In accordance with the new Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), the Institute of the European Network Remembrance inform you as follows:
1. The controller of your personal data (hereinafter referred to as the ‘Personal Data’), shall be the state cultural institution Institute of the European Network Remembrance and Solidarity seated at ul. Zielna 37, 00-108 Warsaw, acting on the basis of an entry into the register of institutions of culture kept by the Minister of Culture and National Heritage under the number of RIK 90/2015, holding the unique taxpayer’s NIP number 701-045-62-60 (hereinafter the ‘Institute’). You can get in touch with the Institute using the following e-mail address: ado.enrs@enrs.eu.
2. The contact data of the data protection officer appointed by the Institute is as follows: iod.enrs@enrs.eu.
3. Your Personal Data shall be processed by the Institute pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation (OJ L No 119) hereinafter the ‘GDPR’, for the purpose to publish them including but not limited to: on the hardcopy materials connected with the ‘Guidelines for international discourse on history and memory’ (hereinafter the ‘Guidelines’) and/or in the Internet – in connection with information about the Guidelines, for the purpose of promotion of the Guidelines and for the purpose of maintenance of statistics of endorsement for the Guidelines.
4. Your Personal Data shall be processed pursuant to Article 6 sec. 1. (a) of the GDPR – the data subject has given consent to the processing of his or her personal data for one or more specific purposes and art. 9 sec. 2 a) of the GDPR - the data subject has given explicit consent to the processing of personal data regarding his/her political opinions and philosophical beliefs for one or more specified purposes, except where Union or Member State law provide that the prohibition of processing of personal data revealing political opinions or philosophical beliefs, may not be lifted by you.
5. Your Personal Data shall be received by the following categories of entities: providers of technical services (including, inter alia, telecommunications, hosting, owners of servers and spaces where data are stored, entities offering services related to performing promotional activities online, including, inter alia FreshMail sp. z o.o. with its registered seat in Kraków, Google), by means of which the Institute carries out its activities, social media in the Internet (e.g. Facebook, Twitter) as well as entities with which the Institute cooperates in relation to the Guidelines and its promotion and moreover people and entities to which the Institute directs its promotional activities (including but not limited to people and entities who receive newsletter and information regarding Institute’s activity).
6. Using the services offered by Google (in compliance with the definition below), the Institute intends to transmit your personal data to the company Google LLC of Delaware seated at Amphitheatre Parkway 1600, Mountain View, California 94043, USA (‘Google’), which may process them (including transmission and storage) also outside of the European Economic Area (EEA), including the United States of America and other countries where Google or its partners has/have relevant infrastructure.
Using the services offered by Facebook (in compliance with the definition below), the Institute intends to transmit your personal data to the company Facebook Ireland Ltd., seated at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland (‘Facebook’), which may process them (including transmission and storage) also outside of the European Economic Area (EEA), including the United States of America and other countries where Google or its partners has/have relevant infrastructure.
By its Decision 2016/1250, the European Commission found that the United States of North America ensured an adequate level of protection of personal data transmitted from the Union to entities in the United States in the context of the EU-U.S. Privacy Shield.
To ensure safety, contracts with Google LLC feature also standard contractual clauses approved by the European Commission. Google gives its assurances that when processing your personal data, it applies appropriate safeguards at all times. You can find more details concerning this on: https://policies.google.com/privacy?gl=PL&hl=pl#enforcement.
Facebook uses typical contractual clauses approved by the European Commission and relies on European Commission decisions acknowledging an appropriate level of data protection with relation to specific countries, in relevant cases, as regards data transfer from the EEA to United States of America and other countries. In this context, Facebook ensures, that when processing your personal data, it applies appropriate safeguards at all times. You can find more details concerning this on: https://www.facebook.com/privacy/explanation.
The Institute may also transfer your Personal Data outside of the European Economic Area, even if the European Commission has not found that the level of personal data protection in this territory is appropriate, provided you have given your relevant consent.
7. Your Personal Data shall be processed as of their submission until your withdrawal of the consent to have them processed by the Institute.
8. You shall have the right to request from the Institute access to your Personal Data, i.e. you can obtain from the Institute a confirmation whether Personal Data concerning your person are processed, and if that is the case, you shall be entitled to information as to such processing in the scope provided for in Article 15(1) of the GDPR and you may receive from the Institute, free of charge, one copy of the Personal Data subject to processing, while the Institute may charge you for each successive copy.
