Privacy policy

PRIVACY POLICY

of the Institute for Urban Culture based in Gdańsk

§1
Personal data controller

We kindly inform you that the Administrator of your personal data is Institute for Urban Culture (hereinafter: IKM) - a self-governing cultural institution with its seat in Gdańsk, 11 Targ Rakowy Street, 80-830 Gdańsk, entered in the Register of Cultural Institutions kept by the Municipality of the City of Gdańsk under number 12/11.
Contact with the Data Controller on matters concerning personal data and privacy is possible at IKM's head office or via email address: iodo@ikm.gda.pl.

§2
Definitions

Definitions:

Policy - means this Privacy Policy, unless the context or content of the Policy's provisions clearly indicate otherwise,
Data - means personal data, unless otherwise expressly stated in this Policy, which allows you to be identified as an individual, e.g. your name, telephone number, e-mail address, home address, but also in certain situations cookies, usage data, etc.
Authorised person - means a person authorised by the Personal Data Controller to process personal data. An authorised person may be an employee of IKM, a person performing work on the basis of a contract of mandate or another civil law agreement, as well as a person undergoing voluntary work, internship or traineeship;
Processing of personal data - means an operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data;
RODO - means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the EU L 119, p. 1);
IKM website - ikm.gda.pl and pages dedicated directly to projects organised by the IKM,
User - a person using the IKM website,
Profiling - means any form of automated processing of personal data which involves the use of personal data to evaluate certain personal factors of an individual, in particular to analyse or predict aspects relating to that individual's performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

§3
Purposes and grounds for processing personal data

IKM processes your personal data for various purposes, but always in accordance with the law. Below you will find the specified purposes of processing your personal data together with the legal basis.

In order to conclusion and performance of the contract we process such personal data as:

name,
residential or business address,
PESEL or NIP,
e-mail address,
telephone number,
bank account number,
contract number.

The legal basis for such processing is Article 6(1)(b) of the RODO, which allows for the processing of personal data if it is necessary for the performance of a contract or for taking steps to enter into a contract; if you choose to provide other personal data as well, we will consider that you have given your consent to the processing of this data as well, in which case the legal basis for such processing may be Article 6(1)(a) of the RODO, which allows for the processing of personal data on the basis of freely given consent;

In order to telephone/email contact in matters relating to the performance of the contract, we process such personal data as:

name,
telephone number,
e-mail address,

The legal basis for such processing is Article 6(1)(b) RODO, which allows personal data to be processed if it is necessary for the performance of a contract or for taking steps to enter into a contract.

In order to to issue a bill or invoice and to comply with other obligations under tax law, as well as social and health insurance regulations such as, for example, keeping accounting records for 5 years after the end of the year in which the tax obligation resulting from the performance of the contract arose, we process personal data such as:

name,
company,
residential or business address,
NIP,
PESEL,

The legal basis for such processing is Article 6(1)(c) of the RODO, which allows the processing of personal data where such processing is necessary for the Data Controller to comply with its obligations under the law.

In order to satisfaction surveys on IKM activities we process such personal data as:

e-mail address,
name,
company/organisation details, if any, and address of residence or registered office.

The legal basis for such data processing is Article 6(1)(f) of the RODO, which allows personal data to be processed if, by doing so, the Personal Data Controller is pursuing its legitimate interest (in this case, IKM's interest is to learn about your opinion on its cultural activities in order to adapt to the needs and expectations of the cultural audience concerned).

In order to creation of registers and records relating to RODO, including, for example, a register of persons who have objected in accordance with the RODO, we process personal data such as:

name,
e-mail address,

because firstly, the provisions of the RODO impose certain documentation obligations on us to demonstrate compliance and accountability, and secondly, if you object to the processing of your personal data for marketing purposes, for example, we need to know to whom we do not apply direct marketing because they do not wish it.

The legal basis for such processing is, firstly, Article 6(1)(c) of the RODO, which allows for the processing of personal data if such processing is necessary for the Data Controller to comply with its obligations under the law; secondly, Article 6(1)(f) of the RODO, which allows for the processing of personal data if, by doing so, the Data Controller is pursuing its legitimate interest (in this case, IKM's interest is to have knowledge of individuals who are exercising their rights under the RODO).

In order to establish, assert or defend against claims we process such personal data as:

name or, alternatively, company,
residence address or registered office,
PESEL number or NIP number,
e-mail address,
contract number.

