Archiving Policy

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation [EN]).

Personal Data Protection Act

• Act of 10 May 2018 on the protection of personal data [EN].

Internal university acts

• Order No. 51 of the Rector of the University of Warsaw of 15 May 2018 on the protection of personal data at the University of Warsaw [PL].
• Order No. 143 of the Rector of the University of Warsaw of 26 June 2020 on the Regulations for Video Surveillance at the University of Warsaw [PL]

The Information on processing personal data

1. The administrator of personal data

According to the Article 13 of the Regulation of European Parliament and Council of Europe (EU) no 2016/679 of 27th April 2016 on the protection of natural persons with the regard to processing of personal data and on the free movement of such data, and repealing the Directive 95/46/EC (General Protection Data Regulation), hereinafter called GDPR, your personal data is administered by Uniwersytet Warszawski (The University of Warsaw), with the headquaters in Warsaw: ul. Krakowskie Przedmieście 26/28, 00-927 Warszawa.

The administrator can be contacted using one of the selected forms available at the website https://www.uw.edu.pl/kontakt/.

2. The data protection officer (DPO)

The administrator has appointed the data protection officer who may be contacted at iod@adm.uw.edu.pl in the matters relating your personal data. You may contact the DPO in the matters relating your data processing by Uniwersytet Warszawski (University of Warsaw) and exercising your rights related to data processing.

The tasks of the DPO do not include the implementation of other matters, such as handling the concluded agreement, accepting documents related to the performance of the agreement, etc.

3. The aims, legal bases and processing period

Your personal data will be processed for the purposes of:

– execution of the Agreement – for a period of the validity of the agreement – Article 6 paragraph 1 b GDPR;

– investigation, defense and determination of possible claims under the concluded agreement within a period of three years from the end of the agreement – Article 6 paragraph 1 f GDPR;

– fulfillment of accounting and tax obligations – for a period of 5 years from the end of the calendar year  – Article 6 paragraph 1 c GDPR;

In order to implement the concluded agreement, your personal data will be processed to the extent necessary to perform the concluded contract. All other personal data will be processed when it is necessary to exercise the right or fulfill the obligation resulting from the law or other applicable regulations.

Special categories of your personal data (so-called sensitive data) referred to in Article 9 GDPR, will be processed only for the purpose of fulfilling the obligation resulting from legal provisions or on the basis of your consent.

All your other data will be processed in special cases after you have given your separate consent to their processing (Article 6  paragraph 1 a GDPR), which you have the right to withdraw at any time. At the same time, we would like to remind you that the withdrawal of your consent does not affect the lawfulness of the processing which was carried out on the basis of your consent before its withdrawal – Article 7 paragraph 3 GDPR)

4. Receipients of the data

Your personal data may be made available to entities authorized under the law. Access to your personal data will also be granted to authorized employees of the administrator who must process your personal data as part of their duties and official tasks.

Recipients of data may also include other entities to which the administrator will commission the performance of specific activities that require the processing of personal data, e.g. entities providing services in the field of property and personal protection, postal and courier services, transport services, etc.

Your business data may also be transferred to the parties of contracts concluded by the Administrator, if it is necessary for the performance of these contracts and will result from the concluded agreement.

5. Data transfer outside the European Economic Area (EEA)

Your data may also be processed by our G-Suit for education service provider Google in its data processing centers  [1].

6. The right of the data subjects

According to the GDPR regulations you have right to:
– access your personal data and receive a copy;
– correcting personal data;
– limiting their processing;
– deleting personal data (restricted to cases specified in the Article 17 paragraph 3 GDPR);

You also have the right to submit a complaint to the President of the Personal Data Protection Office, if you consider that the processing of personal data infridges the law.

7. Information on the requirement to provide data

Providing your personal data to the extent resulting from legal provisions and other regulations for the performance of tasks resulting from the concluded agreement is necessary to conclude agreement with you. Providing other personal data is voluntary

[1]              https://www.google.com/about/datacenters/locations/index.html