Protection of personal data

(Data) Controller – means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (O.J. EU L 119 of 04.05.2016).

Personal Data –  any information relating to an identified or identifiable natural person (‘data subject’). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Personal Data Processing – means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Restriction of Processing – means the marking of stored personal data with the aim of limiting their processing in the future;

Anonymisation– change of personal data resulting in depriving them of the nature of personal data.

Consent of the data subject – any voluntary, specific, aware and clear demonstration of intent by way of which the data subject, in the form of a declaration or explicit confirming action, agrees for his/her personal data to be processed. The consent must be documented in a proper manner to prove it.

1. The Controller of your personal data is Uczelnia Biznesu i Nauk Stosowanych „Varsovia”-Warsaw Management University with its seat in Warsaw, ul. Moniuszki 1a, 00-014 Warsaw (hereinafter referred to as the University) who can process your personal data for the purpose of conducting your matters or performance of obligations.
2. To contact the University, the data subject can write an e-mail to the Data Protection Officer to the address:iod@varsovia.study  
3. The personal data Controller processes your personal data under the governing law/concluded contract/consent granted by you.
4. Your personal data will be stored for the period necessary for the purposes specified in section 3 and, subsequently, for the period and in the scope required by the Act of 14 July 1983 on the national archival resources and archives (Journal of Laws of 2018, item 650, as amended) and other provisions of the commonly governing law.
5. In connection with processing of your personal data, you have the right to access your data, receive their copy and, subject to the conditions specified in GDPR*, you have the right to:
   • data rectification,
   • withdrawal of the consent granted; however, withdrawal of the consent does not affect lawfulness of processing performed under your consent prior to its withdrawal,
   • data erasure,
   • submittal of an objection,
   • data transfer,
   • restriction of data processing.

The above rights can be exercised through submittal of a written request to the University.

• You have the right to submit a complaint to the competent supervisory authority, i.e. President of the Personal Data Protection Office, if you believe that processing of personal data is in breach of the governing law in this scope.
• You will receive detailed information regarding processing of your personal data as well as your rights in the course of dealing with the matter
  
  * – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation))  

