Information on the Processing of Personal Data pursuant to Article 13(1) and (2) of Regulation (EU) 2016/679 (GDPR)
In accordance with Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR), we provide the following information concerning the processing of personal data collected through the InfoTester project website and related online activities.
1. Data Controller
The Controller of your personal data is Science4People sp. z o.o., with its registered office at 6/32 Warszawska Street, 15-063 Białystok, Poland (hereinafter referred to as the “Controller”).
2. Data Protection Officer
The Controller has designated a Data Protection Officer (DPO). You may contact the DPO in all matters relating to the processing of your personal data and the exercise of your rights at:
3. Categories of personal data processed
Depending on the purpose and nature of your interaction with the InfoTester website and project activities, the Controller may process the following categories of personal data:
- name and surname, where provided;
- e-mail address and other contact details, where provided;
- organisation, institution or professional affiliation, where provided;
- country and other information provided voluntarily by you;
- information contained in messages, enquiries, feedback or other communications submitted through the website;
- information concerning your participation in questionnaires, tests, surveys or other activities available through the InfoTester website;
- technical information necessary for the secure operation of the website and its services, such as IP address, browser type and information concerning the use of the website, where such information constitutes personal data under applicable law.
The Controller only collects and processes personal data that are necessary for the respective purpose of processing.
4. Purposes and legal bases of processing
Your personal data may be processed for the following purposes:
a) communication and responding to enquiries submitted through the InfoTester website, where processing is necessary for the performance of a task carried out in the public interest in connection with the objectives and activities of the InfoTester project – pursuant to Article 6(1)(e) GDPR;
b) organisation and administration of participation in project activities, including questionnaires, surveys, tests, educational activities and other activities implemented within the InfoTester project, where applicable – pursuant to Article 6(1)(e) GDPR or, where appropriate, Article 6(1)(a) GDPR;
c) information and promotion of the InfoTester project and its results, including informing participants and interested persons about project activities, results and events, where processing is based on the consent provided by the data subject – pursuant to Article 6(1)(a) GDPR;
d) ensuring the security, proper functioning and maintenance of the website and IT systems, where applicable, on the basis of the legitimate interests pursued by the Controller – pursuant to Article 6(1)(f) GDPR.
Where processing is based on consent, providing personal data is voluntary and consent may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
5. Recipients of personal data
Your personal data may be accessible to persons authorised by the Controller to process personal data and to entities providing services necessary for the operation of the InfoTester website and IT infrastructure, such as hosting, technical support, maintenance and other services, where such entities act on behalf of and under the instructions of the Controller.
Personal data will not be disclosed to third parties unless such disclosure is necessary for the purposes described above, required by law, or based on another valid legal basis.
6. Transfers of personal data outside the European Economic Area
The Controller does not intend to transfer your personal data to countries outside the European Economic Area, unless such transfer is necessary for the provision of a specific service or otherwise permitted under the GDPR. Where such a transfer takes place, the Controller will ensure that the requirements of Chapter V of the GDPR are complied with and that appropriate safeguards are applied where required.
7. Retention period
Personal data will be retained only for as long as necessary to achieve the purposes for which they were collected, or for as long as required by applicable law.
Where personal data are processed on the basis of consent, they will generally be deleted when the consent is withdrawn, unless there is another legal basis for their further processing.
Data submitted solely for the purpose of contacting the Controller will be deleted after the enquiry has been handled, and no further communication is necessary, unless their further retention is required by law or is necessary to establish, exercise or defend legal claims.
Technical data and website logs may be retained for a period necessary to ensure the security and proper functioning of the website and IT systems.
8. Rights of the data subject
You have the right, under the conditions set out in the GDPR, to:
- request access to your personal data;
- request rectification of inaccurate or incomplete personal data;
- request erasure of your personal data;
- request restriction of processing;
- object to the processing of your personal data where the applicable legal conditions are met;
- request data portability where the processing is based on consent or a contract and is carried out by automated means;
- withdraw your consent at any time where processing is based on consent.
To exercise your rights, please contact the Data Protection Officer at piotr@science4people.eu.
9. Right to lodge a complaint
You have the right to lodge a complaint with the supervisory authority competent for data protection if you consider that the processing of your personal data infringes the GDPR or other applicable data protection legislation.
In Poland, the competent supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).
10. Voluntary provision of personal data
Providing personal data is voluntary. However, depending on the particular purpose, failure to provide the data necessary to respond to an enquiry or to participate in a specific activity may make it impossible to provide the requested service, respond to the enquiry or enable participation in that activity.
11. Automated decision-making and profiling
Your personal data will not be subject to automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you.
12. Additional information
The Controller applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure or other unlawful forms of processing.
This information may be updated where necessary to reflect changes in the processing of personal data or changes in applicable legislation.