PRIVACY POLICY
- INTRODUCTION
Collegium Intermarium, entered in the register of non-public higher education institutions kept by the Minister of Education and Science under no. 385,
correspondence address ul. Zielna 39, 8th floor, 00-108 Warsaw (hereinafter referred to as the University or the Controller), fulfilling its obligations under the applicable legislation on the protection of personal data, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter referred to as GDPR), wishes to provide you with information regarding the processing and protection of your personal data.
The information contained in this Privacy Policy will help you to understand what personal data the University collects and processes, the purpose for which it is used and your rights in relation to personal data protection.
- PERSONAL DATA PROCESSING AT THE UNIVERSITY
The University collects and processes personal data in connection with the following:
- maintaining regular contact with the University in connection with the realization of its statutory aims, in particular by informing about organized events (including campaigns, debates, seminars, workshops, lectures, exercises, scientific and press conferences), the current activities of the University (in particular teaching and scientific activities), as well as possibilities of supporting the University’s activities,
- establishing contact via the contact forms available on the websites,
- organization of public events, debates, seminars, lectures, workshops, exercises, scientific or press conferences,
- organization of competitions,
- sharing publications, analyses, reports, brochures, standpoints of the University,
- donor support for the University’s activities,
- recruitment through the Internet system for vacancies, internships or apprenticeships at the University,
- establishing relations with contractors or potential contractors of the University,
- recruitment of candidates for studies,
- implementation of the education process,
- use of the University’s websites (use of cookies).
- CATEGORIES OF DATA PROCESSED BY THE UNIVERSITY
The University collects and processes personal data to the extent necessary to fulfil the purpose for which it was collected.
Depending on the purpose and the legal basis for processing personal data, the University may collect and process, inter alia, the following data:
- identifying information, including: name, surname, PESEL number, date of birth;
- contact details, including residence or correspondence address, telephone number, e-mail address;
- data collected and processed in connection with the statutory purposes of the University, including i.a.: data necessary for the organization of public events, data on donors in connection with the support provided to the University.
- PURPOSES, LEGAL BASIS AND PERIODS OF PROCESSING PERSONAL DATA AT THE UNIVERSITY
- If you receive invitation or information from the University regarding the fulfilment of the University’s statutory objectives, including public events organized.
Applies to persons who have subscribed to our mailing list, persons who communicate with the University via social media (facebook, twitter, youtube, instagram, gab), donors who have given us their contact details (e.g. in an email or in the title of a transfer), and persons whose details have been obtained by the University from publicly available sources.
Purpose of processing personal data | Legal basis for of processing personal data | Period of processing personal data |
providing information on the realization of the University’s statutory aims, including information on organized public events (campaigns, debates, seminars, workshops, lectures, exercises, scientific and press conferences), as well as on the possibilities for supporting the University’s activities | Article 6(1)(f) of GDPR
the realization of the controller’s legitimate interest, i.e. maintaining regular contact with our University in connection with its statutory aims |
the period necessary to fulfil the purpose, but for no longer than until you object against the processing of your personal data |
establishment, pursuing and defense of claims, including documentation of objections raised against the processing of personal data | Article 6(1)(f) of GDPR
Article 17(3)(e) of GDPR the legitimate interest of the Controller in processing the data |
the period of limitation of potential claims under the law |
The administration of the data of users of social media websites takes place between the operator of such a website and the University on joint administering basis. The controller of the personal data of the users of the respective social media website is its operator, who processes the personal data on the basis of its own privacy regulations. We encourage you to familiarize yourself with the above mentioned regulations. If you have questions about the processing of personal data on a social media website, please contact the operator of such website directly. At the same time, when a user interacts with the University by liking a fanpage, observing a page, reacting to posts, shares/retweets, comments, private messages on a social network, the University also becomes the controller of personal data.
- If you use the contact forms available on the websites operated by the University.
Applies to individuals who have made enquiries or submissions via the contact form on websites administered or co-administered by the University.