• The Controller of your personal data is Uczelnia Biznesu i Nauk Stosowanych „Varsovia”-Warsaw Management University with its seat in Warsaw, ul. Moniuszki 1a, 00-014 Warsaw (hereinafter referred to as the University). To contact the University, the data subject can write an e-mail to the Data Protection Officer to the address: iod@varsovia.study
• Your personal data will be processed for the purposes connected with activities taken upon your request, aimed at commenced of cooperation in the scope of provision of educational services at the European Education University for your benefit and for the purpose of such a cooperation to the extent necessary to perform the contract referred to above (Art. 6 section 1 letter b) of the General Data Protection Regulation of 27 April 2016)
• Additionally, the Controller may process your personal data to perform the legal obligations imposed on the Controller in connection with the subject of the conducted educational activity (Art. 6 section 1 letter c) of the General Data Protection Regulation of 27 April 2016), including but not limited to: for purposes connected with reporting to the public authorities, including supervisory authorities as well as other entities to which the bodies of the university are obliged to report under the governing law, including but not limited to the Act on Higher Education and secondary legislation to the said act.
• Furthermore, in certain situations it is or may prove to be necessary to process your personal data for purposes other than specified above and necessary due to pursuit of the legitimate interests of the Controller/university (Art. 6 section 1 letter f) of the General Data Protection Regulation of 27 April 2016), including but not limited to:
  • for purposes connected with IT support and ensuring IT and information security in the Controller’s establishment, including but not limited to management of mobile devices, administration of access and rights to systems and applications;
  • for purposes connected with ensuring physical security at the university, including but not limited to indoor and outdoor video surveillance as well as recording of entering and exiting persons;
  • if applicable, for purposes connected with dispute proceedings as well as proceedings before the public authorities and other proceedings, including but not limited to pursuit of and defence against claims;
• d. if applicable, for purposes connected with cooperation with suppliers, contractors as well as purposes connected with organisation and participation in contests, conferences, events as well as promotional and advertising activity of the Controller;
  • In cases other than specified in points 3), 4) and 5) above, your personal data will be processed exclusively on the basis of previously a granted consent, in the scope and for the purpose specified in the content of the consent.
  • Your personal data will be processed for the period necessary to perform the objectives specified above in points 3), 4) and 5), i.e. in the scope of performance of the contract concluded by you with the Controller, for the period until completion of its performance and, subsequently, for the period and in the scope required by the law or for the purposes of pursuit by the Controller of its legitimate interest in the scope determined in point 5) above, and in case of grant consent for processing of data (upon termination or expiry of the contract), your personal data will be processed until the consent is withdrawn.
• You have the right to request the following from the controller:
• access to the personal data, including the right to obtain a copy of the data;
• right to data rectification,
• right to restriction of data processing in the following cases:
  • the data subject challenges correctness of the personal data,
  • data processing is unlawful and the data subject objects to erasure of data, instead requesting their restriction,
  • the Controller does not need the data any more for its purposes, but the data subject needs them to establish, exercise or defend claims,
• right to withdraw the consent (in the scope in which you granted the consent for processing of personal data. Withdrawal of the consent does not affect lawfulness of data processing carried out based on the consent prior to its withdrawal),
• right to object to processing of personal data when processing of personal data is necessary due to purposes arising from the legitimate interest of the Controller,
• right to request erasure of the personal data (the so-called right to be forgotten in the following cases:
  • the data are no longer necessary for the purposes for which they were collected or processed in any other manner,
  • the data subject has submitted an objection against data processing,
  • the data subject withdrew his/her consent on which the processing is based and there are no other legal grounds for processing,
  • the data are processed unlawfully,
  • the data must be removed for the purpose of performance of an obligation arising from the law.
  • You have the right to submit a complaint to the supervisory authority, i.e. the President of the Personal Data Protection Office.
  • Providing your personal data is a prerequisite for conclusion and performance of the contract between you and the Controller, arises from the obligations imposed by the provisions of the law specified above or is necessary for the purposes arising from the legitimate interest Controller/university described above. Failure to provide all required personal data may be, depending on the circumstances, an obstacle in conclusion of the contract or provision of educational services. Providing data other than arising from the law is voluntary. To the extent the personal data are collected under a consent, providing personal data is voluntary.
  • In connection with processing of your personal data for the purposes specified in points 3), 4) and 5) above, your personal data may be made available to the following recipients or categories of recipients:
  • public authorities and entities performing public tasks or acting based on the instructions of public authorities, in the scope and for the purposes arising from the law (e.g.:   Ministry of Science and Higher Education, Polish Accreditation Committee),
  • entities participating in the processes necessary to perform the contract of educational services,
  • entities supporting the Controller in its business processes, including entities processing the personal data for the benefit of the Controller, the so-called Processors.

In connection with performance of the requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (O.J. EU L 119 of 04.05.2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, I inform that:

• The Controller of your personal data is Uczelnia Biznesu i Nauk Stosowanych „Varsovia”-Warsaw Management University with its seat in Warsaw, ul. Moniuszki 1a, 00-014 Warsaw (hereinafter referred to as the University). To contact the University, the data subject can write an e-mail to the Data Protection Officer to the address: iod@varsovia.study

• Your personal data will be processed for the purposes connected with activities taken upon your request, aimed at commenced of cooperation in the scope of provision of services/work, for the purposes connected with employment and performance of obligations of the employer arising from the law, including but not limited to Art. 22.1, Art. 94 of the Labour Code and other provisions of the labour law (Art. 6 section 1 letters b) and c) of the General Data Protection Regulation of 27 April 2016), including but not limited to:

• for the purpose of the recruitment procedure;
• for the purpose of registering you and your family to social insurances under Art. 36 of the Act on the social insurance system;
• for the purpose of registering you and your family members to health insurances under the terms specified in the Act on health care services financed from public funds;
• for the purpose of referring you to preliminary, check-up and periodical medical examination as well as other health care services to an occupational medicine health care centre under Art. 229 of the Labour Code and Art. 12 of the Act on occupational medicine;
• for the purpose of keeping your personal files and other documentation connected with the employment relationship, under the terms specified in the Regulation of the Ministry of Labour and Social Policy on keeping of documentation connected with the employment relationship by the employer and method of keeping of the employee’s personal files;
• for the purposes connected with ensuring occupational health and safety, performance of obligations arising from the law on occupational health and services (including training purposes), management of accidents at work as well as accidents while commuting to and from work as well as diagnosis of an occupational disease under Art. 234-235 of the Labour Code;
• for the purpose of counteracting mobbing and discrimination under Art. 94 point 2 and 94.3 of the Labour Code;
• for the purpose of responding to letters, applications, enquiries and requests for review of personal files of the employees submitted by the public authorities authorised under the law or entities authorised by you in this scope;
• for the purpose of payment of remuneration and settlement of other payments and costs connected with employment, including but not limited to tax settlements, as well as for the purpose of payment of public levies to the Tax Office, Social Insurance Institution (ZUS), State Fund for Rehabilitation of Disabled Persons (PFRON) and other public authorities;

