Privacy Policy
Privacy Policy of Stowarzyszenie Polish Quality Board
Version 1.0 of 17 October 2026. In the event of any discrepancy between the language versions, the Polish version prevails.
1. Controller and contact
The controller of your personal data within the meaning of Art. 4(7) GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council) is Stowarzyszenie Polish Quality Board, an association with its registered office in Niemcz, ul. ks. H. Mrossy 4c/14, 86-032 Niemcz, Poland, KRS 0001200368, NIP (tax ID) 5543040791, REGON 543007740 (“PQB”).
PQB has not appointed a data protection officer. For data protection matters, contact us:
- by e-mail: rodo@pqb.org.pl,
- by post: at our registered office address, marked “Data protection”.
We reply without undue delay and no later than one month after receiving your message.
2. How to read this policy
The policy consists of a common part (section 3), which applies to everyone, and modules describing specific situations. Find the module that applies to you – each covers the same points: purpose and legal basis, scope of data, source of data, recipients, retention period and whether providing the data is required.
| Module | Applies to |
|---|---|
| A | Candidates taking examinations (on-site, online and remote) |
| B | People who pay for PQB services or receive invoices from us |
| C | PQB members and membership applicants |
| D | Contractors, collaborators, authors, translators and company representatives |
| E | Training providers and trainers in the accreditation process |
| F | Employees and job applicants |
| G | Event participants and speakers (call for papers) |
| H | Newsletter subscribers |
| I | People who contact us by e-mail or through social media |
| J | Users of the pqb.org.pl website |
| K | Customers of the voucher shop shop.pqb.org.pl |
Where we collect data (e.g. the exam registration form, the membership declaration), we show a short notice referring to the relevant module.
3. Rules common to all modules
3.1 Your rights
In connection with the processing of your data, you have the right to:
- access your data and receive a copy (Art. 15 GDPR),
- rectification (Art. 16 GDPR),
- erasure (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- portability of data processed on the basis of a contract or consent (Art. 20 GDPR),
- object to processing based on PQB’s legitimate interest – on grounds relating to your particular situation (Art. 21 GDPR); an objection to direct marketing needs no justification,
- withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
To exercise these rights, write to the address given in section 1.
3.2 Complaint to the supervisory authority
You may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl) if you believe that we process your data unlawfully.
3.3 Who we share data with
Each recipient receives only the data needed for its task. Specific recipients are listed in each module. For example, the accounting office and the bank see only billing data (module B) – they have no access to exam results or recordings.
In all modules, data may also be disclosed to:
- Google Ireland Limited (Google Workspace) – provider of PQB’s e-mail and document storage, acting as a processor under a data processing agreement (Art. 28 GDPR); data may be transferred to Google LLC in the USA on the terms set out in section 3.4,
- public authorities and other bodies entitled by law (e.g. courts, law enforcement, tax offices) – only at their request and to the extent provided by law.
Within PQB, only authorised persons (Board members and people entrusted with specific tasks) have access to data, and they are bound by confidentiality.
3.4 Transfers outside the European Economic Area
As a rule, we process data within the EEA. Where a service provider processes data outside the EEA (e.g. Google LLC in the USA for Google Analytics – module J, or a proctor outside the EEA watching a remote exam live – module A), we rely on a European Commission adequacy decision (EU–US Data Privacy Framework) or on standard contractual clauses approved by the European Commission. You may request a copy of these safeguards.
3.5 Establishing, pursuing and defending claims
In all modules we may also process data to establish, pursue or defend legal claims (e.g. in a dispute over a payment or an exam result). The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). For this purpose we keep data until the limitation period expires – as a rule 6 years, and 3 years for claims related to business activity and periodic claims (e.g. membership fees), counted from the end of the calendar year (Art. 118 of the Polish Civil Code).
3.6 Automated decision-making
We do not carry out profiling. The only decision that may be made automatically is the exam result, based on the number of correct answers and the pass mark set by ISTQB®. This is necessary to perform the exam contract (Art. 22(2)(a) GDPR). You have the right to contest the result and request a review by a human: send an e-mail to info@pqb.org.pl describing the circumstances, no later than 6 days after the exam.
