Privacy Policy
Last updated: 6 November 2026
1. Data controller
The controller of personal data collected through muzea.waw.pl is the site owner. For data protection inquiries, contact us at: kontakt@muzea.waw.pl.
2. What data we collect
Analytics data (Google Analytics 4)
This site uses Google Analytics 4 (GA4) for traffic analysis. GA4 collects the following data:
- IP address (anonymised)
- Browser and operating system type
- Screen resolution
- Browser language
- Referral source (how you found us)
- Pages visited and time spent on site
- Interactions with page elements (clicks, scrolling)
GA4 runs in Google Consent Mode, tied to the Google consent message described below. Without your consent GA4 sets no cookies and stores no identifiers; only identifier-free technical signals may then reach Google.
The data processor for GA4 is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Details: Google Privacy Policy.
Advertising and affiliate links
The site may display advertising and contain affiliate links to partners - currently travel offers (LOT Polish Airlines, Booking.com) served through the CJ Affiliate network (Commission Junction, part of the Epsilon group), and tours and tickets offered through the GetYourGuide partner programme. If you buy a ticket or service through an affiliate link, we receive a commission from the partner. This does not change the price you pay or the content of our recommendations. Museums do not pay to be listed in the catalogue.
This site displays graphic ads in two modes, differing in whether showing them connects your browser to an outside server.
Creatives fetched from the affiliate network’s servers (currently LOT Polish Airlines and Booking.com via CJ Affiliate) appear only after you give consent - only then does your browser contact the network’s server, which involves passing your IP address to them.
Creatives we host ourselves are shown to all visitors. The image comes from our own server, so displaying it passes no data to anyone and stores nothing on your device. Such placements are labelled “Advertisement” and the partner link carries rel="sponsored". Until you click, nothing leaves your browser.
Regardless of mode: no advertising or affiliate cookie is set without your consent. Affiliate cookies are created only when you click a partner link, on the partner’s own domain (Art. 6(1)(a) GDPR). Affiliate links within page content are clearly labelled. Booking.com does not use cookie tracking in this programme - attribution is session-based only.
The controller of data collected by the affiliate network is Commission Junction LLC (CJ Affiliate). Details: CJ legal information. Once you click a GetYourGuide partner link, your data is processed by GetYourGuide Deutschland GmbH under its own privacy policy.
Maps (OpenStreetMap)
Museum pages embed a map from OpenStreetMap. Displaying it connects your browser to the servers of the OpenStreetMap Foundation, which receive your IP address and basic technical data about your browser. We do not pass on the address of the page you come from, and the map stores no cookies. Details: OSMF privacy policy.
Videos (YouTube)
Some pages contain videos from YouTube. The player loads only after you click its play button; until then your browser does not connect to YouTube. Once you click, the player in privacy-enhanced mode (youtube-nocookie.com) connects to Google’s servers, which receive your IP address and browser data and may store cookies or similar data on your device. From then on your data is processed by Google Ireland Limited under its own privacy policy.
Google AdSense advertising
With your consent we also display ads served by Google AdSense. Consent is collected by Google’s message (IAB TCF standard) - you can change or withdraw it at any time via the “Manage consent” link in the footer. Google and its partners may use cookies to personalise and measure ads; details: policies.google.com/technologies/partner-sites.
Cookies
This site uses the following cookies:
| Name | Purpose | Duration | Type |
|---|---|---|---|
FCCDCF, FCNEC | Remembers the decision you made in Google’s consent message (IAB TCF) | approx. 13 months | Necessary |
_ga | Google Analytics identifier | 2 years | Analytics (requires consent) |
_ga_* | Google Analytics session identifier | 2 years | Analytics (requires consent) |
__gads, __gpi, __eoi | Serving and measuring Google AdSense ads | 6 to 13 months | Advertising (requires consent) |
IDE and other cookies on Google advertising domains | Personalisation and measurement of Google ads | approx. 13 months | Advertising (requires consent) |
cjae | Attributes commission for a clicked partner link (CJ network) | approx. 13 months | Advertising/affiliate (requires consent) |
DotomiUser | CJ/Epsilon affiliate network identifier | approx. 13 months | Advertising/affiliate (requires consent) |
Analytics and advertising cookies are only set after you give consent. CJ affiliate cookies are created only when you click a partner link, by the CJ network’s domains, not by this site. The FCCDCF and FCNEC cookies store your consent decision and are necessary to honour it. The full list of cookies used by Google: policies.google.com/technologies/cookies. The muzea_consent cookie, which an earlier version of this site used to remember the decision made in its own consent banner, is no longer set - if it still exists in your browser, the site removes it automatically on your next visit.
3. Legal basis for processing
- Art. 6(1)(a) GDPR - user consent (GA4 analytics, advertising and affiliate links)
- Art. 6(1)(f) GDPR - legitimate interest of the controller (ensuring site functionality and security, showing a map of the museum location)
4. Data retention
- GA4 data: Retention period set in Google Analytics - 14 months from last activity
- Consent decision cookies (
FCCDCF,FCNEC): approximately 13 months from consent/refusal - Google advertising cookies: 6 to 13 months (details in Google’s documentation)
- CJ affiliate cookies: approximately 13 months from clicking a partner link
5. Data transfers
Analytics data is processed by Google on servers within the European Union. Google may transfer data to the USA under GDPR compliance mechanisms (including the EU-US Data Privacy Framework).
Google AdSense advertising is operated by Google Ireland Limited; Google may transfer data to the USA under GDPR compliance mechanisms.
The CJ (Epsilon) affiliate network also processes data in the USA, under GDPR compliance mechanisms.
OpenStreetMap maps are operated by the OpenStreetMap Foundation, based in the United Kingdom.
We do not sell users’ personal data. Data is shared only with the parties named in this policy (the analytics provider, Google’s advertising network, YouTube, the CJ affiliate network, GetYourGuide and the OpenStreetMap Foundation), to the extent described above.
6. Your rights
Under GDPR, you have the following rights:
- Right of access (Art. 15) - find out what data we process
- Right to rectification (Art. 16) - request correction of your data
- Right to erasure (Art. 17) - request deletion of your data (“right to be forgotten”)
- Right to restriction of processing (Art. 18)
- Right to data portability (Art. 20)
- Right to object (Art. 21) - object to processing based on legitimate interest
- Right to withdraw consent - you can withdraw consent for analytics and advertising cookies at any time via the “Manage consent” link in the site footer
To exercise your rights, contact us at: kontakt@muzea.waw.pl.
7. Managing cookies
You can change your cookie decision at any time:
- Withdraw consent: Click the “Manage consent” link in the footer of any page - Google’s consent message opens again and you can change or withdraw your decision.
- Delete cookies: You can also clear muzea.waw.pl cookies in your browser settings - the consent message will then reappear.
- Block cookies: Most browsers allow you to block cookies in privacy settings.
8. Changes to this policy
We reserve the right to update this privacy policy. Significant changes will be communicated via a prominent notice on the site. The date of the last update is shown at the top of this document.
9. Supervisory authority
If you believe your data is being processed in violation of GDPR, you have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO):
ul. Stawki 2, 00-193 Warsaw, Poland
uodo.gov.pl