• Additionally, the Controller may process your personal data to perform the legal obligations imposed on the Controller in connection with the subject of the conducted educational activity (Art. 6 section 1 letter c) of the General Data Protection Regulation of 27 April 2016), including but not limited to: for purposes connected with reporting to the public authorities, including supervisory authorities as well as other entities to which the bodies of the university are obliged to report under the governing law, including but not limited to the Act on Higher Education and secondary legislation to the said act.
• Furthermore, in certain situations it is or may prove to be necessary to process your personal data for purposes other than specified above and necessary due to pursuit of the legitimate interests of the Controller/university (Art. 6 section 1 letter f) of the General Data Protection Regulation of 27 April 2016), including but not limited to:

• for purposes connected with IT support and ensuring IT and information security in the Controller’s establishment, including but not limited to management of mobile devices, administration of access and rights to systems and applications;
• for purposes connected with ensuring physical security at the university, including but not limited to indoor and outdoor video surveillance as well as recording of entering and exiting persons;
• if applicable, for purposes connected with dispute proceedings as well as proceedings before the public authorities and other proceedings, including but not limited to pursuit of and defence against claims;
• if applicable, for purposes connected with cooperation with suppliers, contractors as well as purposes connected with organisation and participation in contests, conferences, events as well as promotional and advertising activity of the Controller;

• In cases other than specified in points 3), 4) and 5) above, your personal data will be processed exclusively on the basis of previously a granted consent, in the scope and for the purpose specified in the content of the consent.
• Your personal data will be processed for the period necessary to perform the objectives specified above in points 3), 4) and 5), i.e. in case of recruitment – until completion of the recruitment, in the scope of performance of the contract concluded by you with the Controller, for the period until completion of its performance and, subsequently, for the period and in the scope required by the law or for the purposes of pursuit by the Controller of its legitimate interest in the scope determined in point 5) above, and in case of grant consent for processing of data (upon termination or expiry of the contract), your personal data will be processed until the consent is withdrawn.
• You have the right to request the following from the controller:

• access to the personal data, including the right to obtain a copy of the data;
• right to data rectification,
• right to restriction of data processing in the following cases:

• the data subject challenges correctness of the personal data,
• data processing is unlawful and the data subject objects to erasure of data, instead requesting their restriction,
• the Controller does not need the data any more for its purposes, but the data subject needs them to establish, exercise or defend claims,

• right to withdraw the consent (in the scope in which you granted the consent for processing of personal data. Withdrawal of the consent does not affect lawfulness of data processing carried out based on the consent prior to its withdrawal),
• right to object to processing of personal data when processing of personal data is necessary due to purposes arising from the legitimate interest of the Controller,
• right to request erasure of the personal data (the so-called right to be forgotten in the following cases:

• the data are no longer necessary for the purposes for which they were collected or processed in any other manner,
• the data subject has submitted an objection against data processing,
• the data subject withdrew his/her consent on which the processing is based and there are no other legal grounds for processing,
• the data are processed unlawfully,
• the data must be removed for the purpose of performance of an obligation arising from the law.
• you have the right to submit a complaint to the supervisory authority, i.e. the President of the Personal Data Protection Office.
• Providing your personal data is a prerequisite for conducting the recruitment process, conclusion and performance of the contract between you and the Controller, arises from the obligations imposed by the provisions of the law specified above or is necessary for the purposes arising from the legitimate interest Controller/university described above. Failure to provide all required personal data may be, depending on the circumstances, an obstacle in conclusion of the contract or provision of services. Providing data other than arising from the law is voluntary. To the extent the personal data are collected under a consent, providing personal data is voluntary.
• In connection with processing of your personal data for the purposes specified in points 3), 4) and 5) above, your personal data may be made available to the following recipients or categories of recipients:
• public authorities and entities performing public tasks or acting based on the instructions of public authorities, in the scope and for the purposes arising from the law (e.g.:   National Labour Inspectorate (PIP), Tax Office, Social Insurance Institution (US), occupational medicine health care centres, Ministry of Science and Higher Education, Polish Accreditation Committee),
• customers, suppliers, contractors of the Controller as well as third parties in relations with the Controller, in the scope and for the purpose necessary to perform the obligations arising from the employment relationship, including contact purposes, on behalf and in the name of the Controller;
• entities supporting the Controller in its business processes, including entities processing the personal data for the benefit of the Controller, the so-called Processors.