3.7 Changes to this policy
We update the policy when our processes, providers or the law change. The current version is always available at pqb.org.pl/polityka-prywatnosci, and changes are described in the change history at the end of this document.
Module A – Examination candidates
We process your data to conduct the exam, give you your result and – if you pass – issue your certificate and confirm it in the future. Below is the full list of data we collect.
| Data | When | Purpose and legal basis | Who has access | Retention |
|---|---|---|---|---|
| Full name, e-mail address | Exam registration | Organising the exam, providing the result, issuing the certificate – Art. 6(1)(b) GDPR | PQB; GASQ (examination system) | See “Retention period” below |
| Nationality | Registration | Preparing aggregate exam statistics for ISTQB® – Art. 6(1)(f) GDPR | PQB; GASQ | As above |
| Telephone number (optional) | Registration | Organisational contact – Art. 6(1)(b) GDPR | PQB; GASQ | As above |
| Training provider, trainer (optional) | Registration | Quality oversight of accredited training and statistics – Art. 6(1)(f) GDPR | PQB | As above |
| Exam voucher code | Registration | Confirming payment for the exam – Art. 6(1)(b) GDPR | PQB; GASQ | As above |
| Login, IP address, device and browser information, session data | Log-in and exam | Security of the system and of the exam – Art. 6(1)(b) and (f) GDPR | GASQ | As above |
| Answers and exam result | Exam | Marking the exam, certification – Art. 6(1)(b) GDPR; settlement of licence fees for exams held – Art. 6(1)(c) GDPR | PQB; GASQ | As above |
| Identity document – on-site exam | Before the exam | Checking that the name matches the registration – Art. 6(1)(b) GDPR | Exam invigilator | Shown only – we do not copy or record any data from the document |
| Photo (copy) of identity document, camera and microphone video and audio recording, screen capture – remote exam | Log-in and exam | Confirming that the right person logs in to the exam and supervising the exam – Art. 6(1)(b) GDPR | GASQ, ExamUnit and the remote proctor; PQB only when investigating irregularities | Deleted automatically 14 days after the exam |
| Technical support requests | When you contact support | Solving the problem – Art. 6(1)(b) GDPR | PQB; GASQ | As above |
| Full name, certificate name, number and date | After passing the exam | Entry in the public ISTQB® Successful Candidate Register – Art. 6(1)(f) GDPR | ISTQB® and anyone who checks the register | Until you object |
| Invoice data | Purchase of an exam or voucher | Billing – module B (shop purchase – module K) | See module B | See module B |
We do not collect your PESEL number, date of birth or home address.
We use the copy of your identity document only temporarily, to confirm that the right person logs in to the remote exam. It is deleted together with the recording 14 days after the exam.
Recipients.
- GASQ Service GmbH, Oberhaching, Germany – provider of the examination system in which you register, take the exam (online, remotely or on paper) and receive your result and certificate. GASQ acts solely on our instructions under a data processing agreement (Art. 28 GDPR) and stores data only on servers in the EU/EEA. For remote exams GASQ uses a sub-processor – ExamUnit GmbH, Germany (remote exam platform and proctoring).
- Remote exam proctors – may be located outside the EEA. They watch the live stream but do not store it. Such live viewing is a transfer of data to a third country, safeguarded by the European Commission’s standard contractual clauses (section 3.4).
- International Software Testing Qualifications Board (ISTQB®) AISBL, Belgium – receives only aggregate exam statistics (numbers, without names) that do not identify you. Your name reaches ISTQB® only through the SCR entry after you pass the exam (below).
The accounting office and the bank have no access to examination data.
Entry in the SCR. After you pass the exam, we enter your data in the register at scr.istqb.org so that employers and others can verify your certificate. If you do not want to be listed, write to info@pqb.org.pl within 7 days of receiving your result – we will then not enter your data. You may also object later; we will then remove the entry or have it removed.
Source of data. You provide the data yourself on the registration form. If a training provider or your employer registered you, we received your name, e-mail address and training information from them (Art. 14 GDPR).
Retention period.
