Detailed information on the processing of personal data by the European University of Business in Warsaw, Al. Solidarności 117, 00-140 Warsaw, in connection with the requirements of Articles 13 and 14 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals, with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter “GDPR”).
1. Administrator of personal data
The administrator and controller of the collected personal data is the European School of Business in Warsaw, a non-public university, entered in the register of universities kept by the Ministry of Education and Science under number 221. If you have questions about the processing of your personal data and your rights, please contact our Data Protection Officer at email address: firstname.lastname@example.org or by mail to: European University of Business in Warsaw, 117 Solidarności Avenue, 00-140 Warsaw.
2. Purposes of personal data processing and legal basis for processing
Personal data are processed:
a. For the purpose of providing educational services, taking the necessary steps prior to the conclusion of the agreement, its execution and archiving the data after the service has been provided, we will process your data on the basis of the agreement concluded or the Act of 20 July 2018. Law on Higher Education and Science, for a period of time:
i. 50 years in accordance with par. 15(12)(4) of the Regulation of the Minister of Science and Higher Education of 27 September 2018 on studies,
ii. 25 years if the documentation relates to postgraduate studies and MBA and Executive MBA,
iii. the period resulting from the applicable legislation in the case of other educational services (e.g. training),
iv. 6 months from the end of your enrolment if you do not undertake your studies with us.
b. For marketing purposes for the duration of the contract concluded with the university for the provision of our services and as part of the use of our website, services and other functionalities provided by us on the websites, including those stored in cookies. The legal basis for sending information electronically is the Act of 18 July 2002 on the provision of electronic services (Journal of Laws 2020.0.344).
c. In the implementation of the Newsletter service, the legal basis for the processing of personal data is Article 6.1.b of GDPR. Your data under the provided service will be processed until you unsubscribe.
d. Within the framework of the social media channels operated by them under the conditions specified by them in order to inform you about our activities, events organized by us, products and services offered, and in order to analyze the functioning of our channels of communication and sending you commercial information. The basis of data processing is the legitimate interest, which consists in promoting our activities and answering your questions. The processed data are kept for the period of operation of the channel until you delete your account or cancel the channel of communication.
e. For the purpose of teaching using distance learning methods and techniques, the legal basis for data processing is Article 12(1) of the Regulation of the Minister of Science and Higher Education of 27 September 2018 on studies. This also means verification of the achieved learning outcomes specified in the study programme, in particular conducting examinations completing specific classes, outside the seat of the university or outside its branch, using electronic means of communication. In the case of diploma examinations conducted outside the seat of the higher education institution or outside its branch using electronic means of communication, these means must ensure in particular real-time transmission of the diploma examination between its participants and real-time multilateral communication. The legal basis for data processing is Article 76a (1) of the Act of 20 July 2018. Law on Higher Education and Science. Personal data processed during the transmission will only be processed for the duration of the task.
f. Your personal data will be processed in order to enable you to use the library’s resources and to use the reading room, to enable you to use the library’s collection, to use the library information system operating at the University and to enable us to fulfil our obligations under the Act of 27 June 1997 on libraries (Journal of Laws 2018, item 574 consolidated text) and the Act of 20 July 2018 – Law on Higher Education and Science (Journal of Laws 2018, item 1668 as amended). The basis for processing your personal data is Article 6(1)(b) and (c) of the GDPR and Article 6(1)(a) of the GDPR, if applicable.
g. In order to ensure the safety of persons on University premises and to secure property, as well as to establish, assert or defend claims in judicial, administrative or out-of-court proceedings – we conduct video surveillance. The legal basis for processing the data recorded as part of the conducted monitoring is our legitimate interest (Article 6.1.f of GDPR). Recordings from video surveillance are stored for a period not longer than three months from the date of recording, unless the recording is necessary to establish, document events as part of the purposes for which the monitoring is conducted, then the period of processing will be extended until the completion of these tasks.
h. In order to establish claims, defend against them and pursue them, which constitutes our legitimate interest. We process these data until the statute of limitations for possible claims set forth by law.
3. Rights of data subjects
You have the right:
• to access the content of your data,
• to rectify your data,
• to delete your data, if:
– you withdraw your consent to the processing of your personal data,
– your personal data are no longer necessary for the purposes for which they were collected or processed,
– you file an objection to the use of your data for marketing purposes,
– you file an objection to the use of your data for the purpose of adapting our services to your preferences,
– your personal data are being processed unlawfully,
• to restrict processing of your data,
• to object to the processing of your data,
• to move your data,
• to withdraw your consent at any time. Withdrawal of consent does not affect the processing carried out by us before its withdrawal,
• to lodge a complaint to the supervisory authority (PUODO), if you consider that the processing of your personal data violates the provisions of applicable law.
4. Processing of data collected by automated means
We shall process personal data collected for marketing purposes in an automated manner in the form of profiling. By analyzing the data provided, we will present an offer tailored to your needs. On the basis of the data received from you, we also adjust the content of online advertisements to your preferences. Here, too, we act on the basis of our legally justified interest, which consists in promoting our business and choosing the best offer for you. You can change your browser settings in order to switch off, among other things, the personalization of advertisements. In this respect, we refer you to the relevant rules of your browser.
5. Sharing of personal data
Data may be disclosed to public authorities, but only if they are authorized to do so by applicable laws.
Data such as first name, University email address will be transferred for processing to data recipients, in particular entities cooperating with the Personal Data Administrator, providing the University with electronic communication tools, including MS Office 365 tools. By entities cooperating with the Personal Data Administrator we mean entities directly or indirectly related to the Personal Data Administrator.
Additionally, your data in the following fields: first name, University email address will be visible to other students, also from entities related to the Personal Data Administrator, through the address book. The purpose of sharing the data is to ensure proper communication with the students within the scope of the performed teaching tasks, participation in study groups, participation in science clubs, as well as activities carried out by the Student Government.
In connection with our use of social media, your personal data may be transferred to the owners of the following portals: Facebook, LinkedIn, YouTube, Instagram, among others, as well as to marketing agencies serving us.
The Administrator’s suppliers are headquartered mostly in Poland and other EEA countries. Some of them may have seats outside of the EEA territory. In the latter case, the Administrator of your personal data will make sure that the suppliers guarantee a high level of data protection.