Privacy notice

My Angelic Gesture Campaign · version of 15 October 2026 (changes: likes, comments and shares of gestures, keepsakes with the gesture number and sending them by e-mail). This is the English version of the Polish privacy notice.

Who is responsible for your data

The organiser of the campaign and the controller of the data submitted in the form is Asepta sp. z o.o., ul. Szlak 25, 43-300 Bielsko-Biała, Poland, KRS 0000429918, NIP (tax ID) 5472143749. For anything concerning your submission or your data, write to gest@akcjamojanielskigest.org or to the postal address above.

What you provide in the form

We only require a description of the gesture and your first name or a nickname. The title, category, town or city, age and up to 3 photos are optional. You don’t need an account. Your e-mail address is optional — you give it if you would like to receive your keepsake (a Unique Angelic Heart or an Angel) by e-mail; separately, you can choose to receive information from us about the My Angelic Gesture Campaign. Do not include other people’s surnames, addresses, phone numbers or health information in the description.

What we publish and why

On the basis of your voluntary consent (Article 6(1)(a) GDPR), we receive, review and publish your story in order to share examples of kindness as part of the campaign. We publicly show the description, your first name or nickname and — if you provide them — the title, category, town or city, age and photos. The gesture number is assigned on approval. We never publish your e-mail address. Every published story has its own number and page address.

Before saving photos we process them: we reduce their size and remove their metadata, including GPS location and camera data. Only add photos that you are entitled to share and whose publication the people shown in them agree to. We check photos before publication; we may decide not to publish them or remove them.

Your keepsake and sending it by e-mail

Every gesture that is added receives a keepsake — an image with the gesture number and the first name or nickname you gave. At random, on average for one gesture in a hundred, we award an Angel instead of a heart. The image is created in your browser; you can download and share it. The keepsake of a published gesture is available at a page address containing its number.

If you give an e-mail address, we will send your keepsake to it — right after the gesture is published or once it has been approved. Until then we keep the address, and we delete it after sending (unless you also chose to receive news about the Campaign). Messages are sent through the e-mail provider Resend. The legal basis is your consent, given by providing the address for this purpose (Article 6(1)(a) GDPR).

Likes, comments and shares

Every published gesture can be liked, commented on and shared. So that each person can like a gesture only once, we store a one-way hash of a random identifier from the __Host-mag_device cookie (no personal data), and your browser remembers which gestures you have liked. Shares are counted in total. The legal basis is the controller’s legitimate interest (Article 6(1)(f) GDPR) — a fair ranking of gestures and protection against artificially inflated likes.

When you comment, you give a first name or nickname and the text of the comment, which we publish under the gesture on the basis of your consent (Article 6(1)(a) GDPR). Comments are checked automatically: vulgar language is blocked, and comments with links or contact details wait for a moderator. We may decide not to publish, or remove, a comment that breaks the campaign’s rules. We keep a comment until you withdraw your consent or the campaign ends.

Gesture of passing the good on

You can also save a “gesture of passing the good on” — a statement that you have invited at least 3 people to the Campaign. In that case you only give your first name or a nickname; we do not collect any data about the people you invited. We count such a gesture once per person: for this purpose we store a one-way hash of a random identifier from the __Host-mag_device cookie (no personal data). Once approved, the gesture is added to the Great Clock and can be found by its number; we do not show it in the story lists.

Submission status link

After saving a gesture you receive a private link where you can check whether it has been approved. We store only a hash of this link in our database — without the link it is impossible to tell which submission is yours.

We also record which version of this notice you accepted and when — this is the confirmation of your consent to publication. The consent covers publication on this website; any other use of the story requires a separate agreement.

Campaign news by e-mail

If you tick “I want to receive news about the Campaign” and enter your e-mail address, we will use it only to send you information about the My Angelic Gesture Campaign (for example about the counter’s progress, new stages of the campaign and events). The legal basis is your consent, given by voluntarily providing your address for this purpose (Article 6(1)(a) GDPR). We do not pass your address on to other parties for marketing purposes. You can withdraw your consent at any time by writing to gest@akcjamojanielskigest.org — we will then remove your address from the list. Withdrawing consent does not affect the publication of your story.

Sharing the link to the Campaign

When you click “Share a ready-made invitation” or “Copy the message with the link”, we create your personal link (e.g. ?ref=ABCD234EFG) and keep it in your browser’s storage, and we store a random device identifier in the __Host-mag_device cookie. This lets you see how many people have opened your link, while your own visits are not counted. The link and the identifier contain no personal data.

When someone opens such a link, we count the visit in the Campaign’s reach statistics (how many people found out about it through shared links). These visits are not added to the Great Clock. So that the same person is not counted several times, we store a one-way hash created from the IP address, the browser type and the link code — without the IP address itself. Nothing is stored on the device of the person who opens the link. The legal basis is the controller’s legitimate interest (Article 6(1)(f) GDPR) — reliable measurement of the campaign’s reach.

Security and service providers

The website uses Vercel hosting, a PostgreSQL database provided by Neon and Vercel BotID form protection. The database and the functions that handle submissions are configured in the Frankfurt region. The providers may also process technical data outside the European Economic Area in line with their data processing terms and transfer safeguards, including standard contractual clauses.

To protect against spam and abuse, we process technical connection data and short-lived, secured hashes of identifiers. The legal basis is the controller’s legitimate interest (Article 6(1)(f) GDPR) in keeping the service secure. We collect contact details only if you voluntarily give your e-mail address.

To improve the website, we count in total how many times a day the “Add your Angelic Gesture” button was clicked, a form was started and sent, a link was shared or a gesture was searched for. We store only daily totals — without cookies, IP addresses or identifiers. The legal basis is the controller’s legitimate interest (Article 6(1)(f) GDPR).

We load the Spotify player in the “Campaign Anthem” section only after you click the play button — from that moment Spotify may set its own cookies in accordance with its privacy policy. We do not use advertising tools or marketing analytics. The form protection performs a necessary technical check in your browser. We do not use submissions for profiling or for decisions that produce legal effects.

How long we keep your data

We keep your story for as long as needed to review and publish it as part of the campaign, until you withdraw your consent or that purpose ends. We keep your e-mail address until you withdraw your consent to campaign news or until the campaign ends. Withdrawing consent does not affect the lawfulness of processing before the withdrawal. Data needed to show how a submission or a request was handled may be kept for the period necessary to establish, pursue or defend legal claims. Identifiers that limit the number of submissions expire after 24 hours and are deleted by a clean-up task.

Your rights

You can withdraw your consent and request access to your data, its rectification, erasure, restriction of processing or — where the law provides for it — its portability. You can also object to processing based on legitimate interest. Write to the address above and give the story number (shown with every gesture, e.g. #123), its title and the date it was added. If you did not give an e-mail address, we may ask for additional information confirming that you are the author. Please do not send a scan of an identity document.

You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) in Poland. Providing your data is voluntary, but without the required fields we cannot accept and publish your story. Remember that a public story can be read and copied by other internet users.