- Passed exam: for as long as the certificate is valid; after it expires we delete the data within 6 months. ISTQB® certificates are generally issued without an expiry date – in that case we keep the data for as long as needed to confirm the authenticity of the certificate and to reissue it (Art. 6(1)(f) GDPR).
- Failed exam: 6 years from the end of the calendar year in which the exam took place, after which we delete the data within 6 months. During this time the data is needed to settle licence fees for exams held (accounting obligations, module B), to prepare aggregate statistics for ISTQB® and for possible claims (section 3.5).
- Recordings and the copy of the identity document from a remote exam: 14 days after the exam, unless they are needed to handle an appeal or investigate a reported irregularity – in that case until it is concluded.
Is providing data required? Your name and e-mail address are required to conclude the exam contract. For a remote exam, identity verification and recording of the exam are also required. Other data is optional.
In a remote exam, your face is compared with the photo in your identity document by a proctor (a human). We do not use automated facial recognition or process biometric data.
Module B – Billing and payments
This module applies to anyone who pays PQB or receives an invoice from us (for an exam, membership fee, accreditation or event), as well as people acting on behalf of a paying company. Billing data is kept separate from other data – the recipients listed in this module have no access to exam results, membership declarations or other documents.
Scope of data. Full name or company name, invoice address, NIP/VAT number (where applicable), e-mail address for sending the invoice, payment data (amount, date, account from which the payment was made, transfer title).
Purposes and legal bases.
- Issuing invoices and settling payments – Art. 6(1)(b) GDPR (contract); for people acting on behalf of a company – Art. 6(1)(f) GDPR.
- Tax and accounting obligations, including issuing invoices in the National e-Invoicing System (KSeF) – Art. 6(1)(c) GDPR.
- Recovering overdue payments – section 3.5.
Recipients.
- Simple Taxes Sp. z o.o., ul. Szomańskiego 43, 02-495 Warsaw, Poland, NIP 5223119628 – the accounting office keeping PQB’s books, under a data processing agreement,
- Bank Polska Kasa Opieki S.A. (Bank Pekao S.A.), ul. Żubra 1, Warsaw – the bank holding PQB’s account,
- PayPro S.A. – payment operator for the shop (module K),
- the National e-Invoicing System and tax authorities – to the extent required by law.
Source of data. From you or from the company that pays for the service and named you as a contact person (Art. 14 GDPR).
Retention period. 5 years from the end of the calendar year in which the tax payment deadline expired (Polish Tax Ordinance, Accounting Act), and for claims – as set out in section 3.5.
Is providing data required? Yes – without it we cannot issue an invoice or accept payment.
Module C – Members and membership applicants
Scope of data. Full name, e-mail address, telephone number, correspondence address, employer (needed to apply the statutory limit on members from one employer), membership category and its changes, membership fee information, signed non-disclosure agreement (NDA), participation in the General Meeting (attendance lists, votes, minutes). For members of the Board and the Audit Committee also: PESEL number and address for service – only because the National Court Register (KRS) requires them.
Purposes and legal bases.
- Considering the membership declaration, the probationary membership period and administering membership in accordance with the statute – Art. 6(1)(b) GDPR.
- Obligations under the Polish Associations Act and the National Court Register Act (e.g. filing the composition of the governing bodies) – Art. 6(1)(c) GDPR.
- Documenting the association’s activities (minutes, resolutions), communicating with members, representing PQB in ISTQB® and other international organisations – Art. 6(1)(f) GDPR.
- Settling membership fees – module B.
Recipients. The registry court (KRS) – data of members of the governing bodies, which becomes public in the register. ISTQB® and other organisations of which PQB is a member – name and e-mail of the people representing PQB. On pqb.org.pl we publish the names and roles of members of the governing bodies.
Source of data. The membership declaration and documents you submit during your membership.
Retention period.
- For the duration of membership and, after it ends, 3 years (settling membership fees, section 3.5).
- Declaration of an applicant who was not admitted – up to 12 months from the decision.
- NDA – for the confidentiality period set out in it.
- Minutes and resolutions of the governing bodies – for the whole period of PQB’s activity, as the association’s records.