• In connection with performance of the requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (O.J. EU L 119 of 04.05.2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, I inform that:
• The Controller of your personal data is Uczelnia Biznesu i Nauk Stosowanych „Varsovia”-Warsaw Management University with its seat in Warsaw, ul. Moniuszki 1a, 00-014 Warsaw (hereinafter referred to as the University).
• To contact the University, the data subject can write an e-mail to the Data Protection Officer to the address:iod@varsovia.study
• Your personal data will be processed for marketing purposes under Art. 6 section 1 letter a) of the General Data Protection Regulation of 27 April 2016.
• Your personal data will be processed until withdrawal f the consent.
• You have the right to request the following from the controller:
• access to the personal data, including the right to obtain a copy of the data;
• right to data rectification,
• right to restriction of data processing in the following cases:
• the data subject challenges correctness of the personal data,
• data processing is unlawful and the data subject objects to erasure of data, instead requesting their restriction,
• the Controller does not need the data any more for its purposes, but the data subject needs them to establish, exercise or defend claims,
• right to consent withdrawal. Withdrawal of the consent does not affect lawfulness of data processing carried out based on the consent prior to its withdrawal).
  e. right to request erasure of the personal data (the so-called right to be forgotten in the following cases:
• the data are no longer necessary for the purposes for which they were collected or processed in any other manner,
• the data subject has submitted an objection against data processing,
• the data subject withdrew his/her consent on which the processing is based and there are no other legal grounds for processing,
• the data are processed unlawfully,
• the data must be removed for the purpose of performance of an obligation arising from the law.
• you have the right to submit complaint to the President of the Personal Data Protection Office.
• Providing your personal data is voluntary.

• University ceremonies, cultural and scientific events are photographed and recorded. Persons who refuse to grant their consent for their image to be recorded, are requested to notify the photograph and organiser directly. Further participation in the event without the above notice shall be treated by the Controller as an express activity confirming permission to process your image as a personal datum.
• Information processing of personal data:
• The Controller of your personal data is Uczelnia Biznesu i Nauk Stosowanych „Varsovia”-Warsaw Management University with its seat in Warsaw, ul. Moniuszki 1a, 00-014 Warsaw (hereinafter referred to as the University). To contact the University, the data subject can write an e-mail to the Data Protection Officer to the address: iod@varsovia.study
• The personal data will be processed for information and promotion purposes – creation of a gallery of photographs from the ceremonies and publication on the websites administered by the Controller and their subdomains, social networks; video account and on-line transmission from the ceremony – under the consent granted by you as well as for the archiving purposes under the Act of 14 July 1983 on the national archival resources and archives (Journal of Laws of 2018, item 650, as amended).
• Your personal data can be made available to the following entities: media cooperating with the University, entities printing the information materials.
• We do not transfer your data outside Poland.
• Your data are stored until you withdraw the consent granted.
• In case of persons who received named invitations to a ceremony, the Controller processes also the data including name, surname and contact address, title/function/position. These data are processed exclusively for the purpose of informing about ceremonies and important events organised by the Controller and will not be made available to any other entities.
• Providing personal data is voluntary, but indispensable for participation in the ceremony. Failure to grant the consent will prevent you from participating in the event.
• You have the right to access your data, receive their copy and, subject to the provisions of the law, you have the right to:
  • withdrawal of the consent granted; however, withdrawal of the consent does not affect lawfulness of processing performed under your consent prior to its withdrawal,
  • data rectification
  • data erasure,
  • restriction of data processing,
  • submittal of an objection,
  • data transfer.
• The above rights can be exercised through submittal of a written request to the University.
• You have the right to submit a complaint to the competent supervisory authority, i.e. President of the Personal Data Protection Office, if you believe that processing of personal data is in breach of the governing law in this scope.
• We inform that the Controller does not process the supplied personal data using automated processing methods, including profiling.

