Information Clause under the GDPR of the Leon Kozminski University Foundation

The obligation to provide information arises from the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or “GDPR”).

1. The controller of your personal data is the Kozminski University Foundation, located at 59 Jagiellońska Street, 03-301 Warsaw. You can contact the controller in writing by traditional mail at our address.

2. Your personal data will be processed for the following purposes:

a. Fulfilling the controller’s legal obligations related to contracts, such as maintaining accounting records (legal basis – Article 6(1)(c) of the GDPR) – “legal obligation”;
b. Contacting you regarding ongoing matters, including matters related to contracts between the controller and your employer/representing entity, presenting offers, receiving orders, responding to inquiries (legal basis – Article 6(1)(f) of the GDPR) – “legitimate interest”;
c. Pursuing and defending mutual claims related to the contract with the entity you work for or represent, i.e., the contracting party, in case of a dispute arising from the contract (legal basis – Article 6(1)(f) of the GDPR) – “legitimate interest”.

3. Recipients of your personal data are entities to whom the controller delegates the performance of activities that require data processing (data processors): operators of information systems, accounting and auditing entities.
4. Your personal data is not transferred to third countries, i.e., outside the European Economic Area (EEA), or international organizations.
5. The data will be processed for the duration of the contract concluded between your employer/representing entity and the controller, and after that period until the obligations to store data under legal regulations expire.
6. You have the right to access and correct your personal data and, subject to legal provisions, the right to rectify, erase, restrict the processing of, and object to the processing of your data.
7. As your personal data is processed based on the controller’s legitimate interest, the controller will no longer process them for the specified purpose if you object to such processing. You have the right to object, free of charge, to the processing of your personal data at any time when the processing is based on the legitimate interest, and the objection is justified by your particular situation.
8. You have the right to lodge a complaint with the supervisory authority responsible for personal data protection, i.e., the President of the Office for Personal Data Protection.
9. We obtained your personal data directly from your employer/representing entity. We receive data such as your name, official telephone number and email address, place of work, position, or information about the type of matters you handle from your employer/representing entity.
10. Your personal data will not be subject to automated decision-making, including profiling, without your separate consent.
11. For more information on how to exercise your rights, as specified above, please contact the controller or the Data Protection Officer as described in paragraphs 1 and 2.
12. The controller takes all necessary measures to ensure the physical, technical, and organizational security of personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, use, or access, in compliance with all applicable regulations.