Is providing data required? Yes – without the data in the declaration we cannot consider the membership application. Only people elected to the governing bodies provide their PESEL number.
Module D – Contractors, collaborators and authors
This module covers people who enter into civil-law contracts with PQB (mandate contracts, contracts for specific work, service contracts, copyright agreements – e.g. authors and reviewers of exam questions, syllabus translators), as well as people representing companies and organisations PQB works with (including partner ISTQB® Member Boards).
Scope of data.
- Person entering into a contract: full name, address, e-mail address, telephone number, bank account number; for contracts on which PQB withholds tax or pays social security contributions – also PESEL number, tax office and data required by ZUS (Social Insurance Institution); for sole traders – NIP.
- Company representative or contact person: full name, position or role, e-mail address, telephone number.
Purposes and legal bases.
- Concluding and performing a contract with an individual – Art. 6(1)(b) GDPR.
- Contact with representatives of companies and organisations when concluding and performing contracts – Art. 6(1)(f) GDPR.
- Tax, social security and copyright law obligations – Art. 6(1)(c) GDPR.
- Attributing authorship and documenting rights to works (questions, translations, materials) – Art. 6(1)(f) GDPR.
Recipients. Recipients from module B (remuneration and invoices). The Social Insurance Institution (ZUS) and tax offices – to the extent required by law. Partner organisations with which PQB runs joint projects (e.g. a joint exam question pool) and ISTQB® – the name of the author or translator and information about the work, where the agreement with the partner requires it.
Source of data. From you or from the company or organisation you represent or that named you as a contact person (Art. 14 GDPR).
Retention period. For the term of the contract and then for the period required by tax law (module B) and the limitation period for claims (section 3.5). If the contract concerns a transfer of copyright or a licence – until those rights expire.
Is providing data required? Yes – without it we cannot conclude or perform the contract.
Module E – Accreditation of training providers and trainers
PQB accredits training providers (ATPs) and trainers in accordance with ISTQB® rules. Applications are accepted at akredytacja@pqb.org.pl.
Scope of data.
- Training provider representatives and contact persons: full name, role, e-mail address, telephone number.
- Trainers: full name, e-mail address, certificates held (name, number, date), description of professional and teaching experience (CV), results of the assessment or observation of a training course carried out as part of accreditation.
Purposes and legal bases.
- Considering the application, granting and maintaining accreditation, quality oversight of training – Art. 6(1)(b) GDPR for people applying in their own name; Art. 6(1)(f) GDPR for trainers and representatives named by the provider (PQB’s interest in running accreditation in line with ISTQB® requirements).
- Publishing the list of accredited providers – Art. 6(1)(f) GDPR.
- Settling accreditation fees – module B.
Recipients. ISTQB® – data of accredited providers and, where ISTQB® rules require it, of trainers. People assessing training materials or observing courses on behalf of PQB – bound by confidentiality. The list of accredited providers is public on pqb.org.pl and istqb.org; we publish trainers’ names only with their consent (Art. 6(1)(a) GDPR).
Source of data. From you or from the training provider that named you as a trainer or contact person (Art. 14 GDPR).
Retention period. For the period of accreditation and, after it expires or is refused, for the limitation period for claims (section 3.5).
Is providing data required? Yes – without it we cannot carry out the accreditation.
Module F – Employees and job applicants
This module applies when PQB recruits or employs staff under employment contracts. People working under civil-law contracts are covered by module D.
Scope of data.
- Applicants: full name, date of birth, contact details, education, professional qualifications, employment history (Art. 22¹ § 1 of the Polish Labour Code), and any other data you provide in your CV.
- Employees: additionally home address, PESEL number, family members’ data (where needed for employee entitlements), bank account number and other data required by labour law.
Purposes and legal bases.
- Recruitment, concluding and performing the employment contract, keeping employee records, payroll – Art. 6(1)(b) and (c) GDPR in conjunction with Art. 22¹ of the Labour Code.
- Data in your CV beyond what the law requires, and taking part in future recruitment – Art. 6(1)(a) GDPR (consent).
Recipients. Recipients from module B (payroll). The Social Insurance Institution (ZUS), tax offices, occupational health physician – to the extent required by law.
