Privacy Policy

1DEFINITIONS

1.1. Controller – Prywatne Akademickie Centrum Ksztalcenia – Jerzy Waligora, Kazimiera Waligora, Milosz Waligora, Agnieszka Kucz Spolka Cywilna, with its principal place of business at ul. Karmelicka 45, 31-128 Krakow, VAT no. 676-22-09-977, e-mail sekretariat@pack.edu.pl, telephone: 12 633 96 57.

1.2. Personal data – all information about an identified or identifiable natural person, by reference to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity, including the device IP address, location data, an online identifier and information collected by means of cookies and other similar technology.

1.3. Policy – this Privacy Policy.

1.4. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

1.5. Portal/Website – the website operated by the Controller at www.academos.krakow.pl.

1.6. User – any natural person visiting the Portal or using the services or functionalities described in the Policy.

2PROCESSING OF DATA IN CONNECTION WITH USE OF THE PORTAL

2.1. In connection with the User use of the Portal, the Controller collects data to the extent necessary to provide services by electronic means, as well as information about the User activity on the Portal. The detailed rules and purposes of the processing of personal data collected while the User uses the Portal are described below.

3PURPOSES AND LEGAL BASES FOR PROCESSING DATA ON THE PORTAL

USE OF THE PORTAL

3.1. The personal data of everyone using the Portal (including the IP address or other identifiers and information collected by means of cookies or other similar technologies) is processed by the Controller:

3.1.1. in order to provide services by electronic means, namely making the content gathered on the Portal available to Users and providing contact forms – in which case the legal basis for processing is that processing is necessary for the performance of a contract where the enquiry relates to the possibility of concluding a contract (Article 6(1)(b) GDPR), or consent where it concerns other matters (Article 6(1)(a) GDPR);

3.1.2. for analytical and statistical purposes – in which case the legal basis for processing is the legitimate interest of the Controller (Article 6(1)(f) GDPR) in analysing User activity and preferences in order to improve the functionalities and services provided;

3.1.3. in order to establish and pursue claims or to defend against them – the legal basis for processing is the legitimate interest of the Controller (Article 6(1)(f) GDPR) in protecting its rights;

3.1.4. for the Controller marketing purposes – the rules on processing personal data for marketing purposes are described in the MARKETING section. User activity on the Portal, including their personal data, is recorded in system logs (a dedicated computer program that keeps a chronological record of events and actions relating to the IT system used by the Controller to provide its services). The information gathered in the logs is processed in connection with the operation of the Portal. The Controller also processes it for technical purposes; in particular, data may be temporarily stored and processed in order to ensure the security and correct operation of IT systems, for example in connection with making backups, testing changes to IT systems, detecting irregularities or protecting against abuse and attacks. CONTACT FORMS

3.2. The Controller makes it possible to get in touch using electronic contact forms or the e-mail address provided. Using the form requires providing the personal data necessary to contact the User. The User may also provide other data in order to make contact or handling the enquiry easier. Providing the data marked as mandatory is required in order to accept and handle an enquiry; failure to provide it means the enquiry cannot be handled. Providing the remaining data is voluntary.

3.3. Personal data is processed:

3.3.1. in order to identify the sender and handle the enquiry submitted via the form provided – the legal basis for processing is that processing is necessary for the performance of a contract for the provision of a service (Article 6(1)(b) GDPR);

3.3.2. in order to identify the sender and handle the enquiry submitted via the form provided – the legal basis is consent, where the enquiry concerns a matter other than the wish to conclude a contract (Article 6(1)(a) GDPR);

3.3.3. for analytical and statistical purposes – the legal basis for processing is the legitimate interest of the Controller (Article 6(1)(f) GDPR) in keeping statistics of enquiries submitted by Users via the Portal in order to improve its functionality.

4MARKETING

4.1. The Controller processes Users personal data in order to carry out marketing activities, which may consist of:

4.1.1. displaying marketing content to the User that is not tailored to their preferences (contextual advertising);

4.1.2. displaying marketing content to the User that corresponds to their interests (behavioural advertising).

5SOCIAL MEDIA

5.1. The Controller processes the personal data of Users who visit the Controller profiles on social media (Facebook). This data is processed solely in connection with running the profile, including informing Users about the Controller activities and promoting various events, services and products, and communicating with users through the functionalities available on social media. The legal basis for the Controller processing of personal data for this purpose is its legitimate interest (Article 6(1)(f) GDPR) in promoting its own brand and in building and maintaining a community around that brand.