The legal basis for such processing is Article 6(1)(f) RODO, which allows the processing of personal data if, by doing so, the Personal Data Controller is pursuing its legitimate interest (in this case, IKM's interest is to have personal data to establish, assert or defend against claims, including those of persons using IKM's business and third parties.

In order to to accept applications for projects, workshops, training, events, cultural, artistic or educational events organised by the IKM We process the following your personal data:

Name;
surname;
residential address;
e-mail address;
telephone number;

The legal basis for such processing is Article 6(1)(a) or (b) of the RODO, which allows personal data to be processed on the basis of freely given consent (in this case, we assume, the filling of the application is a simultaneous consent to the processing of personal data).

In order to archives and evidence we process such personal data as:

name,
contract number,
e-mail address,

- for the purpose of safeguarding information that can serve to prove facts of legal significance. The legal basis for such processing is Article 6(1)(f) of the RODO, which allows personal data to be processed if, by doing so, the Personal Data Controller is pursuing its legitimate interest (in this case, IKM's interest is to have personal data to prove certain facts related to the provision of services, e.g. when some government authority requests it).

In order to the use of an online shop, the sale of tickets by telephone/electronic means for events, cultural or artistic events organised by IKM, as well as payment for tickets/products sold, we process such personal data as:

name (if given),
e-mail address,
bank account number,

The legal basis for such processing is Article 6(1)(a) or (b) of the RODO, which allows personal data to be processed on the basis of freely given consent, or in the case of (b), which allows personal data to be processed if they are necessary for the performance of a contract or for taking steps to enter into a contract.

In order to your posting of a comment on IKM's social media profiles we process such personal data as:

name,

The legal basis for such processing is Article 6(1)(a) RODO, which allows personal data to be processed on the basis of freely given consent (in this case, we assume that the posting of a comment is a concomitant consent to the processing of personal data).

In order to use of cookies on the website, we process such textual information (cookies will be described in a separate section). The legal basis for such processing is Article 6(1)(a) RODO, which allows us to process personal data on the basis of voluntarily given consent (when you first access the website, you are asked if you agree to the use of cookies).

In order to administering the IKM website we process such personal data as:

IP address,
server date and time,
browser information,
information on the operating system

- This data is saved automatically in so-called server logs every time the website belonging to IKM is used. Administration of the website without the use of the server and without this automatic recording would not be possible. The legal basis for such data processing is Article 6(1)(f) RODO, which allows personal data to be processed if by doing so the Personal Data Controller pursues its legitimate interest (in this case IKM's interest is the administration of the website).

In order to running direct marketing we process personal data, such as:

Name;
surname;
e-mail address;
telephone number;

The legal basis for such processing is Article 6(1)(f) of the RODO, which allows the processing of personal data if, by doing so, the Personal Data Controller pursues its legitimate interest.

In order to sending the newsletter we process personal data, such as:

e-mail address;

The legal basis for such processing is Article 6(1)(a) RODO, which allows personal data to be processed on the basis of freely given consent.

§4
Cookies

The Personal Data Administrator uses cookies, i.e. small textual information stored on the User's terminal device (e.g. computer, tablet, smartphone). Cookies can be read by the Personal Data Administrator's ICT system.
The Personal Data Administrator stores cookies on the User's terminal device and then accesses the information contained therein for statistical purposes, for marketing purposes (remarketing) and to ensure the proper functioning of the IKM website.
The Personal Data Administrator hereby informs the User that it is possible to configure the Internet browser in such a way as to prevent the storage of cookies on the User's terminal equipment. In such a situation, the User's use of the IKM website may be impaired.
The Personal Data Administrator hereby points out that cookies may be deleted by the User once they have been stored by the Personal Data Administrator, by means of the appropriate functions of the Internet browser, programs designed for this purpose or by using the appropriate tools available within the operating system used by the User.

§5
Server logs

The use of the IKM website involves sending requests to the server where the website is stored.
Every request made to the server is recorded in the server logs. The logs include, among other things, the User's IP address, the date and time of the server, information about the Internet browser and the operating system the User is using.
Logs are saved and stored on the server.
The data recorded in the server logs are not associated with specific individuals using the Site and are not used by the Personal Data Administrator to identify the User.
The server logs are only ancillary material for the administration of the website, and their contents are not disclosed to anyone other than those authorised to administer the server.

