PERSONAL DATA PROCESSING INFORMATION*

In connection with the implementation of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), please be advised of the rules of processing personal data and your rights thereunder.

I. Indicating the controller

The controller of your personal data is Collegium Civitas, a non-state university with its registered office in Warsaw, entered into the Register of Non-state Universities and Associations of Non-state Universities maintained by the Minister of Science and Higher Education under No. 129.

In the case of any questions regarding the processing of your personal data, please:

• contact the Data Protection Officer via email: iod@civitas.edu.pl
• or in writing at the following address: Collegium Civitas, 00-901 Warsaw, Plac Defilad 1, Palace of Culture and Science, 12th Floor
• visit the CC registered office in person.

II. The aims and legal basis of processing your personal data:

Personal data are processed by CC in order to maintain correspondence and other forms of communication (e.g. telephone contact) with you related to queries and requests regarding the processing of personal data.

Your personal data are processed in relation to the compliance with the legal obligation (pursuant to Article 6(1)(c) of the GDPR) to which CC is subject under Article 12-22 of the GDPR.

In some cases, personal data of users are processed in connection with the establishment and exercise of legal claims regarding exercising rights of data subjects.

In this case, the legal basis for the processing is a legitimate interest of the data controller (pursuant to Article 6(1)(f) of the GDPR) which consists in the need for the establishment, exercise and enforcement of claims and defence against claims.

III. The obligation to provide personal data

In some cases, you may need to provide your personal data in order to confirm your identity. Under GDPR regulations, data controllers are obliged to ensure that the person with whom correspondence is maintained is the same person who is entitled to receive relevant information regarding the processing of personal data. In such cases failure to provide personal data constitutes a basis for the refusal to exercise a right arising from the GDPR or the refusal to provide the answer to a query.

IV. Information on recipients of your personal data

Please be advised that your personal data may be shared with the following categories of recipients:

• public authorities and entities performing public services or acting at the behest of public authorities, within the scope and for purposes arising from applicable laws (e.g. Police, Public Prosecutor’s Office, Border Guard, Ministry of Science and Higher Education, etc.)
• IT service development and support operators
• logistics service operators
• document archiving operators
• mail and courier service operators.

V. Personal data processing period

Your personal data are processed for a period necessary to achieve purposes indicated in II or a period indicated in applicable laws. In particular, your personal data will be erased after a period necessary to demonstrate that your request has been granted or refused to the satisfaction of a supervisory authority.

VI. Rights of a data subject

Collegium Civitas wishes to assure that all persons whose personal data are processed by CC enjoy relevant rights arising from the GDPR. Consequently, you enjoy the following rights:

• the right to access personal data, including the right to obtain copies of those data
• the right to request a rectification (correction) of personal data, if the data are inaccurate or incomplete
• the right to request the erasure of personal data (also known as “the right to be forgotten”), if (i) the data are no longer necessary
• in relation to the purposes for which they were collected or otherwise processed; (ii) a data subject objected to the processing of personal data and the controller did not demonstrate significant grounds for the continuing of processing the personal data that would override the interests, rights and freedoms of the data subject, or grounds for the establishment, exercise or defence of claims; (iii) a data subject has withdrawn their consent on which the processing is based and there is no other legal basis for the processing; (iv) the data have been unlawfully processed; or (v) the data have to be erased for compliance with a legal obligation
• the right to request the restriction of processing personal data, where one of the following applies: (i) the accuracy of the personal data is contested by the data subject; (ii) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; (iii) the controller no longer needs the personal data for the purposes of the processing,
• but they are required by the data subject for the establishment, exercise or defence of legal claims; (iv) the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.
• the right to object to the processing of any personal data, where CC processes your personal data based on a legitimate interest of the controller.

VII. The right to file a complaint with a supervisory authority

In all cases associated with the processing of personal data, you are entitled to lodge a complaint with a relevant supervisory authority for personal data protection.

* The information clause only applies to natural persons whose personal data are processed by CC