• The Controller of your personal data is Uczelnia Biznesu i Nauk Stosowanych „Varsovia”-Warsaw Management University with its seat in Warsaw, ul. Moniuszki 1a, 00-014 Warsaw (hereinafter referred to as the University). To contact the University, the data subject can write an e-mail to the Data Protection Officer to the address: iod@varsovia.study
• Your personal data are processed for the following purpose:
  • ensuring security of persons present at the University;
  • protection of the University’s property
    pursuant to the legitimate interest of the Controller – Art. 6 section 1 letter f of GDPR¹

• Your personal data can be made available to other entities exclusively in the cases provided for by the law.
• Video surveillance system recordings are stored until overwritten, no longer than for 30 years, except for the situations provided for by the law.
• Providing personal data is voluntary, but necessary to enter the University building covered by the surveillance system. Failure to provide the data is equivalent to deprivation of the right to enter the area of the University.
• In connection with processing of your personal data, you have the right to access your data, receive their copy and, subject to the provisions of the law, you have the right to:
  • data erasure;
  • restriction of data processing.
     
    The above rights can be exercised through submittal of a written request to the University.

• Your personal data will not be transferred to any third country.
• The University does not process the your personal data using automated processing methods, including profiling.
• You have the right to submit a complaint to the competent supervisory authority, i.e. President of the Personal Data Protection Office, if you believe that processing of personal data is in breach of the governing law in this scope.

• The Controller of your personal data is Uczelnia Biznesu i Nauk Stosowanych „Varsovia”-Warsaw Management University with its seat in Warsaw, ul. Moniuszki 1a, 00-014 Warsaw (hereinafter referred to as the University). To contact the University, the data subject can write an e-mail to the Data Protection Officer to the address: iod@varsovia.study
• Your personal data will be processed for promotional purposes under the consent granted by you.
• Your image can be made available to the following entities: media cooperating with the University, entities printing the information materials.
• We do not transfer your data outside Poland.
• Your image will be stored until you withdraw the consent granted.
• You grant the consent voluntarily. In case of failure to grant consent for photographic and recording you image, please leave the room or report to the relevant person.
• You have the right to access your data, receive their copy and, subject to the provisions of the law, you have the right to:
  • withdrawal of the consent granted; however, withdrawal of the consent does not affect lawfulness of processing performed under your consent prior to its withdrawal,
  • data erasure,
  • restriction of data processing,
  • submittal of an objection,
  • data transfer.

The above rights can be exercised through submittal of a written request to the University.

• Your have the right to submit a complaint to the President of the Personal Data Protection Office of you believe that processing of image as a personal datum is in breach of the commonly governing law in this scope.
• We inform that the Controller does not process the supplied personal data using automated processing methods, including profiling.

• The Controller of your personal data is Uczelnia Biznesu i Nauk Stosowanych „Varsovia”-Warsaw Management University with its seat in Warsaw, ul. Moniuszki 1a, 00-014 Warsaw (hereinafter referred to as the University). To contact the University, the data subject can write an e-mail to the Data Protection Officer to the address: iod@varsovia.study
• Your personal data will be processed for contact purposes.
• Your personal data will not be made available to other entities, unless such an obligation arises from the law.
• We do not transfer your personal data outside Poland.
• Your data are stored until you withdraw the consent granted.
• Providing your personal data is voluntary, but necessary to pursue the specified purposes and failure to provide the data will preclude contact.
• You have the right to access your data, receive their copy and, subject to the provisions of the law, you have the right to:
  • data rectification,
  • withdrawal of the consent granted; however, withdrawal of the consent does not affect lawfulness of processing performed under your consent prior to its withdrawal,
  • data erasure,
  • restriction of data processing,
  • submittal of an objection,
  • data transfer.

The above rights can be exercised through submittal of a written request to the University.

• You have the right to submit a complaint to the competent supervisory authority if you believe that processing of personal data is in breach of the governing law in this scope.
• We inform that the Controller does not process the supplied personal data using automated processing methods, including profiling.

I, the undersigned, under Art. 6 section 1 letter a of the General Data Protection Regulation of 27 April 2016 (O.J. EU L 119 of 04.05.2016), grant consent for processing of the personal data provided in my job offer for the purposes of the current recruitment. 

I, the undersigned, under Art. 6 section 1 letter a of the General Data Protection Regulation of 27 April 2016 (O.J. EU L 119 of 04.05.2016), grant consent for processing of the personal data provided in my job offer for the purposes of future recruitments.