Personal Data Protection

INFORMATION ON PERSONAL DATA PROCESSING (PDF FOR DOWNLOAD)

1. INFORMATION ON PERSONAL DATA PROCESSING AT THE POLISH AVIATION MUSEUM IN KRAKOW

Acting pursuant to Art. 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation — hereinafter “GDPR”), we inform you that:

• the controller of your personal data is the Polish Aviation Museum with its registered office in Krakow (31-864), at al. Jana Pawla II 39, phone: (+48) /12/ 642 87 00, email: info@muzeumlotnictwa.pl (hereinafter referred to as the “Controller” or the “Museum”);
• the controller has not designated a representative;
• the controller has designated a Data Protection Officer (Marek Rogoz), who can be contacted by sending correspondence to the email address iodo@muzeumlotnictwa.pl, by phone (600 89 68 68), or in person at the controller’s registered office;
• the authority responsible for supervising matters related to personal data protection is the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, where you have the right to lodge a complaint;
• your personal data will be processed:
  • *for the purpose of fulfilling the Controller’s statutory and charter tasks, as well as for the performance of tasks carried out in the public interest — on the basis of Art. 6(1)(c) and (e) GDPR,
  • *for the purpose of concluding and/or performing a contract entered into with the Controller — on the basis of Art. 6(1)(b) GDPR, including the defence or pursuit of any claims,
  • *for the purpose of communicating with the Controller — on the basis of Art. 6(1)(a) GDPR;
• in cases where it is required, the Museum will seek your consent to process personal data for a clearly declared purpose, with the reservation that such consent may be easily withdrawn by the person who previously gave it — on the basis of Art. 6(1)(a) and Art. 9(2)(a) GDPR;
• detailed information on the purpose and legal basis for a given type of processing may also be provided in the content of applications, forms, and during the collection of personal data;
• the recipients of your personal data will be entities authorised to obtain personal data on the basis of legal provisions, as well as entities to which the Controller entrusts services related to personal data processing, in particular organisers of leisure services, educational activities, and IT services;
• your personal data will be stored for the period specified by legal provisions, in particular in accordance with the office procedures manual; if the basis for processing personal data is consent, the data will be processed until the consent is withdrawn; if the basis for processing is a contract, the data will generally be processed until the mutual claims become time-barred;
• you have the right to request from the controller access to personal data, the right to rectification, erasure or restriction of processing, the right to object to processing, the right to data portability, and the right to withdraw consent at any time — exclusively on the terms set out in the GDPR (taking into account limitations arising from legal provisions);
• to the extent that providing your personal data is a statutory requirement, it is necessary for the Museum to carry out its tasks; in other cases, providing data is voluntary, however refusal to provide data may result in the inability of the Museum to deliver its services;
• you are not subject to automated decision-making;
• in the event of joint controllership of your data with another entity (controller), information on this matter will be communicated in a separate notice.

2. INFORMATION ON PERSONAL DATA PROCESSING (GDPR) — SOCIAL MEDIA

The controller of personal data is the Polish Aviation Museum with its registered office in Krakow (31-864), at al. Jana Pawla II 39, phone: (+48) /12/ 642 87 00, email: info@muzeumlotnictwa.pl (hereinafter referred to as the “Controller” or the “Museum”); the Controller has designated a Data Protection Officer (Marek Rogoz), who can be contacted by sending correspondence to the email address iodo@muzeumlotnictwa.pl, by phone (600 89 68 68), or in person at the controller’s registered office.

Our activities comply with the requirements set out in the platform’s terms of service, and the Museum processes your personal data for the purpose of answering questions, commenting on posts, communicating with other users, and in connection with the information we publish (for the purpose of promoting our activities and conducting marketing activities).

We collect and process the following types of personal data: identifier, profile photo, other photos, content of comments, and content of conversations conducted through the messaging application.

Personal data processing is carried out on the basis of the following legal grounds:

• consent — Art. 6(1)(a) GDPR in the case of directing enquiries to us;
• contract — Art. 6(1)(b) GDPR in the case of the user’s intention to use the services we provide in connection with our activities;
• legitimate interest of the controller — Art. 6(1)(f) GDPR in the case of carrying out promotional activities.