§6
Rules on the protection of your personal data

All your personal data shall be processed in accordance with the applicable legislation.
IKM shall comply with the information obligation under the provisions of the RODO before processing your personal data.
The personal data collected is processed for designated and legitimate purposes.
The processing of your personal data shall be carried out in accordance with the principles relating to factual accuracy and relevant to the purposes for which the data were collected.
Your personal data shall be processed for no longer than is necessary to achieve the purposes of the processing.
Your data shall not be shared without your consent, except with persons or entities authorised in accordance with data protection legislation.
The processing of your data takes place in an IT system as well as in traditional form (written/paper).
You are entitled to all rights under the RODO, as further described in § 8 of this Policy.
IKM verifies and ensures that each of your requests related to the protection of your personal data can be effectively implemented.
IKM ensures an adequate level of security of your data by means of adopted procedures corresponding to the risk of violation of your rights and freedoms as a result of its processing of your personal data.

§7
Children's privacy

The purpose of IKM's policy is to avoid the collection or use of personal data of children under the age of 16, unless consent has been given or approved by the person with parental responsibility or custody of the child.
Where consent to the processing of a child's personal data has been given or approved by the person with parental responsibility or custody of the child, the information contained in this Privacy Policy also applies to the child's personal data.
If we discover that a child under the age of 16 has sent an email enquiry to IKM, or otherwise provided their personal information to IKM, without the prior consent of the person with parental responsibility or custody of the child, we will delete the child's personal information from our databases as soon as possible.
In the event that persons with parental responsibility or custody of a child suspect that their child has provided personal data to IKM and this has occurred without their consent, they are requested to immediately contacting us to request their removal.

§8
Data sharing

Like most entities, we use the assistance of other service providers in our business, which sometimes involves the transfer of personal data. Accordingly, if necessary, we will pass on your personal data to the lawyer cooperating with us who performs IKM's legal services, to banks processing payments for contracts performed, services or goods purchased, to the hosting company maintaining IKM's website, to the company providing IKM with e-mail services, to telecommunication operators providing services to IKM, and, if required, to institutions entitled to account and audit IKM's activities (subject, of course, to the requirements of applicable laws).
Notwithstanding the above, it may happen, for example, that we are obliged to pass on your personal data to other entities as well, for example, on the basis of a relevant legal provision or a decision of a competent authority. Consequently, it is difficult for us to predict who may come forward with a request for personal data. Nevertheless, for our part, we assure you that we analyse each request for personal data very carefully in order not to pass on information to an unauthorised person.
Only persons with a personal data processing authorisation issued by the Data Controller will be allowed to process personal data and to handle IT files containing your data.
The tool, as well as the entity implementing the sending of marketing information in the form of a newsletter, is FreshMail Sp. z o.o. with its registered office in Kraków, 31-406 Kraków, Al. 29 Listopada 155 c, entered into the register of entrepreneurs of the National Court Register by the District Court for Kraków-Śródmieście in Kraków, XI Economic Division of the National Court Register under KRS no.: 0000497051.
In any event, we require third parties to maintain the confidentiality and security of the data provided and to use it only to provide us with the service or product in question.

§9
Entitlements

In accordance with the provisions of the RODO, the Act on the provision of electronic services and the Telecommunications Act, you are entitled to:
the right to withdraw consents:

processing of your personal data, if the processing is based on consent,

In this case, you may withdraw your consent at any time at IKM's head office, by telephone, by e-mail or by letter. If the processing of your personal data took place on the basis of your consent, revoking your consent does not render the processing of your personal data up to that point unlawful, i.e. revoking your consent does not affect the lawfulness of the previous processing.

the right to bring:

to object to the processing of your data for direct marketing purposes,
a legitimate objection to the processing of your personal data within the framework of IKM's legitimate interests for reasons related to your particular situation;

However, you must bear in mind that, in accordance with the regulations, we may refuse to take an objection into account if we can demonstrate that there are legitimate grounds for the processing which override your interests, rights and freedoms or there are grounds for the establishment, assertion or defence of claims.

