Cookie policy

Definitions

Administrator: Akademia Sztuk Pięknych w Warszawie ul. Krakowskie Przedmieście 5, 00-068 Warszawa, NIP: 5250008666, REGON: 000275777.

Personal data: all information about an identified or identifiable natural person through one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the natural person, including the IP number of the device, location data, an online identifier and information collected through cookies and other similar technology.

Policy: this Privacy Policy.

RODO: Regulation (EU) 2016/679 of the European Parliament and of the Council of 7 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC.

Services: the website or online service issued by the Administrator to which this Policy applies.

User: any natural person visiting the Website or using one or more services or functionalities made available on the Website.

Processing of data in connection with the use of the service

In connection with the User's use of the Website, the Administrator collects data to the extent necessary for the provision of individual services offered on the Website, as well as information on the User's activity on the Website. The detailed principles and purposes of the processing of personal data collected during the User's use of the Website are described below.

Purposes and legal basis of data processing on the site

Use of the Website

Personal data of all persons using the Website (including IP address or other identifiers and information collected through cookies or other similar technologies), are processed by the Administrator:

• in order to provide services electronically in terms of providing Users with access to content collected on the Website - in which case the legal basis for the processing is the necessity of the processing for the performance of the contract (Article 6(1)(b) RODO),
• for analytical and statistical purposes - in which case the legal basis for the processing is the legitimate interest of the Administrator (Article 6(1)(f) RODO), consisting of conducting analyses of the Users' activities, as well as their preferences, in order to improve the functionalities used and the services provided;
• for the purpose of possibly establishing, investigating or defending against claims - the legal basis for the processing is the legitimate interest of the Administrator (Article 6(1)(f) RODO) to protect your rights.

The User's activity on the Website, including his/her personal data, are recorded in system logs (a special computer programme used to store a chronological record containing information on events and activities concerning the IT system used to provide services by the Administrator). The information collected in the logs is processed primarily for purposes related to the provision of services. The Administrator also processes this data for technical, administrative purposes, for the purposes of ensuring the security of the IT system and its management, as well as for analytical and statistical purposes - in this regard, the legal basis for processing is the Administrator's legitimate interest (Article 6(1)(f) RODO).

Contact forms

The Administrator provides the possibility to contact him/her using electronic contact forms. The use of the form requires the User to provide personal data necessary to contact the User and respond to the enquiry. The User may also provide other data in order to facilitate the contact or handling of the enquiry. The provision of data marked as mandatory is required in order to receive and handle the enquiry, and failure to provide such data will result in the impossibility of handling the enquiry. The provision of other data is voluntary.

Personal data is processed:

• for the identification of the sender and the handling of his/her enquiry sent via the form provided - the legal basis of the processing is the necessity of the processing for the performance of the service contract (Article 6(1)(b) RODO);
• for analytical and statistical purposes - the legal basis for the processing is the Administrator's legitimate interest (Article 6(1)(f) RODO), consisting of keeping statistics on queries made by Users via the Website in order to improve its functionality.

Newsletter

The Administrator provides a newsletter service to persons who have provided their e-mail address for this purpose. The provision of data is required in order to provide the newsletter service, and failure to do so will result in the newsletter not being sent.

Personal data is processed:

• for the purpose of providing the newsletter mailing service - the legal basis for the processing is the necessity of the processing for the performance of the contract (Article 6(1)(b) RODO);
• in the case of directing marketing content to the User as part of a newsletter - the legal basis for the processing, including profiling, is the legitimate interest of the Administrator (Article 6(1)(f) RODO), in connection with the consent to receive the newsletter;
• for analytical and statistical purposes - the legal basis of the processing is the Administrator's legitimate interest, (Article 6(1)(f) RODO) consisting of conducting analyses of Users' activity on the Website, in order to improve the applied functionalities;
• for the purpose of possibly establishing, investigating or defending against claims - the legal basis for the processing is the legitimate interest of the Administrator (Article 6(1)(f) RODO).

Social networks

The Administrator processes the personal data of Users visiting the Administrator's profiles maintained on social media (Facebook, LinkedIn, YouTube, Instagram, Twitter, Pinterest). This data is processed exclusively in connection with the running of the profile, including for the purpose of informing Users about the Administrator's activities and promoting various events, services and products. The legal basis for the Administrator's processing of personal data for this purpose is the Administrator's legitimate interest (Article 6(1)(f) RODO) in promoting its own brand.

Cookies and related technology

Cookies are IT data, in particular text files, installed on the User's device when browsing the Website. Cookies usually contain the domain name of the website from which they originate, the time they are stored on the end device and a unique number. In this Policy, information on cookies also applies to other similar technologies used within the Service.

Cookies are used for:

• adapting the content of the websites to the user's preferences and optimising the use of the websites; in particular, these files allow for the recognition of the website user's device and appropriate display of the website, adapted to his/her individual needs,
• to create statistics which help us to understand how visitors use the websites, so that we can improve their structure and content,
• maintain the session of the website user (after logging in), so that the user does not have to re-enter his/her login and password on each page of the website.