Purpose of processing personal data | Legal basis for of processing personal data | Period of processing personal data |
contact in relation to a question or request submitted via the contact form available on the website | article 6(1)(f) GDPR
pursuing the legitimate interests of the controller in the form of communication with users of the website |
the period necessary to give an answer, but for no longer than until you object against the processing of your personal data |
providing information on the realization of the University’s statutory aims, including information on organized public events (campaigns, debates, seminars, workshops, lectures, exercises, scientific and press conferences), as well as on the possibilities for supporting the University’s activities | Article 6(1)(f) of GDPR
the realization of the controller’s legitimate interest, i.e. maintaining regular contact with our University in connection with its statutory aims |
the period necessary to fulfil the purpose, but for no longer than until you object against the processing of your personal data for that purpose, and afterwards it may be processed for the period of limitation of possible claims (Article 17(3)(e) GDPR) |
establishment, pursuing and defense of claims, including documentation of objections raised against the processing of personal data | Article 6(1)(f) of GDPR
Article 17(3)(e) of GDPR the legitimate interest of the Controller in processing the data |
the period of limitation of potential claims under the law |
- If you participate in public events organized by the University.
Applies to individuals who have expressed their desire to participate in a given event, meeting, debate, seminar, lecture, workshop, exercise, scientific or press conference organized by the University, e.g. to deliver a paper or participate as a listener in a conference by filling in a form on the website informing about the given conference or by filling in a form at the reception desk directly before the event.
Purpose of processing personal data | Legal basis for of processing personal data | Period of processing personal data |
providing information on an event, meeting, debate, seminar, lecture, workshop, exercise, scientific or press conference |
Article 6(1)(f) of GDPR pursuing the legitimate interests of the controller, i.e. communication with persons who have expressed their will to participate in a given public event |
the period necessary to provide information about the organized event, but for no longer than until you object against the processing of your personal data |
providing information on the realization of the University’s statutory aims, including information on organized public events, as well as on the possibilities for supporting the University’s activities | Article 6(1)(f) of GDPR the realization of the controller’s legitimate interest, i.e. maintaining regular contact with our University in connection with its statutory aims |
the period necessary to fulfil the purpose, but for no longer than until you object against the processing of your personal data for that purpose, and afterwards it may be processed for the period of limitation of possible claims (Article 17(3)(e) GDPR) |
establishment, pursuing and defense of claims, including documentation of objections raised against the processing of personal data | Article 6(1)(f) of GDPR
Article 17(3)(e) of GDPR the legitimate interest of the Controller in processing the data |
the period of limitation of potential claims under the law |
- If you participate in competitions organized by the University.
Applies to individuals taking part in competitions, workshops, etc. held by the University.
Purpose of processing personal data | Legal basis for of processing personal data | Period of processing personal data |
preparation and realization of the competition, identification of participants, selection of the winners, awarding and giving prizes, archiving of documents |
Article 6(1)(f) of GDPR i.e. the legitimate interest of the Controller |
the period necessary to fulfil the purpose of processing the personal data |
publication of information on the results of the competition, including the names, surnames and images of the winners, and thus the promotion of the winners and their achievements, as well as the promotion of the University and its activities | Article 6(1)(a) of GDPR, i.e. the competition winner’s consent for his/her personal data to be made public,
Article 81 of the Copyright Law – consent to dissemination of image |
the period necessary to fulfil the purpose of processing the personal data |
accounting of awards | Article 6(1)(c) of the GDPR, i.e. to comply with a legal obligation of the controller | the period for keeping accounting and tax records under the law |
informing competition participants about the realization of the University’s statutory aims and about the possibilities of supporting the University’s activities | Article 6(1)(f) of GDPR the realization of the controller’s legitimate interest, i.e. maintaining regular contact with our University in connection with its statutory aims |
the period necessary to fulfil the purpose, but for no longer than until you object against the processing of your personal data |
pursuing and defense of possible claims, including complaint handling
|
Article 6(1)(f) of GDPR
Article 17(3)(e) of GDPR the legitimate interest of the Controller |
the period of limitation of potential claims under the law |
- If you receive free publications issued by the University.
