PRIVACY POLICY

  1. INTRODUCTION

 

Collegium Intermarium, entered in the register of non-public higher education institutions kept by the Minister of Education and Science under no. 385,

correspondence address ul. Zielna 39, 8th floor, 00-108 Warsaw (hereinafter referred to as the University or the Controller), fulfilling its obligations under the applicable legislation on the protection of personal data, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter referred to as GDPR), wishes to provide you with information regarding the processing and protection of your personal data.

The information contained in this Privacy Policy will help you to understand what personal data the University collects and processes, the purpose for which it is used and your rights in relation to personal data protection.

 

  1. PERSONAL DATA PROCESSING AT THE UNIVERSITY

 

The University collects and processes personal data in connection with the following:

 

  1. maintaining regular contact with the University in connection with the realization of its statutory aims, in particular by informing about organized events (including campaigns, debates, seminars, workshops, lectures, exercises, scientific and press conferences), the current activities of the University (in particular teaching and scientific activities), as well as possibilities of supporting the University’s activities,
  2. establishing contact via the contact forms available on the websites,
  3. organization of public events, debates, seminars, lectures, workshops, exercises, scientific or press conferences,
  4. organization of competitions,
  5. sharing publications, analyses, reports, brochures, standpoints of the University,
  6. donor support for the University’s activities,
  7. recruitment through the Internet system for vacancies, internships or apprenticeships at the University,
  8. establishing relations with contractors or potential contractors of the University,
  9. recruitment of candidates for studies,
  10. implementation of the education process,
  11. use of the University’s websites (use of cookies).

 

  1. CATEGORIES OF DATA PROCESSED BY THE UNIVERSITY

 

The University collects and processes personal data to the extent necessary to fulfil the purpose for which it was collected.

Depending on the purpose and the legal basis for processing personal data, the University may collect and process, inter alia, the following data:

  1. identifying information, including: name, surname, PESEL number, date of birth;
  2. contact details, including residence or correspondence address, telephone number, e-mail address;
  3. data collected and processed in connection with the statutory purposes of the University, including i.a.: data necessary for the organization of public events, data on donors in connection with the support provided to the University.

 

  1. PURPOSES, LEGAL BASIS AND PERIODS OF PROCESSING PERSONAL DATA AT THE UNIVERSITY

 

  1. If you receive invitation or information from the University regarding the fulfilment of the University’s statutory objectives, including public events organized.

 

Applies to persons who have subscribed to our mailing list, persons who communicate with the University via social media (facebook, twitter, youtube, instagram, gab), donors who have given us their contact details (e.g. in an email or in the title of a transfer), and persons whose details have been obtained by the University from publicly available sources.

 

Purpose of processing personal data Legal basis for of processing personal data Period of processing personal data
providing information on the realization of the University’s statutory aims, including information on organized public events (campaigns, debates, seminars, workshops, lectures, exercises, scientific and press conferences), as well as on the possibilities for supporting the University’s activities Article 6(1)(f) of GDPR

the realization of the controller’s legitimate interest, i.e. maintaining regular contact with our University in connection with its statutory aims

the period necessary to fulfil the purpose, but for no longer than until you object against the processing of your personal data
establishment, pursuing and defense of claims, including documentation of objections raised against the processing of personal data Article  6(1)(f) of GDPR

Article 17(3)(e) of GDPR

the legitimate interest of the Controller in processing the data

the period of limitation of potential claims under the law

 

The administration of the data of users of social media websites takes place between the operator of such a website and the University on joint administering basis. The controller of the personal data of the users of the respective social media website is its operator, who processes the personal data on the basis of its own privacy regulations. We encourage you to familiarize yourself with the above mentioned regulations. If you have questions about the processing of personal data on a social media website, please contact the operator of such website directly. At the same time, when a user interacts with the University by liking a fanpage, observing a page, reacting to posts, shares/retweets, comments, private messages on a social network, the University also becomes the controller of personal data. 

 

  1. If you use the contact forms available on the websites operated by the University.

 

Applies to individuals who have made enquiries or submissions via the contact form on websites administered or co-administered by the University.