Information contained in messages will be stored for the time needed to answer your questions or until the end of cooperation. In the case of comments, they will be available in our service until they are deleted by their author. Your personal data collected by the platform are stored in accordance with the terms set out in the platform’s separate terms of service.

You have the following rights under the terms set out in the GDPR: the right of access to your data, the right to obtain a copy thereof (if such possibility exists), the right to rectification, the right to erasure, the right to restriction of processing, the right to object to processing, the right to data portability (if such possibility exists), and the right to lodge a complaint with the President of the Personal Data Protection Office.

The relationship between the Museum and the platform user is entirely voluntary.

3. PRINCIPLES OF PERSONAL DATA PROCESSING BY THE POLISH AVIATION MUSEUM IN KRAKOW (AS THE CONTRACTING PARTY)

The parties to the contract hereby confirm that they have fulfilled the information obligations provided for in Art. 13 and/or Art. 14 of the General Data Protection Regulation of 27 April 2016 (hereinafter “GDPR”) towards natural persons from whom they obtained personal data directly or indirectly for the purpose of concluding and performing the contract, in particular for the purpose of mutual disclosure of personal data.

Pursuant to Art. 14 GDPR, the Contracting Party informs that with respect to personal data disclosed by the Contractor (if applicable), in connection with the conclusion and performance of the contract, the processing of personal data will be carried out on the following terms:

The controller of personal data is the Polish Aviation Museum with its registered office in Krakow (31-864), at al. Jana Pawla II 39, phone: (+48) /12/ 642 87 00, email: info@muzeumlotnictwa.pl (hereinafter referred to as the “Controller” or the “Museum”); the Controller has designated a Data Protection Officer (Marek Rogoz), who can be contacted by sending correspondence to the email address iodo@muzeumlotnictwa.pl, by phone (600 89 68 68), or in person at the controller’s registered office.

The Controller obtained personal data from the Contractor in connection with the conclusion and performance of this contract, and these will include, in particular, identification, address, and contact data necessary for the performance of the subject matter of the contract.

Personal data will be processed for the purpose of ensuring the proper performance of the contract, the fulfilment of the Contracting Party’s statutory objectives, as well as on the basis of legal provisions — pursuant to Art. 6(1)(b), (c), (e) and (f) GDPR, that is, in particular, in situations where it is necessary for the purposes arising from the Controller’s legitimate interests.

The recipients of personal data may include:

• entities authorised to receive data on the basis of legal provisions,
• other entities that, on the basis of appropriate agreements signed with the Controller, process personal data,
• companies, authorities, and institutions to which the Controller will direct correspondence, enquiries, or with which it cooperates on behalf of the parties.

Personal data will be stored for the period necessary to achieve the purposes of processing, i.e. until the expiration of the limitation period for claims arising from this contract and/or for the period required by legal provisions, in particular for archival and accountability purposes, as referred to in Art. 5(2) GDPR.

In connection with the processing of personal data, data subjects have the following rights, exclusively on the terms set out in the provisions, including the GDPR:

• the right of access to their data and to receive a copy thereof in accordance with Art. 15 GDPR,
• the right to rectification (correction) of their data in accordance with Art. 16 GDPR,
• the right to restriction of processing in accordance with Art. 18 GDPR,
• the right to object in accordance with Art. 21 GDPR.

In the event of becoming aware of unlawful processing of personal data, data subjects have the right to lodge a complaint with the supervisory authority competent in matters of personal data protection, i.e. the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw.

In the event of appearing in person at the Contracting Party’s premises, the Contracting Party informs that its premises are covered by a video surveillance system. Surveillance is used for the protection of property and the ensuring of safety, including the safety of persons working there. The source of data is the recordings from the surveillance cameras. The recipients of the recorded personal data will be exclusively entities authorised to obtain personal data on the basis of legal provisions. Surveillance data will generally be processed for a period of up to 3 months. More information on video surveillance can be obtained from the Contracting Party’s secretariat.