The right of access to your data, including obtaining a copy of the data being processed, also in electronic form;
The right to rectification (correction) of your personal data, If your data in our possession is inaccurate or incomplete, IKM will rectify it at your request;
The right to erasure of your data, if your data are no longer necessary for the purposes for which they were collected and IKM has no basis for processing them, e.g. on the basis of your consent or the fulfilment of a legal obligation, where an effective objection has been lodged against the processing of your data or the need to erase your data arises from a legal obligation;
right to data portability provided to us by you in machine-readable format, e.g. for sharing with another service provider;
the right to restrict the processing of your data in the following cases (please indicate one of the following cases when submitting your application):

if you have concerns about the accuracy of your data;
if you believe that we should not process your data, but at the same time you do not want us to delete it;
if we no longer need such personal data, but you need them in connection with the assertion of claims;
if you have objected to the processing of your data and it is our responsibility to check whether we should continue to process it.

You may exercise your rights by making an appropriate instruction at IKM's premises, by post, by email or by telephone.
IKM shall provide you with information on the action taken on your request as soon as possible and no later than one month after receipt of your request. If necessary, the deadline for your request may be extended by a further two months due to the complexity of the request or the number of requests made to IKM.
In order to fulfil your request, we are entitled to verify your identity so that your data does not reach an unauthorised person.
If your request would appear to be manifestly unfounded or excessive, in particular due to its repetitive nature, IKM may either demand a reasonable fee for processing the request or refuse to act on the request.

§10
Requirement to provide personal data

The provision of any personal data is voluntary and at your discretion. However, in some cases, the provision of certain personal data is necessary in order to meet your expectations with regard to the use of our activities and so, for example:
In order to conclude a contract with us, it is necessary to provide your name, surname, address, PESEL or NIP number - without this we are unable to conclude and perform the contract.
In order for you to be able to receive an invoice for your services, it is necessary to provide all the data required by tax law, i.e. your name or company name, your address or registered office address, your PESEL or NIP number - without this, we are unable to correctly issue the invoice.
In order to be able to contact you by telephone in matters concerning the execution of the contract, it is necessary to provide a telephone number - without this we are unable to make telephone contact.
If you wish to receive the newsletter by e-mail, it is necessary to provide your e-mail address - without this we are unable to send you the news.

§11
Period of processing of personal data

In accordance with the applicable legislation, we process your personal data for the period of time that is necessary to achieve the stated purpose. After this period, your personal data will be irreversibly deleted or destroyed.
In situations where we do not need to perform operations on your personal data other than storing them, we will additionally protect them - by pseudonymisation - until they are permanently deleted or destroyed.
Regarding the specific processing periods for personal data, we kindly inform you that we process personal data for a period of time:

the duration of the contract - in relation to personal data processed for the conclusion and performance of the contract;
3 years or 6 years + 1 year - in respect of personal data processed for the purpose of establishing, pursuing or defending claims (the length of the period depends on whether or not both parties are businesses);
6 months - with regard to personal data collected when attempting to conclude a contract while the contract was not concluded immediately and with regard to personal data provided for the purpose of participating in an event, etc. organised by IKM;
5 years - for personal data involving compliance with tax law obligations;
until the consent is withdrawn or the purpose of the processing is achieved, but for no longer than 3 years - for personal data processed on the basis of consent;
until an effective objection is lodged or the purpose of the processing is achieved, but for no longer than 5 years - in relation to personal data processed on the basis of the legitimate interest of the Personal Data Controller or for marketing purposes;
until it becomes obsolete or is no longer relevant, but for a maximum of 3 years, with regard to personal data processed mainly for analytical purposes, the use of cookies and website administration.

We count periods in years from the end of the year in which we started processing personal data in order to streamline the process of deleting or destroying personal data.
The additional year associated with the processing of personal data collected for the performance of a contract is dictated by the fact that you may make a claim moments before the expiry of the limitation period, the demand may be served with a material delay or you may misstate the limitation period for your claim.

§12
Right of action

If you believe that your personal data is being processed in violation of applicable law, you may lodge a complaint with the President of the Data Protection Authority.

§13
Automated decision-making and profiling

Please be advised that IKM identifies cases where profiling of processed data will take place and has mechanisms in place to ensure the legality of this process. Where profiling and automated decision-making are identified, IKM will follow the established rules in this regard.

§14
Final provisions

To the extent not covered by this Privacy Policy, the data protection regulations apply.
Any changes made to this Privacy Policy, other than of an editorial nature, will be notified to you by email.