Purpose of processing personal data Legal basis for of processing personal data Period of processing personal data
contact in relation to a question or request submitted via the contact form available on the website article 6(1)(f) GDPR

pursuing the legitimate interests of the controller in the form of communication with users of the website

the period necessary to give an answer, but for no longer than until you object against the processing of your personal data
providing information on the realization of the University’s statutory aims, including information on organized public events (campaigns, debates, seminars, workshops, lectures, exercises, scientific and press conferences), as well as on the possibilities for supporting the University’s activities Article 6(1)(f) of GDPR

the realization of the controller’s legitimate interest, i.e. maintaining regular contact with our University in connection with its statutory aims

the period necessary to fulfil the purpose, but for no longer than until you object against the processing of your personal data for that purpose, and afterwards it may be processed for the period of limitation of possible claims (Article 17(3)(e) GDPR)
establishment, pursuing and defense of claims, including documentation of objections raised against the processing of personal data Article  6(1)(f) of GDPR

Article 17(3)(e) of GDPR

the legitimate interest of the Controller in processing the data

the period of limitation of potential claims under the law

 

  1. If you participate in public events organized by the University.

 

Applies to individuals who have expressed their desire to participate in a given event, meeting, debate, seminar, lecture, workshop, exercise, scientific or press conference organized by the University, e.g. to deliver a paper or participate as a listener in a conference by filling in a form on the website informing about the given conference or by filling in a form at the reception desk directly before the event.

Purpose of processing personal data Legal basis for of processing personal data Period of processing personal data
 

providing information on an event, meeting, debate, seminar, lecture, workshop, exercise, scientific or press conference

Article  6(1)(f) of GDPR
pursuing the legitimate interests of the controller, i.e. communication with persons who have expressed their will to participate in a given public event
the period necessary to provide information about the organized event, but for no longer than until you object against the processing of your personal data
providing information on the realization of the University’s statutory aims, including information on organized public events, as well as on the possibilities for supporting the University’s activities Article  6(1)(f) of GDPR
the realization of the controller’s legitimate interest, i.e. maintaining regular contact with our University in connection with its statutory aims
the period necessary to fulfil the purpose, but for no longer than until you object against the processing of your personal data for that purpose, and afterwards it may be processed for the period of limitation of possible claims (Article 17(3)(e) GDPR)
establishment, pursuing and defense of claims, including documentation of objections raised against the processing of personal data Article  6(1)(f) of GDPR

Article 17(3)(e) of GDPR

the legitimate interest of the Controller in processing the data

the period of limitation of potential claims under the law

 

  1. If you participate in competitions organized by the University.

 

Applies to individuals taking part in competitions, workshops, etc. held by the University.

 

Purpose of processing personal data Legal basis for of processing personal data Period of processing personal data
 

preparation and realization of the competition, identification of participants, selection of the winners, awarding and giving prizes, archiving of documents

Article  6(1)(f) of GDPR
i.e. the legitimate interest of the Controller
the period necessary to fulfil the purpose of processing the personal data
publication of information on the results of the competition, including the names, surnames and images of the winners, and thus the promotion of the winners and their achievements, as well as the promotion of the University and its activities Article 6(1)(a) of GDPR, i.e. the competition winner’s consent for his/her personal data to be made public,

Article 81 of the Copyright Law – consent to dissemination of image

the period necessary to fulfil the purpose of processing the personal data
accounting of awards Article 6(1)(c) of the GDPR, i.e. to comply with a legal obligation of the controller the period for keeping accounting and tax records under the law
informing competition participants about the realization of the University’s statutory aims and about the possibilities of supporting the University’s activities Article  6(1)(f) of GDPR
the realization of the controller’s legitimate interest, i.e. maintaining regular contact with our University in connection with its statutory aims
the period necessary to fulfil the purpose, but for no longer than until you object against the processing of your personal data
 

pursuing and defense of possible claims, including complaint handling

 

Article  6(1)(f) of GDPR

Article 17(3)(e) of GDPR

the legitimate interest of the Controller

the period of limitation of potential claims under the law

 

 

  1. If you receive free publications issued by the University.

 

Applies to individuals to whom the University makes available, free of charge, scientific publications, books, reports, newsletters, brochures, analyses and position papers issued by the University.