In the event of an intention to transfer data to a third country or an international organisation, the data subject will be informed thereof in a separate communication.

Pursuant to Art. 13 GDPR, the Contracting Party informs the Contractor that the purpose of processing their data as a party to the contract (if applicable) is the conclusion and performance of a civil law contract on the basis of Art. 6(1)(b) and (c) GDPR in conjunction with the provisions of the Civil Code, and on the basis of Art. 6(1)(f) for the purpose of transferring basic data to cooperating entities, including contractors, as the Contracting Party’s legitimate interest. The Contractor declares and confirms that they have read the full information on personal data processing by the Contracting Party, which is available on its website or at the Contracting Party’s registered office, and that it is fully understandable to them.

In the event of disputes concerning personal data processing, the Parties will seek an amicable resolution and commit to referring the matter to out-of-court mediation, with the reservation that the Parties will jointly select a mediator and share the costs and fees of the mediator equally. In the event of failure to reach an amicable resolution, the Parties will submit the dispute for resolution to the court having jurisdiction over the Contracting Party’s registered office.

4. INFORMATION ON PERSONAL DATA PROCESSING OF PARTICIPANTS IN COMPETITIONS ORGANISED BY THE POLISH AVIATION MUSEUM IN KRAKOW

In accordance with Art. 13 and 14 of the General Data Protection Regulation of 27 April 2016 (hereinafter “GDPR”), we inform you that:

The controller of personal data is the Polish Aviation Museum with its registered office in Krakow (31-864), at al. Jana Pawla II 39, phone: (+48) /12/ 642 87 00, email: info@muzeumlotnictwa.pl (hereinafter referred to as the “Controller” or the “Museum”); the Controller has designated a Data Protection Officer (Marek Rogoz), who can be contacted by sending correspondence to the email address iodo@muzeumlotnictwa.pl, by phone (600 89 68 68), or in person at the controller’s registered office.

The Controller processes personal data for the following purposes:

• personal data provided in connection with participation in the Competition, in particular by the participant or their representative in the application, declarations, or subsequently during the Competition, will be processed for the purpose of organising and conducting the Competition, publishing information about the Competition laureates and their works, in particular on the Controller’s website and on social media, as well as for accountability purposes required by the GDPR;
• archival, statistical, and reporting purposes;
• promotion of the Competition;
• conducting educational activities by the Controller.

Personal data will be processed and stored for the period necessary to achieve the purposes indicated above, in particular in accordance with the criteria set out in legal provisions.

The Controller processes personal data on the basis of a legitimate interest, which is enabling Competition participants to take part and enabling the Controller to conduct it, publish information about laureates, and archive documents, in accordance with Art. 6(1)(f) GDPR.

Personal data collected for the purpose of organising and conducting the Competition and publishing information about Competition laureates or component parts of competition entries may also be processed on the basis of consent given, in accordance with Art. 6(1)(a) GDPR.

Personal data of Competition laureates or their representatives, as well as persons collecting prizes, may be transferred to prize sponsors or co-organisers in order to fulfil formal requirements related to receiving prizes, or within the framework of cooperation with other institutions for the purpose of evaluating competition entries.

Personal data may be disclosed to entities authorised on the basis of legal provisions, as well as to entities that provide the Controller with services necessary for conducting the Competition, in particular IT services, as well as entities cooperating in the implementation of the Competition, including co-organisers of the competition and organisers of the Competition at a higher level.

Competition participants have the right to access the content of their data, to rectify, transfer, and object to their processing, and to withdraw the consent given to us for processing, on the terms set out in legal provisions.

Providing personal data is voluntary but necessary for the achievement of the stated purposes of data collection.

Submitting a Competition entry is equivalent to accepting the Competition Rules and to the participants’ consent to the processing of personal data on the terms set out in the Rules, in particular with regard to the disclosure of their personal data.

The Controller may process data obtained in a manner other than directly from the data subject (data provided in the application form) through the person or entity submitting the application. In such a case, the entity making the application provides the information on personal data processing on behalf of the Controller.