search

Protection of personal data

Following the implementation of the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as: “RODO”, we inform you of the rules for the processing of your personal data and of your rights related thereto.

WHO PROCESSES YOUR PERSONAL DATA

Your personal data shall be processed by the Institute De Republica, with its seat in Warsaw (00-761), at 23/1 Belwederska Street, which is the Administrator (hereinafter referred to as: “Controller”) of such data within the meaning of the RODO.

CONTACT

For any enquiry regarding the processing of personal data, please contact the Inspector of Data Protection at: ul. Belwederska 23/1, 00-761 Warsaw, e-mail address: rodo@iderepublica.pl.

PURPOSES AND LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

Your personal data may be processed for one or more of the purposes indicated below:

  • in order to provide access to public information, to process petitions, complaints and requests and other correspondence addressed to the Institute De Republica, as well as to reply, pursuant to Article 6(1)(c) of the RODO, as the processing is necessary for the performance of legal obligation of the Institute De Republica arising from generally applicable legislation, including legislation on access to public information, legislation on petitions as well as provisions concerning the processing of complaints and requests;
  • on the basis of your previously provided consent to the extent and purpose specified in it, pursuant to Article 6(1)(a) of the RODO.

RECIPIENTS OF PERSONAL DATA

In connection with the processing of personal data for the purposes referred to above, your personal data may be disclosed to:

  • public authorities and entities performing public tasks or acting on behalf of public authorities, to the extent and for the purposes arising from generally applicable law,
  • other entities which, on the basis of relevant agreements, assist the Institute De Republica in fulfilment of the legal obligation imposed on the Controller.

STORAGE PERIOD OF PERSONAL DATA

Under the applicable legal provisions, your personal data shall be processed for the period that is necessary to achieve the purpose of the processing indicated in the section “Purposes and legal grounds for processing personal data”, including the period necessary for the examination of the petition, the settlement of the complaint or request as well as other correspondence. After this period, we process personal data for the period and to the extent required by generally applicable laws, in particular archiving laws. The period of processing, including data storage, may each time be extended by the time necessary to assert or defend against claims lodged in relation to the processing of personal data by the Controller.

THE RIGHTS RELATING TO THE PROCESSING OF PERSONAL DATA

You are entitled to the following rights in relation to the processing of your personal data:

  • the right to obtain from the Controller confirmation as to whether it is processing your personal data, and the right of access to such data, including the right to request a copy of the data – pursuant to the provisions of Article 15 RODO;
  • the right to request rectification of your personal data, if inaccurate, or its supplementation – pursuant to the provisions of Article 16 RODO;
  • the right to request the immediate erasure of your personal data – pursuant to the provisions of Article 17 RODO;
  • the right to request the limitation of processing of your personal data – pursuant to the provisions of Article 18 RODO;
  • the right to transfer your personal data – pursuant to the provisions of Article 20 RODO.

Additionally, you have the right to withdraw your consent at any time if it has been provided for the purpose of the processing of personal data by the Controller.

A request for exercising the rights described above may be submitted:

  • by regular post to the address of the Controller’s registered office;

The request should allow for identification of the person who lodges it and it should specify as precisely as possible what the request concerns. The Controller will examine whether it is permissible to exercise the requested right on the basis of the applicable provisions of law, taking into account the factual and legal circumstances of a particular case. Not in every case the provisions of law allow for the aforementioned rights to be exercised. If the Controller is unable to determine either the content of the request or identify the applicant on the basis of the submitted request, we shall ask you for additional information. The request shall be answered to the e-mail address from which it was sent or by registered letter to the address indicated by the applicant, if the request was lodged in that way, promptly, but no later than within one month of its receipt by the Controller. In case it is necessary to extend the above period, the Controller shall inform the applicant of the reasons for such an extension.  

THE RIGHT TO LODGE A COMPLAINT TO THE SUPERVISORY AUTHORITY

In case you consider that your personal data is processed in breach of the applicable law, you may lodge a complaint to the President of the Personal Data Protection Office.

TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES AND INTERNATIONAL ORGANISATIONS

Personal data is neither transferred to third countries, i.e., outside the European Economic Area (EEA), nor to any international organisations.

THE NATURE OF PROVISION OF PERSONAL DATA

The provision of your personal data is:

  • mandatory – in the case when the premise for the processing of personal data is a provision of law,
  • voluntary – if the processing of personal data is based on your consent. In this case, you have the right to withdraw such consent at any time. However, withdrawal of the consent shall not affect the compliance of the processing of personal data, which was performed on the basis of the consent, before its withdrawal.

AUTOMATED DECISION-MAKING AND PROFILING

When processing personal data for the purposes indicated in the section “Purposes and legal grounds for processing personal data”, the Controller neither makes decisions by automated means nor applies profiling.