 

Purpose of processing personal data Legal basis for of processing personal data Period of processing personal data
realization of the publication order, including its delivery to the ordering person, contact in relation to the realization of the order Article 6 (1)(b) of GDPR
i.e.: realization of free publication order
the period necessary to fulfil the purpose of processing the personal data
 

providing information on the realization of the University’s statutory aims, including information on organized public events, as well as on the possibilities for supporting the University’s activities

 

Article  6(1)(f) of GDPR
the realization of the controller’s legitimate interest, i.e. maintaining regular contact with our University in connection with its statutory aims
the period necessary to fulfil the purpose, but for no longer than until you object against the processing of your personal data for that purpose, and afterwards it may be processed for the period of limitation of possible claims (Article 17(3)(e) GDPR)
pursuing and defense of possible claims, which is a legitimate interest to process the personal data by the Controller Article 6(1)(f) of GDPR

Article 17(3)(e) of GDPR

the period of limitation of potential claims under the law

 

 

  1. If you support the University by making donations.

 

Applies to individuals making donations directly to the University’s bank account indicated on the website www.collegiumintermarium.org or through tpay.pl or PayPal payment systems. We process donors’ data in our accounting records, we use it to contact them in order to confirm the payment and to inform them about our activities.

 

 

Purpose of processing personal data Legal basis for of processing personal data Period of processing personal data
managing donors’ contributions, including issuance of certificates for tax purposes Article 6(1)(b) of GDPR the period in which the donation is made, including the issuance of a certificate allowing the amount of the donation to be deducted in the personal income tax return
contacting donors by post or e-mail in order to respond to their enquiries or requests and to thank them for their support Article 6(1)(f) of GDPR

 

the period necessary to respond to donors’ enquiries or notifications or to send acknowledgements of support to the donors
keeping accounting books and tax records Article 6(1)(c) of GDPR in conjunction with Article 74(2) of the Accounting Act and other special regulations the period of keeping books and tax records stipulated in the law
providing information on the realization of the University’s statutory aims, including information on organized public events, as well as on the possibilities for supporting the University’s activities

 

Article  6(1)(f) of GDPR
the realization of the controller’s legitimate interest, i.e. maintaining regular contact with our University in connection with its statutory aims
the period necessary to fulfil the purpose, but for no longer than until you object against the processing of your personal data for that purpose, and afterwards it may be processed for the period of limitation of possible claims (Article 17(3)(e) GDPR)
pursuing and defense of possible claims related to the concluded agreement, which is a legitimate interest to process the personal data by the Controller Article 6(1)(f) of GDPR

Article 17(3)(e) of GDPR

the period of limitation of potential claims under the law

 

 

  1. If you are interested in internship, apprenticeship or work at the University.

 

Applies to candidates for employment, internship or apprenticeship at the University

Purpose of processing personal data Legal basis for of processing personal data Period of processing personal data
assessment of the qualifications, abilities and skills of a candidate for a job, internship or apprenticeship at a particular position, which is necessary to select a suitable person for employment or cooperation with the University Article 22(1) § 1 of the Labor Code
within the scope of processing the candidate’s personal data necessary for the conclusion of the employment contract

Article 6(1)(a) of GDPR
consent to the processing of data provided in a CV or other application documents, if the candidate provides data other than: name and surname, parents’ names, date of birth, place of residence (correspondence address), education, previous employment history (e.g. image in CV, interests or the candidate expresses his/her interest in participation in future recruitments)

 

Article 6(1)(b) of GDPR
regarding civil law agreements

Article 6(1)(f) of GDPR
within the scope of the data collected during the interview and the results of the pre-selection tests

until the decision on the conclusion of the agreement is made
pursuing and defense of possible claims related to the recruitment process, which is a legitimate interest to process the personal data by the Controller Article 6(1)(f) of GDPR

Article 17(3)(e) of GDPR

the period of limitation of potential claims under the law on fighting employment discrimination

 

 

  1. If you are a contractor or potential contractor of the University

 

Applies to sole traders with whom the University has entered into contracts for supply of goods or services, or acts at the request of the above persons prior to entering into a contract.