Applies to individuals to whom the University makes available, free of charge, scientific publications, books, reports, newsletters, brochures, analyses and position papers issued by the University.
Purpose of processing personal data | Legal basis for of processing personal data | Period of processing personal data |
realization of the publication order, including its delivery to the ordering person, contact in relation to the realization of the order | Article 6 (1)(b) of GDPR i.e.: realization of free publication order |
the period necessary to fulfil the purpose of processing the personal data |
providing information on the realization of the University’s statutory aims, including information on organized public events, as well as on the possibilities for supporting the University’s activities
|
Article 6(1)(f) of GDPR the realization of the controller’s legitimate interest, i.e. maintaining regular contact with our University in connection with its statutory aims |
the period necessary to fulfil the purpose, but for no longer than until you object against the processing of your personal data for that purpose, and afterwards it may be processed for the period of limitation of possible claims (Article 17(3)(e) GDPR) |
pursuing and defense of possible claims, which is a legitimate interest to process the personal data by the Controller | Article 6(1)(f) of GDPR
Article 17(3)(e) of GDPR |
the period of limitation of potential claims under the law |
- If you support the University by making donations.
Applies to individuals making donations directly to the University’s bank account indicated on the website www.collegiumintermarium.org or through tpay.pl or PayPal payment systems. We process donors’ data in our accounting records, we use it to contact them in order to confirm the payment and to inform them about our activities.
Purpose of processing personal data | Legal basis for of processing personal data | Period of processing personal data |
managing donors’ contributions, including issuance of certificates for tax purposes | Article 6(1)(b) of GDPR | the period in which the donation is made, including the issuance of a certificate allowing the amount of the donation to be deducted in the personal income tax return |
contacting donors by post or e-mail in order to respond to their enquiries or requests and to thank them for their support | Article 6(1)(f) of GDPR
|
the period necessary to respond to donors’ enquiries or notifications or to send acknowledgements of support to the donors |
keeping accounting books and tax records | Article 6(1)(c) of GDPR in conjunction with Article 74(2) of the Accounting Act and other special regulations | the period of keeping books and tax records stipulated in the law |
providing information on the realization of the University’s statutory aims, including information on organized public events, as well as on the possibilities for supporting the University’s activities
|
Article 6(1)(f) of GDPR the realization of the controller’s legitimate interest, i.e. maintaining regular contact with our University in connection with its statutory aims |
the period necessary to fulfil the purpose, but for no longer than until you object against the processing of your personal data for that purpose, and afterwards it may be processed for the period of limitation of possible claims (Article 17(3)(e) GDPR) |
pursuing and defense of possible claims related to the concluded agreement, which is a legitimate interest to process the personal data by the Controller | Article 6(1)(f) of GDPR
Article 17(3)(e) of GDPR |
the period of limitation of potential claims under the law |
- If you are interested in internship, apprenticeship or work at the University.
Applies to candidates for employment, internship or apprenticeship at the University
Purpose of processing personal data | Legal basis for of processing personal data | Period of processing personal data |
assessment of the qualifications, abilities and skills of a candidate for a job, internship or apprenticeship at a particular position, which is necessary to select a suitable person for employment or cooperation with the University | Article 22(1) § 1 of the Labor Code within the scope of processing the candidate’s personal data necessary for the conclusion of the employment contract Article 6(1)(a) of GDPR
Article 6(1)(b) of GDPR Article 6(1)(f) of GDPR |
until the decision on the conclusion of the agreement is made |
pursuing and defense of possible claims related to the recruitment process, which is a legitimate interest to process the personal data by the Controller | Article 6(1)(f) of GDPR
Article 17(3)(e) of GDPR |
the period of limitation of potential claims under the law on fighting employment discrimination |
- If you are a contractor or potential contractor of the University
Applies to sole traders with whom the University has entered into contracts for supply of goods or services, or acts at the request of the above persons prior to entering into a contract.