Retention period.
- Applicants: until the recruitment ends; with consent to future recruitment – for 12 months.
- Employees: employee records – 10 years from the end of the calendar year in which the employment ended (Art. 94(9b) of the Labour Code).
Is providing data required? Data required by the Labour Code – yes; other data is optional.
Module G – Events and call for papers
This module applies to participants in conferences, meetups, workshops and webinars organised by PQB, and to people submitting talks in a call for papers (CFP).
Scope of data.
- Participants: full name, e-mail address, company and position (optional), answers to the post-event survey (if the survey is not anonymous).
- Talk submitters and speakers: full name, e-mail address, telephone number, company, bio, photo, talk description, materials (slides), recording of the talk.
- Image: photos and recordings made during events.
Purposes and legal bases.
- Registration and participation in the event, reviewing CFP submissions, cooperation with speakers – Art. 6(1)(b) GDPR.
- Publishing the programme with the speaker’s name, bio and photo, and the recording of the talk – on the basis of the agreement with the speaker or their consent (Art. 6(1)(a) or (b) GDPR, Art. 81 of the Polish Copyright Act).
- Photos and recordings reporting on the event in which participants appear as part of a larger whole (e.g. the audience) – Art. 6(1)(f) GDPR (promotion of statutory activities), Art. 81(2)(2) of the Polish Copyright Act. We inform about photography at registration and on site.
- Evaluating the event through surveys – Art. 6(1)(f) GDPR.
Recipients. Providers of registration systems and webinar platforms, if we use them for a given event – under a data processing agreement. Recipients from module B for paid events. The public – as regards the published programme, photos and recordings (pqb.org.pl, PQB social media). We share participants’ data with partners and sponsors only with separate consent.
Retention period.
- Participant list – up to 12 months after the event (paid events – also module B).
- Rejected CFP submissions – up to 12 months after the event.
- Event programme, published photos and recordings – as an archive of PQB’s activities, until consent is withdrawn or an objection is upheld.
Is providing data required? Your name and e-mail address are required to register or submit a talk; other data is optional.
Module H – Newsletter
This module applies from the launch of the PQB newsletter.
Scope of data. E-mail address, first name (optional), date and method of subscription and confirmation, information on opening messages and clicking links (if the tool collects it).
Purposes and legal bases.
- Sending the newsletter with information about PQB’s activities, exams and events – Art. 6(1)(a) GDPR and consent to receive electronic communications (Art. 398 of the Polish Electronic Communications Law).
- Demonstrating that consent was given – Art. 6(1)(f) GDPR.
Subscription must be confirmed by clicking a link in an e-mail (double opt-in). We always collect newsletter consent separately – it is not a condition for taking an exam, attending an event or membership. Every message contains an unsubscribe link.
Recipients. The provider of the newsletter tool – under a data processing agreement.
Retention period. Until consent is withdrawn. After you unsubscribe, we keep your e-mail address and proof of giving and withdrawing consent for the limitation period for claims (section 3.5).
Is providing data required? No – subscription is voluntary; without an e-mail address we cannot send the newsletter.
Module I – Correspondence and social media
Correspondence. When you write to us by e-mail or post, we process your contact details and the content of your message to reply and deal with the matter – Art. 6(1)(f) GDPR. If the matter concerns a contract, exam, membership or accreditation, the relevant module applies. Other correspondence is kept for up to 12 months after the matter is closed and, if it may be needed to defend claims, as set out in section 3.5. The recipient is our e-mail provider (section 3.3).
Social media and community. When you follow our profiles, comment, send a message, join our Discord server or submit changes to our repositories, we process your user name, public profile data and the content of the interaction. We do this to run PQB’s profiles and community and to reply to messages – Art. 6(1)(f) GDPR.
| Service | PQB profile | Service operator |
|---|---|---|
| Polish Quality Board | LinkedIn Ireland Unlimited Company | |
| Polish Quality Board | Meta Platforms Ireland Limited | |
| GitHub | POLISH-QUALITY-BOARD | GitHub, Inc. |
| Discord | “Polish Quality Board” server | Discord Inc. |
The operators also process your data on their own account, in accordance with their privacy policies. For page statistics on LinkedIn and Facebook, PQB is a joint controller with the service operator (Art. 26 GDPR) – we see only aggregate data on reach and audience. We process messages and interactions while they are visible on the service or while you are a member of the community; moderators of the Discord server may remove content that breaks its rules.
