of Personal Data
Personal data may be transferred or made available to the extent necessary to:

• hosting providers and IT infrastructure providers;
• CRM providers and customer management systems;
• providers of analytics and marketing tools;
• payment service providers, including Przelewy24, if this payment method is used by the user;
• providers of e-mail, communication and other necessary services;
• accounting, legal and other professional advisers;
• public authorities and other authorized entities – exclusively in cases and to the extent required by law.

Service providers may process personal data on behalf of the controller on the basis of appropriate agreements and in accordance with GDPR/RODO requirements, where such processing is carried out as data processing entrusted by the controller (powierzenie przetwarzania danych osobowych).

7. Transfer of Data Outside the European Economic Area
In certain cases, personal data may be transferred outside the European Economic Area where service providers used by us process data in third countries.
Such transfers are carried out only where an appropriate legal basis exists and the safeguards provided for by the GDPR are applied, including:

• an adequacy decision of the European Commission;
• Standard Contractual Clauses (SCC);
• other mechanisms for transferring personal data provided for by the GDPR.

Where a service provider participates in the EU-U.S. Data Privacy Framework, the transfer may be carried out on the basis of the relevant European Commission decision, provided that the relevant provider is included in the current DPF register.

8. Rights of Data Subjects
The user has the following rights, to the extent provided for by the GDPR:

• the right to access their personal data;
• the right to request rectification of inaccurate or incomplete data;
• the right to request erasure of data in cases provided for by law;
• the right to request restriction of processing;
• the right to object to the processing of data;
• the right to receive data in a structured, commonly used and machine-readable format, where provided for by the GDPR;
• the right to withdraw consent to the processing of data at any time where processing is based on consent;
• the right to lodge a complaint with the Polish supervisory authority – the President of the Personal Data Protection Office (Urząd Ochrony Danych Osobowych – UODO).

Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
To exercise their rights, the user may contact either of the Joint Controllers using the contact details provided in Section 2.

9. Cookies and Similar Technologies
The website uses cookies and similar technologies for:

• ensuring the proper functioning of the website;
• saving necessary settings;
• ensuring security;
• analysing website usage;
• where appropriate consent has been provided – for analytics and marketing purposes.

The user may manage cookie settings through the consent management mechanism available on the website, where such a mechanism is used, as well as through their browser settings.
Disabling certain cookies may affect the functionality of individual elements of the website.

10. Updates to the Privacy Policy
This Privacy Policy may be updated periodically, in particular in connection with changes in legislation, technologies used, services or methods of processing personal data.
The current version of the Privacy Policy is always available on the website.
Website: https://berserk.com.pl/en/

Last updated: 17 September 2026