Purpose of processing personal data | Legal basis for of processing personal data | Period of processing personal data |
taking actions prior to entering into an agreement with potential contractors, upon their request, including verification that they meet certain requirements | Article 6(1)(b) of GDPR | until the conclusion of an agreement with the contractor or, if a decision is taken not to conclude an agreement, at the latest for 6 months after collection of the contractor’s personal data |
performance of the contract concluded between the University and the contractor | Article 6(1)(b) of GDPR | period of performance of the agreement concluded with the contractor |
keeping accounting books and tax records | Article 6(1)(c) of GDPR in conjunction with Article 74(1 and 2) of the Accounting Act and other special regulations | until the expiry of the obligation to store data under tax and accounting legislation |
pursuing and defense of possible claims deriving from agreements with contractors |
Article 6(1)(f) of GDPR
Article 17(3)(e) of GDPR the legitimate interest of the Controller |
the period of limitation of claims related to the agreement concluded with the contractor
|
- If you are a candidate for studies
Applies to candidates for master studies, PhD studies, postgraduate studies, LL.M. – Master of Laws, courses, trainings
Purpose of processing personal data | Legal basis for of processing personal data | Period of processing personal data |
assessment of the qualifications, abilities and skills of a candidate for studies at the University | Article 6(1)(b) of GDPR – taking actions prior to the conclusion of an agreement to provide educational services, at the request of a candidate for studies, including verification of the candidate’s compliance with certain requirements Article 6(1)(c) of GDPR in conjunction with Article 69(1)(1) and Article 70(1) of the Act on Higher Education and Science and §15(1)(1) of the Regulation of the Minister of Science and Higher Education of 27.09.2018 on Studies (Polish Journal of Laws of 2018, item 1861, as amended), Article 62(1) of the Act of 15 April 2011 on the System of Education Information (i.e. Polish Journal of Laws of 2021 item 584, as amended) – legal obligation of the controller to execute recruitment process for studies Article 6(1)(a) of GDPR – consent of the candidate to whom the data relates to provide data beyond the scope indicated in the Regulation of the Minister of Science and Higher Education of 27.09.2018. on Studies |
until the conclusion of the agreement with the student or, in the case of not admitted candidates, for a maximum of 1 year after the collection of the candidate’s personal data |
pursuing and defense against claims related to the recruitment process, which is a legitimate interest to process the personal data by the Controller
|
Article 6(1)(f) of GDPR
Article 17(3)(e) of GDPR the legitimate interest of the Controller |
the period of limitation of possible claims of candidates for studies |
- If you are a student of the University
Applies to students of master studies, PhD studies, postgraduate studies, LL.M. – Master of Laws, courses, trainings
Purpose of processing personal data | Legal basis for of processing personal data | Period of processing personal data |
implementation of the educational process at the University, documentation of the course of education, including maintenance of the student’s personal file | Article 6(1)(b) of GDPR – performance of the agreement to provide educational services concluded with the student Article 6(1)(c) of GDPR, Act on Higher Education and Science, Regulations of the Minister of Science and Higher Education of 27.09.2018 on Studies (Polish Journal of Laws of 2018, item 1861, as amended) – legal obligation of the controller to execute recruitment process for studies Article 6(1)(a) of GDPR – consent of the candidate to whom the data relates to provide data beyond the scope indicated in the above mentioned legal regulations |
50 years in relations to the data included in the documents specified in §15 Regulations of the Minister of Science and Higher Education of 27.09.2018 on Studies (Polish Journal of Laws of 2018, item 1861, as amended)
with regard to the remaining data – a period no longer than necessary for the purpose for which the data is processed, in accordance with applicable law, including the provisions on the statute of limitations for possible claims or on keeping of accounting records |
pursuing and defense against claims related to the recruitment process, which is a legitimate interest to process the personal data by the Controller | Article 6(1)(f) of GDPR
Article 17(3)(e) of GDPR the legitimate interest of the Controller |
the period of limitation of possible claims of the students |
- If you use the Internet websites of the University.