You may send the request referred to in this paragraph to the following email address: iod.enrs@enrs.eu.
9. You shall have the right to request from the Institute that your incorrect Personal Data be rectified without delay as well as to request from it (considering the purpose for which the data are processed) that your incomplete Personal Data be completed. You can make that latter request by means of submitting an additional declaration.
You may send the requests referred to in this paragraph to the following email address: iod.enrs@enrs.eu.
10. You shall have the right to request from the Institute that your Personal Data be erased without delay and the Institute shall be obliged to erase such Personal Data without undue delay (subject to the exceptions provided for in Article 17(3) of the GDPR), in the case of one of the following circumstances:
a) your Personal Data are not necessary any more for the purposes for which they were collected or otherwise processed;
b) you have revoked your consent which is the basis for the processing of your Personal Data and there exists no other legal basis for their processing;
c) you have objected pursuant to Article 21(1) of the GDPR against the processing of your Personal Data and there are no overriding legitimate grounds for the processing, or you have raised the objection referred to in the last sentence of paragraph 13 below (objection against Personal Data processing for the purposes of direct marketing, including profiling);
d) your Personal Data have been unlawfully processed;
e) your Personal Data have to be erased for compliance with a legal obligation;
f) your Personal Data have been collected on the basis of a consent expressed by an authorised entity or entities, in relation to the offer of information society services directly to a child, referred to in Article 8(1) of the GDPR.
You may send the request referred to in this paragraph to the following email address: iod.enrs@enrs.eu.
11. You shall have the right to request from the Institute that the processing of your Personal Data be restricted, when:
a) you contest the accuracy of the Personal Data - for a period enabling the Institute to verify their accuracy;
b) the processing is unlawful and you oppose the erasure of the Personal Data and request the restriction of their use instead;
c) the Institute no longer needs the Personal Data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims;
d) you have objected to the processing of your Personal Data pursuant to Article 21(1) of the GDPR (described in the second sentence of paragraph 13 below) pending the verification whether the legitimate grounds of the Institute override yours.
You shall be informed by the Institute before the restriction of the processing of your Personal Data referred to above is lifted.
You may send the request referred to in this paragraph to the following email address: iod.enrs@enrs.eu.
12. You shall have the right to transmit the Personal Data you provide, i.e. you shall have the right to receive from the Institute, in a structured, commonly used and machine-readable format, your Personal Data you provide the Institute with and that you shall have the right to transmit those Personal Data to another controller unhindered by the Institute, if the processing takes place by automated means and is performed on the basis of consent granted or a contract.
In exercising the right referred to above, you shall have the right to request that the Personal Data be transmitted directly from one controller to another, where technically feasible.
You may send the request referred to in this paragraph to the following email address: iod.enrs@enrs.eu.
13. You have the right to object to the processing of your Personal Data pursuant to Art. 21 GDPR. However, this law applies only to cases where there are reasons related to your particular situation and processing: a) is based on legitimate interests pursued by the Institute or a third party, or b) is necessary to perform the task carried out by the Institute in the public interest or in the exercise of official authority vested in the Institute, including when profiling is carried out on the grounds listed in point a) or b) above. The right to object to the processing of your Personal Data also applies to you if, on the basis of legally justified interests pursued by the Institute or a third party, your Personal Data is processed for direct marketing purposes which includes profiling to the extent that the processing is related to such direct marketing.
The objection referred to in this point may be sent by you to the following e-mail address: ado.enrs@enrs.eu.
14. You shall have the right to withdraw your data processing consent at any time without affecting the lawfulness of processing based on that consent before its withdrawal. If you wish to withdraw your consent please click this link: Withdrawal of Support for the Guidelines
15. You shall have the right to lodge a complaint with the President of Personal Data Protection Office (Polish abbreviation: PUODO), should you find that the processing of your personal data infringes on the provisions of the GDPR.
16. The submission of personal data shall be voluntary, subject to its being a requirement for publishing them and using them for promotion of the Guidelines.
17. No automated decision-making, including profiling, shall be performed as regards your person.