Purpose of processing personal data Legal basis for of processing personal data Period of processing personal data
taking actions prior to entering into an agreement with potential contractors, upon their request, including verification that they meet certain requirements Article 6(1)(b) of GDPR until the conclusion of an agreement with the contractor or, if a decision is taken not to conclude an agreement, at the latest for 6 months after collection of the contractor’s personal data
performance of the contract concluded between the University and the contractor Article 6(1)(b) of GDPR period of performance of the agreement concluded with the contractor
keeping accounting books and tax records Article 6(1)(c) of GDPR in conjunction with Article 74(1 and 2) of the Accounting Act and other special regulations until the expiry of the obligation to store data under tax and accounting legislation
 

pursuing and defense of possible claims deriving from agreements with contractors

Article  6(1)(f) of GDPR

Article 17(3)(e) of GDPR

the legitimate interest of the Controller

the period of limitation of claims related to the agreement concluded with the contractor

 

 

 

  1. If you are a candidate for studies

 

Applies to candidates for master studies, PhD studies, postgraduate studies, LL.M. – Master of Laws, courses, trainings

 

Purpose of processing personal data Legal basis for of processing personal data Period of processing personal data
assessment of the qualifications, abilities and skills of a candidate for studies at the University Article 6(1)(b) of GDPR
– taking actions prior to the conclusion of an agreement to provide educational services, at the request of a candidate for studies, including verification of the candidate’s compliance with certain requirements

Article 6(1)(c) of GDPR in conjunction with Article 69(1)(1) and Article 70(1) of the Act on Higher Education and Science and §15(1)(1) of the Regulation of the Minister of Science and Higher Education of 27.09.2018 on Studies (Polish Journal of Laws of 2018, item 1861, as amended), Article 62(1) of the Act of 15 April 2011 on the System of Education Information (i.e. Polish Journal of Laws of 2021 item 584, as amended)  – legal obligation of the controller to execute recruitment process for studies

Article 6(1)(a) of GDPR – consent of the candidate to whom the data relates to provide data beyond the scope indicated in the Regulation of the Minister of Science and Higher Education of 27.09.2018. on Studies

until the conclusion of the agreement with the student or, in the case of not admitted candidates, for a maximum of 1 year after the collection of the candidate’s personal data
pursuing and defense against claims related to the recruitment process, which is a legitimate interest to process the personal data by the Controller

 

Article  6(1)(f) of GDPR

Article 17(3)(e) of GDPR

the legitimate interest of the Controller

the period of limitation of possible claims of candidates for studies

 

 

  1. If you are a student of the University 

 

Applies to students of master studies, PhD studies, postgraduate studies, LL.M. – Master of Laws, courses, trainings

 

 

Purpose of processing personal data Legal basis for of processing personal data Period of processing personal data
implementation of the educational process at the University, documentation of the course of education, including maintenance of the student’s personal file Article 6(1)(b) of GDPR
– performance of the agreement to provide educational services concluded with the student

Article 6(1)(c) of GDPR, Act on Higher Education and Science, Regulations of the Minister of Science and Higher Education of 27.09.2018 on Studies (Polish Journal of Laws of 2018, item 1861, as amended)  – legal obligation of the controller to execute recruitment process for studies

Article 6(1)(a) of GDPR – consent of the candidate to whom the data relates to provide data beyond the scope indicated in the above mentioned legal regulations

50 years in relations to the data included in the documents specified in §15 Regulations of the Minister of Science and Higher Education of 27.09.2018 on Studies (Polish Journal of Laws of 2018, item 1861, as amended)

with regard to the remaining data – a period no longer than necessary for the purpose for which the data is processed, in accordance with applicable law, including the provisions on the statute of limitations for possible claims or on keeping of accounting records

pursuing and defense against claims related to the recruitment process, which is a legitimate interest to process the personal data by the Controller Article  6(1)(f) of GDPR

Article 17(3)(e) of GDPR

the legitimate interest of the Controller

the period of limitation of possible claims of the students

 

 

  1. If you use the Internet websites of the University.

 

For your convenience, websites operated by the University use cookies to adjust the service to users’ needs (such as remembering the preferred language or font size) and for statistical purposes. By using this website the user gives consent to placement of cookies on his/her computer or other device for the purposes stated above. If the user does not wish to receive cookies, he/she can manage and control them through his/her browser settings.  Please note, however, that deleting or blocking cookies may affect the use of this website.