Service cookies

The Administrator uses so-called service cookies primarily to provide the User with services provided electronically and to improve the quality of these services. In this regard, the Administrator and other entities providing analytical and statistical services to the Administrator make use of cookies, storing information or accessing information already stored in the User's telecommunications end device (computer, phone, tablet, etc.).

Cookies used for this purpose include:

• cookies with data entered by the user (session ID) for the duration of the session (userinputcookies)
• authentication cookies used for services that require authentication for the duration of the session (authenticationcookies);
• security cookies, e.g. used to detect authentication abuse (usercentricsecuritycookies);
• multimedia playersessioncookies (e.g. flash player cookies), for the duration of the session;
• persistent cookies for personalisation of the user interface, for the duration of the session or slightly longer (userinterfacecustomisationcookies).

More information about cookies

The Administrator may also use cookies for marketing purposes, including in connection with targeting Users with behavioural advertising. For this purpose, the Administrator may store information or access information already stored in the User's telecommunications terminal equipment (computer, telephone, tablet, etc.). The use of cookies and the personal data collected through them for marketing purposes, in particular to promote the services and goods of third parties, requires the User's consent. This consent may be withdrawn at any time.

Marketing cookies

In many cases, the web browsing software (web browser) allows cookies to be stored on the User's terminal device by default. Users of the Website may change their cookie settings at any time. These settings can be changed in particular in such a way as to block the automatic handling of cookies in the settings of the web browser or inform on their placement in the device of the user of the website every time. Detailed information on the possibility and methods of using cookies is available in the settings of your software (web browser). Failure to change the settings with regard to cookies means that they will be placed on the user's terminal equipment, and thus the Administrator will store information on the user's terminal equipment and gain access to this information.

Processing period for personal data

The period of data processing by the Administrator depends on the type of service provided and the purpose of the processing. As a general rule, the data are processed for the duration of the service provided or the fulfilment of the order, until the consent given is withdrawn or an effective objection is made to the data processing in cases where the legal basis for the data processing is the legitimate interest of the Administrator.

The processing period may be extended if the processing is necessary for the establishment, investigation or defence against possible claims, and thereafter only if and to the extent required by law. After the expiry of the processing period, the data shall be irreversibly deleted or anonymised.

User privileges

The user has the right: to access the content of the data and to request rectification, erasure, restriction of processing, the right to data portability and the right to object to the processing of the data, as well as the right to lodge a complaint with the supervisory authority in charge of personal data protection.

To the extent that the User's data are processed on the basis of consent, the consent may be withdrawn at any time by contacting the Administrator (via e-mail address iodo@asp.waw.pl or in writing to Akademia Sztuk Pięknych w Warszawie ul. Krakowskie Przedmieście 5, 00-068 Warszawa), or using the functionalities made available on the Website.

Right of opposition

User have the right to object at any time to the processing of your data for direct marketing purposes, including profiling, if the processing is carried out for the legitimate interest of the controller.

The User also has the right to object at any time to the processing of his/her data on grounds relating to his/her particular situation in cases where the legal basis for the processing is the legitimate interest of the Controller (e.g. in connection with the performance of analytical and statistical purposes, including profiling). For more information on your rights under the RODO, please see the "Personal data" subpage, available here.

Data recipients

In connection with the provision of services, personal data will be disclosed to external entities, including in particular suppliers responsible for operating the IT systems used to provide the services, entities such as banks and payment operators, research companies, entities providing accounting services, couriers (in connection with the fulfilment of the order), marketing agencies (for marketing services) and entities related to the Administrator.

The Administrator reserves the right to disclose information concerning the User to the competent authorities or third parties who request such information on the basis of an appropriate legal basis and in accordance with the provisions of the applicable law.

Transfers of data outside the European Economic Area

The level of protection of personal data outside the European Economic Area (EEA) differs from that provided by European law. For this reason, the Controller transfers personal data outside the EEA only if

• cooperation with processors of personal data in countries for which a relevant European Commission decision has been issued;
• the use of standard contractual clauses issued by the European Commission;
• the application of binding corporate rules approved by the competent supervisory authority.

The controller always informs of the intention to transfer personal data outside the EEA at the stage of collection.

Security of personal data

The controller shall carry out a risk analysis on an ongoing basis to ensure that personal data is processed by the controller in a secure manner, ensuring in particular that only authorised persons have access to the data and only to the extent necessary for the performance of their tasks. The controller shall ensure that all operations on personal data are recorded and carried out only by authorised employees and associates.

The Administrator shall take all necessary measures to ensure that also its subcontractors and other cooperating entities guarantee the application of appropriate security measures whenever they process personal data on behalf of the Administrator.

Contact information

Contact with the Administrator is possible via e-mail address: iodo@asp.waw.pl or in writing to the following address: Academy of Fine Arts in Warsaw ul. Krakowskie Przedmieście 5, 00-068 Warszawa.

The Data Controller has appointed a Data Protection Officer who can be contacted via e-mail: iodo@asp.waw.pl on any matter concerning the processing of personal data.

Changes in the privacy policy

The policy is kept under review and updated as necessary.
The current version is effective from 1 January 2023.