Module J – Website, cookies and Google Analytics
Server logs. On every visit to pqb.org.pl the server records the IP address, date and time, the address of the page opened and browser information. We do this to keep the website running and protected against abuse – Art. 6(1)(f) GDPR. The recipient is the hosting provider – GitHub, Inc. (GitHub Pages), USA; the transfer takes place on the terms set out in section 3.4. The log retention period is set by GitHub in its privacy policy.
Google Analytics. With your consent we use Google Analytics 4 to know how many people visit the website and which pages are read most often. Legal bases: consent to storing cookies (Art. 399 of the Polish Electronic Communications Law) and Art. 6(1)(a) GDPR. Without consent, Google Analytics does not store cookies on your device. The provider is Google Ireland Limited; data may be transferred to Google LLC in the USA on the terms set out in section 3.4. We keep data in Google Analytics for 14 months [to be confirmed in GA settings]. You can withdraw consent at any time in the cookie settings on the website.
Google Tag Manager. We load Google Analytics on the website through Google Tag Manager (provider: Google Ireland Limited). Tag Manager itself does not store cookies, but when the page loads your browser connects to Google servers, which receive your IP address and browser information. This is necessary for the consent mechanism to work – Art. 6(1)(f) GDPR. Google Analytics tags fire only after you give consent in the banner.
Cookies used on the website.
| Name | Provider | Purpose | Duration | Consent required |
|---|---|---|---|---|
cookie-consent | PQB | Remembering your choice in the banner (value “granted” or “denied”) | 12 months | No (strictly necessary) |
_ga | Distinguishing users in statistics | 2 years | Yes | |
_ga_<ID> | Keeping session state in statistics | 2 years | Yes |
You can also delete or block cookies in your browser settings.
On your first visit we display a banner in which you accept or reject Google Analytics cookies.
You can change your decision at any time – click “Ustawienia cookies” (cookie settings) in the website footer.
Module K – Voucher shop (shop.pqb.org.pl)
In the shop shop.pqb.org.pl we sell exam vouchers and study materials. We send the voucher by e-mail; you activate it when registering for the exam in the GASQ system (module A).
Scope of data. Full name, e-mail address, telephone number, address (for products shipped by post), company invoice data (name, NIP/VAT number, address), order history, shop account data (if you create one), payment information (status, amount, date).
Purposes and legal bases.
- Fulfilling the order, sending the voucher, handling complaints and withdrawal from the contract – Art. 6(1)(b) GDPR.
- Maintaining your shop account – Art. 6(1)(b) GDPR.
- Invoices and billing – module B.
- Shop security and statistics – Art. 6(1)(f) GDPR; analytics cookies only with consent (module J applies accordingly).
Recipients.
- cyber_Folks S.A., ul. Wierzbięcice 1B, 61-569 Poznań, Poland, KRS 0000685595, NIP 7792467259 – provider of the Shoper shop platform and hosting, under a data processing agreement (provider’s privacy policy).
- PayPro S.A., Poznań – a national payment institution (reg. no. IP24/2014) that processes payments in the shop (card, BLIK, fast bank transfer); cyber_Folks S.A. acts as its agent. PayPro processes payment data as a separate controller, as described in its privacy policy.
- Postal or courier operator – only for physically shipped products.
- Recipients from module B (invoices).
The shop does not pass your data to GASQ. It only retrieves the voucher code from the GASQ system, which we then send to you by e-mail.
Retention period. Order data – for the period required by tax law (module B) and the limitation period for claims (section 3.5). Account data – until the account is deleted.
Is providing data required? Yes – without your name and e-mail address we cannot fulfil the order or send the voucher.
The shop is run by PQB; this policy applies to personal data processed in it.
Change history
| Version | Date | Change |
|---|---|---|
| 1.0 | 17.10.2026 | First version: common part and modules A–K |