The website sometimes uses third-party web services to display certain content, such as images or videos. The University is not able to prevent these websites or domains from collecting information about how our users use the content posted there. To learn how they use the information they collect about users, and the possibility to resign from or delete certain cookies, please read the terms and conditions of use of those websites regarding their privacy and cookie policies

 

  1. UYOUR RIGHTS IN RELATION TO THE UNIVERSITY PROCESSING OF YOUR DATA

 

In relation to the processing of your personal data by the University, you are entitled to:

  1. the right of access your personal data pursuant to Article 15 of the GDPR;
  2. the right to rectify your personal data pursuant to Article 16 of the GDPR;
  3. the right to request deleting of the data in the cases set out in Article 17(1) of GDPR (subject to the exceptions set out in the provision of Article 17(3) of GDPR), in particular if you have exercised the following rights:
      1. the right to withdraw consent – where the University processes personal data on the basis of consent – individuals have the right to withdraw their consent at any time, without affecting the lawfulness of processing that was carried out on the basis of the consent given before withdrawal. Please note, however, that the University does not process personal data on the basis of consent, as it usually acts on the basis of other legal grounds contained in Article 6 of the GDPR and set out in Section IV of this Policy. The fulfilment of any of the legal bases set out in Article 6 of the GDPR is sufficient for the University to process your data;
      2. the right to object – in the case of the processing of your personal data on the basis of a legitimate interest pursued by the University (e.g. in the case of informing about realization of the University’s statutory objectives, sending invitations to public events organized by the University, sending notes to thank the donors for their support). In such a case, the University will no longer process the personal data or will restrict the processing unless it demonstrates that there are valid, legitimate grounds for the processing overriding the interests, rights and freedoms of the person to whom the data relate, or grounds for the establishment, assertion and defense of the University’s claims
  4. the right to request the restriction of data processing in the cases referred to in Article 18 of the GDPR;
  5. the right to transfer the data in the cases specified in Article 20 of the GDPR.

 

In order to exercise any of these rights, please send an e-mail to iod@collegiumintermarium.org or contact us by post at: Uczelnia Collegium Intermarium, ul. Zielna 39, VIII piętro, 00-108 Warszawa.

 

If you consider that the processing of your personal data violates data protection regulations, you also have the right to lodge a complaint with the Head of the Personal Data Protection Office.

 

  1. MAKING AUTOMATED DECISIONS ON YOUR PERSONAL DATA

 

Your personal data may be processed by the University by automated means, including profiling. However, decisions concerning an individual person related to this processing will not be automated

  1. SHARING YOUR PERSONAL DATA WITH THIRD PARTIES

 

The University uses appropriate technical and organizational measures to keep your personal data safe, including securing personal data against unauthorized access, loss or destruction. In order to ensure the security of your personal data, the University has implemented appropriate personal, organizational, technical (IT) and physical safeguards.

 

We only transfer personal data to other parties if we are legally permitted to do so. In this case, we contractually provide for provisions and security mechanisms to protect the data and to maintain our standards for data protection, confidentiality and security.

 

The following entities may have access to your personal data:

  1. employees and associates of the University who are authorized to process your personal data as instructed by the Controller;
  2. entities entrusted by the University with the processing of your personal data, including entities providing hosting, IT, printing, mailing, payment, legal, accounting and HR services to the University.

The University may transfer your personal data to countries outside the European Economic Area and international organizations, which is related to the scope of the University’s activities and the cooperation undertaken with various entities. The University ensures that data will be transferred to countries in respect of which the European Commission has issued decisions on their compliance with an adequate level of personal data protection or in compliance with all legal requirements, including on the basis of an appropriate agreement containing data protection clauses adopted by the European Commission, ensuring an adequate manner of securing the transferred personal data.

 

  1. AMENDMENTS HERETO

 

Taking into consideration the principle of transparency, the University will regularly review and update the above Privacy Policy by publishing a new version on its website.