Privacy policy

The data controller is the editorial team of the Cytadela Warszawska portal — an independent information site, not affiliated with the museums. You can reach the team about data-protection matters through the official contact channels.

This site is informational. For tickets, reservations and events the relevant museum, not the portal, remains the controller of your data.

The portal does not operate user accounts, a mailing list or a form that sends personal data to our server. The RSS feed requires no email address.

Contact takes place through external Facebook and Instagram profiles. Information included in a message is processed by the platform under its policies and by the editors only to reply, handle a content correction or discuss collaboration. Do not send sensitive information.

When you contact the editors through an external platform, handling the message is based on taking steps at your request and the legitimate interest in replying (Art. 6(1)(b) or (f) GDPR, depending on the matter). Messages are retained only as long as needed to handle the matter and defend possible claims.

We do not sell data or share it for the editors’ own third-party marketing. When you contact us through Facebook or Instagram, the platform operator is also a recipient. Google services used for advertising and analytics are described below.

Google AdSense and Analytics tags are currently disabled, so the site does not load Google ads or measurement. When AdSense is enabled, Google and its partners may use cookies and device identifiers to serve, personalise and measure advertising; for that purpose Google acts as a separate data controller under its own policies. In the European Economic Area, personalised ads require the user’s consent. Details are described on the cookies page.

The site makes an Adsterra Native Banner available only after separate user consent. When enabled, Adsterra may process technical device and ad-interaction data as a separate party under its privacy policy. The code runs on a separate origin in an isolated iframe without access to the portal DOM or storage and without permission to open popups. Only a deliberate ad click may open the advertiser’s page in the current tab. The choice can be changed on the cookies page.

When enabled, Google Analytics (GA4) is used for aggregate traffic analysis and improving the site. Google may use cookies and identifiers for this purpose. Analytics runs in Consent Mode with consent signals denied by default and a certified IAB TCF CMP. Details are described on the cookies page.

You have the right to access your data, to rectify, erase or restrict its processing, to object, and to withdraw consent at any time, as well as to lodge a complaint with the supervisory authority. Cookie practices are described on the cookies page.