Jan Wyżykowski University
Privacy Policy
1. Scope and Data Controller
This policy sets forth the rules for processing the personal data of users of the ujw.pl website, individuals who correspond with the University, and those who use the University’s forms. Rules regarding other University processes are set forth in the GDPR and the relevant specific clauses.
The controller of personal data collected on our websites is the Jan Wyżykowski University, ul. Skalników 6b, 59-101 Polkowice.
Contact for data protection matters: Data Protection Coordinator, [email protected] or the Controller’s mailing address. This policy is for informational purposes only; acceptance of this policy does not constitute a basis for data processing.
2. Purposes, Legal Bases, and Scope of Processing
The Data Controller processes identification and contact data, as well as the content of submissions, to the extent necessary to handle correspondence, forms, and event registrations. Data regarding the use of the website, including the IP address, is processed to ensure its operation and security.
The legal basis for processing is: Article 6(1)(f) of the GDPR regarding the handling of routine correspondence, website security, and the establishment, pursuit, and defense of claims; Article 6(1)(b) of the GDPR regarding the conclusion or performance of a contract; Article 6(1)(c) of the GDPR regarding legal obligations; Article 6(1)(a) of the GDPR regarding purposes covered by voluntary consent. The applicable legal basis and purpose are specified in the information accompanying the relevant form.
Providing personal data via the contact and registration forms available on our websites is voluntary, but may be necessary, for example, to respond to a question or to register for an event we are organizing.
3. Forms
The University uses its own forms as well as Microsoft Forms on accounts managed by the University.
Each form is accompanied by relevant information regarding data processing, specifically the purpose, legal basis, required data, and retention period. The requirement to log in and verify the respondent’s identity stems from the form’s purpose and settings and is communicated to the user before the response is submitted. Consent to cookies does not replace the legal basis for processing responses.
4. Recipients and External Services
Data may be disclosed to entities authorized by law, as well as to IT and communications service providers, to the extent necessary to achieve the purpose of processing. Providers acting on behalf of the University process data under data processing agreements.
Microsoft processes responses in Microsoft Forms on behalf of the University, in accordance with the applicable terms of service and a data protection agreement. With regard to processing by the provider for its own purposes, the provider’s data protection policy applies.
The website provides access to Google Maps and YouTube videos. Launching these services results in the transfer of technical data to the provider and may involve tracking or personalization. The rules for activation are set forth in the Cookie Policy. Information from the providers is available in the privacy policies of Google and Microsoft.
5. Data Transfer Outside the EEA
The use of Microsoft and Google services may involve the transfer of data outside the European Economic Area, including to the United States. Data transfers by the Controller require a legal basis as specified in Chapter V of the GDPR: a European Commission decision on an adequate level of protection, if applicable to the transfer in question, or appropriate safeguards, in particular standard contractual clauses along with the required supplementary measures. Information regarding the legal basis for a given transfer and how to obtain a copy of the safeguards is provided by the Data Protection Coordinator.
6. Retention Period
Data from correspondence and forms are retained for the period necessary to conclude the matter, and data related to events are retained for the duration of their organization, execution, and settlement. Further retention is permitted to the extent required by law or necessary to establish, pursue, or defend claims.
Data used for website security is retained for the period necessary to protect systems and investigate irregularities. For individual forms, the retention period or criteria are specified in the relevant clause. Withdrawal of consent terminates processing for the purpose covered by that consent, unless further retention has a separate legal basis.
7. Individual Rights
Under the terms set forth in the GDPR, you have the rights to access, rectify, erase, restrict processing, and transfer your data. In the case of processing based on a legitimate interest, you have the right to object on grounds relating to your particular situation; in the case of direct marketing, no justification is required for such an objection.
Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to its withdrawal. Requests may be directed to the Data Protection Coordinator. You have the right to file a complaint with the President of the Personal Data Protection Office.
The University does not use the data covered by this policy for decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect an individual.
8. Cookies
The types, purposes, and duration of use of cookies, as well as the rules for granting and withdrawing consent, are set forth in a separate Cookie Policy.