For your convenience, websites operated by the University use cookies to adjust the service to users’ needs (such as remembering the preferred language or font size) and for statistical purposes. By using this website the user gives consent to placement of cookies on his/her computer or other device for the purposes stated above. If the user does not wish to receive cookies, he/she can manage and control them through his/her browser settings. Please note, however, that deleting or blocking cookies may affect the use of this website.
The website sometimes uses third-party web services to display certain content, such as images or videos. The University is not able to prevent these websites or domains from collecting information about how our users use the content posted there. To learn how they use the information they collect about users, and the possibility to resign from or delete certain cookies, please read the terms and conditions of use of those websites regarding their privacy and cookie policies
- UYOUR RIGHTS IN RELATION TO THE UNIVERSITY PROCESSING OF YOUR DATA
In relation to the processing of your personal data by the University, you are entitled to:
- the right of access your personal data pursuant to Article 15 of the GDPR;
- the right to rectify your personal data pursuant to Article 16 of the GDPR;
- the right to request deleting of the data in the cases set out in Article 17(1) of GDPR (subject to the exceptions set out in the provision of Article 17(3) of GDPR), in particular if you have exercised the following rights:
- the right to withdraw consent – where the University processes personal data on the basis of consent – individuals have the right to withdraw their consent at any time, without affecting the lawfulness of processing that was carried out on the basis of the consent given before withdrawal. Please note, however, that the University does not process personal data on the basis of consent, as it usually acts on the basis of other legal grounds contained in Article 6 of the GDPR and set out in Section IV of this Policy. The fulfilment of any of the legal bases set out in Article 6 of the GDPR is sufficient for the University to process your data;
- the right to object – in the case of the processing of your personal data on the basis of a legitimate interest pursued by the University (e.g. in the case of informing about realization of the University’s statutory objectives, sending invitations to public events organized by the University, sending notes to thank the donors for their support). In such a case, the University will no longer process the personal data or will restrict the processing unless it demonstrates that there are valid, legitimate grounds for the processing overriding the interests, rights and freedoms of the person to whom the data relate, or grounds for the establishment, assertion and defense of the University’s claims
- the right to request the restriction of data processing in the cases referred to in Article 18 of the GDPR;
- the right to transfer the data in the cases specified in Article 20 of the GDPR.
In order to exercise any of these rights, please send an e-mail to [email protected]collegiumintermarium.org or contact us by post at: Uczelnia Collegium Intermarium, ul. Zielna 39, VIII piętro, 00-108 Warszawa.
If you consider that the processing of your personal data violates data protection regulations, you also have the right to lodge a complaint with the Head of the Personal Data Protection Office.
- MAKING AUTOMATED DECISIONS ON YOUR PERSONAL DATA
Your personal data may be processed by the University by automated means, including profiling. However, decisions concerning an individual person related to this processing will not be automated
- SHARING YOUR PERSONAL DATA WITH THIRD PARTIES
The University uses appropriate technical and organizational measures to keep your personal data safe, including securing personal data against unauthorized access, loss or destruction. In order to ensure the security of your personal data, the University has implemented appropriate personal, organizational, technical (IT) and physical safeguards.
We only transfer personal data to other parties if we are legally permitted to do so. In this case, we contractually provide for provisions and security mechanisms to protect the data and to maintain our standards for data protection, confidentiality and security.
The following entities may have access to your personal data:
- employees and associates of the University who are authorized to process your personal data as instructed by the Controller;
- entities entrusted by the University with the processing of your personal data, including entities providing hosting, IT, printing, mailing, payment, legal, accounting and HR services to the University.
The University may transfer your personal data to countries outside the European Economic Area and international organizations, which is related to the scope of the University’s activities and the cooperation undertaken with various entities. The University ensures that data will be transferred to countries in respect of which the European Commission has issued decisions on their compliance with an adequate level of personal data protection or in compliance with all legal requirements, including on the basis of an appropriate agreement containing data protection clauses adopted by the European Commission, ensuring an adequate manner of securing the transferred personal data.
- AMENDMENTS HERETO
Taking into consideration the principle of transparency, the University will regularly review and update the above Privacy Policy by publishing a new version on its website.