Privacy notice

PRIVACY NOTICE FOR PERSONS USING THE CONTACT FORM

1. Controller of personal data

The controller of your personal data is the Robert Dobrzycki Foundation, with its registered office in Warsaw, at Rondo Ignacego Daszyńskiego 1, 00-843 Warsaw, entered into the register of associations, other social and professional organisations, foundations and independent public healthcare institutions of the National Court Register (KRS) under number 0001092803, NIP (tax identification number) 5273103351, REGON 528059349, hereinafter referred to as the “Foundation” or the “Controller”.

 

2. Contact with the Controller

You may contact the Controller:

  1. by e-mail at: [email protected];
  2. in writing at the Controller’s registered office: Rondo Ignacego Daszyńskiego 1, 00-843 Warsaw.

The Foundation has not appointed a data protection officer. Questions regarding the processing of personal data may be directed directly to the Controller using the contact details above.

 

3. Purposes and legal bases for processing data

Your personal data will be processed:

  1. for the purpose of receiving and handling the message sent via the contact form, providing a response and conducting further correspondence – on the basis of Article 6(1)(f) GDPR, i.e. the legitimate interest of the Controller consisting in communicating with persons interested in the Foundation’s activities;
  2. if the message concerns establishing cooperation, concluding a contract or taking action at your request prior to concluding a contract – on the basis of Article 6(1)(b) GDPR;
  3. for the purpose of forwarding the enquiry or the information contained in the message to another foundation, non-governmental organisation, institution or other entity cooperating with the Controller, where, due to the subject matter of the enquiry, that entity is competent to consider it, provide assistance or undertake cooperation – on the basis of Article 6(1)(f) GDPR, i.e. the legitimate interest of the Controller and of the recipient of the data consisting in the effective handling of enquiries, the coordination of assistance activities and the pursuit of statutory objectives;
  4. for the purpose of establishing, pursuing or defending against any claims related to the submitted enquiry or the correspondence conducted – on the basis of Article 6(1)(f) GDPR, i.e. the legitimate interest of the Controller consisting in the protection of its rights.

 

4. Scope of processed data

The Controller will process the data provided by you in the contact form, comprising: first name, surname, e-mail address, and the information contained in the content of the message and further correspondence.

Please do not include in the content of the message any data that is not necessary to deal with the matter, in particular data concerning health, disability, racial or ethnic origin, political views, religious or philosophical beliefs, or other data belonging to special categories of personal data.

If handling a particular enquiry requires the processing, or the transfer to another entity, of data belonging to special categories of personal data, the Controller will request explicit consent, unless the processing of such data is possible on another legal basis.

 

5. Recipients of personal data

Your personal data may be transferred to:

  1. other foundations, non-governmental organisations, institutions or partners cooperating with the Controller – where this is justified by the subject matter of the message sent and necessary for the proper handling of the enquiry, the provision of assistance, the assessment of a cooperation proposal or the implementation of a joint project;
  2. entities providing IT, hosting and maintenance services to the Controller, as well as services related to the operation of the website and e-mail;
  3. providers of the systems and tools used to handle correspondence;
  4. entities providing legal, advisory, accounting or auditing services to the Controller – where necessary;
  5. entities authorised to receive data under the provisions of law.

The Controller will transfer only the data necessary to achieve the given purpose, taking into account the nature of the enquiry and the reasonable expectations of the data subject.

If the data is transferred to another foundation, organisation, institution or other partner for the purpose of independently considering the enquiry, that entity will, as a rule, be a separate controller of the received personal data and will be obliged to provide you with information on the rules for its processing, in accordance with the applicable provisions of law.

 

6. Transfer of data outside the European Economic Area

As a rule, the Controller does not intend to transfer your personal data outside the European Economic Area or to international organisations.

However, should the providers of the IT solutions used by the Controller process data outside the European Economic Area, the transfer of data will take place solely in accordance with the provisions of the GDPR, in particular on the basis of a European Commission decision confirming an adequate level of protection, or subject to appropriate safeguards, including standard contractual clauses.

Information on the safeguards applied, and the possibility of obtaining a copy thereof, can be obtained from the Privacy Policy or by contacting the Controller.

 

7. Data retention period

Your personal data will be stored for the period necessary to handle the message and to conduct the related correspondence, and subsequently for a period no longer than 12 months from the end of the communication.

If the correspondence leads to the establishment of cooperation or the conclusion of a contract, the data may be stored for the duration of the cooperation and subsequently for a period arising from the applicable provisions of law or until the expiry of the limitation period for related claims.

Data processed for the purpose of establishing, pursuing or defending against claims may be stored until the final conclusion of the related matter or the expiry of the relevant limitation period.

 

8. Rights of the data subject

In connection with the processing of personal data, you have the right – under the conditions set out in the GDPR – to:

  1. access your personal data and obtain a copy thereof;
  2. rectify or supplement the data;
  3. erase the data;
  4. restrict the processing of the data;
  5. data portability – where the data is processed on the basis of Article 6(1)(b) GDPR and by automated means;
  6. object, on grounds relating to your particular situation, to the processing of data carried out on the basis of the legitimate interest of the Controller, including to the transfer of data to other organisations for the purpose of handling the enquiry;
  7. lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) if you consider that the data is being processed unlawfully.

 

9. Voluntary nature of providing data

Providing personal data is voluntary; however, providing your first name, surname and e-mail address is necessary in order to send a message via the form and to enable the Controller to handle it. Failure to provide this data will make it impossible to send the form or to provide a response.

 

10. Automated decision-making

Your personal data will not be used to make decisions in a solely automated manner, including profiling.