6COOKIES AND SIMILAR TECHNOLOGY

6.1. Cookies are small text files placed on the device of a User browsing the Portal. Cookies collect information that makes using the website easier – for example by remembering the User visits to the Portal and the actions they take. FUNCTIONAL COOKIES

6.2. The Controller uses so-called functional cookies primarily in order to provide the User with services by electronic means and to improve the quality of those services. Accordingly, the Controller and other entities providing analytical and statistical services to it use cookies, storing information on or gaining access to information already stored on the User terminal equipment (computer, telephone, tablet, etc.). The cookies used for this purpose include:

6.2.1. cookies holding data entered by the User (session identifier) for the duration of the session (user input cookies);

6.2.2. authentication cookies used for services requiring authentication, for the duration of the session;

6.2.3. cookies used to ensure security, for example to detect authentication abuse (user centric security cookies);

6.2.4. multimedia player session cookies (for example flash player cookies), for the duration of the session;

6.2.5. persistent cookies used to personalise the User interface, for the duration of the session or somewhat longer (user interface customization cookies),

6.2.6. cookies used to remember the contents of the basket for the duration of the session (shopping cart cookies);

6.2.7. cookies used to monitor website traffic, that is data analytics, including Google Analytics cookies (files used by Google to analyse how the User uses the Portal and to produce statistics and reports on how the Portal functions). Google does not use the data collected to identify the User, nor does it combine that information in a way that would make identification possible. Detailed information on the scope of and rules for data collection in connection with this service can be found at: https://www.google.com/intl/en/policies/privacy/partners.

7PERIOD OF PROCESSING OF PERSONAL DATA

7.1. The period for which the Controller processes data depends on the type of service provided and the purpose of processing. As a rule, data is processed for as long as the service is provided, or until consent is withdrawn or an effective objection to processing is raised in cases where the legal basis for processing is the legitimate interest of the Controller.

7.2. The processing period may be extended where processing is necessary to establish and pursue possible claims or to defend against them, and after that time only in the cases and to the extent required by law. Once the processing period has elapsed, the data is irreversibly deleted or anonymised.

8USER RIGHTS

8.1. Data subjects have the following rights:

8.1.1. The right to information about the processing of personal data – on this basis, the Controller provides the person making such a request with information about the processing of their personal data, including above all the purposes and legal bases for processing, the scope of the data held, the entities to whom the personal data is disclosed and the planned date of its erasure;

8.1.2. The right to obtain a copy of the data – on this basis, the Controller provides a copy of the processed data concerning the person making the request;

8.1.3. The right to rectification – on this basis, the Controller corrects any inaccuracies or errors in the personal data processed, and completes or updates it if it is incomplete or has changed;

8.1.4. The right to erasure – on this basis, a person may request the erasure of data whose processing is no longer necessary for any of the purposes for which it was collected;

8.1.5. The right to restriction of processing – on this basis, the Controller ceases to carry out operations on the personal data, other than operations to which the data subject has consented, and its storage in accordance with the retention rules adopted, or until the reasons for restricting the processing cease to apply (for example a decision of the supervisory authority permitting further processing is issued);

8.1.6. The right to data portability – on this basis, to the extent that the data is processed in connection with a contract concluded or with consent given, the Controller releases the data provided by the person to whom it relates in a machine-readable format. It is also possible to request that this data be sent to another entity – provided, however, that both the Controller and that other entity have the technical means to do so;

8.1.7. The right to object to the processing of data for marketing purposes (where applicable) – the data subject may at any time object to the processing of personal data for marketing purposes, without having to give reasons for the objection;

8.1.8. The right to object to other purposes of processing – the data subject may at any time object to the processing of personal data on the basis of the legitimate interest of the Controller (for example for analytical or statistical purposes, or for reasons connected with the protection of property). An objection of this kind should include a justification and is subject to assessment by the Controller;

8.1.9. The right to withdraw consent – where data is processed on the basis of consent, the data subject has the right to withdraw it at any time, which does not, however, affect the lawfulness of processing carried out before that consent was withdrawn;

8.1.10 The right to lodge a complaint – if a data subject considers that the processing of personal data infringes the GDPR or other data protection legislation, they may lodge a complaint with the President of the Personal Data Protection Office.

8.2. A request concerning the exercise of data subject rights may be submitted:

8.2.1. in writing to: Academos, ul. Sobieskiego 3/3, 31-136 Krakow;

8.2.2. by e-mail to: szkola@academos.krakow.pl

8.3. So far as possible, the request should state precisely what it concerns, in particular:

8.3.1. which right the person making the request wishes to exercise (for example the right to obtain a copy of the data, the right to erasure, etc.);

8.3.2. which processing operation the request concerns (for example use of a particular service, activity on a particular website, receiving a newsletter containing commercial information at a particular e-mail address, etc.);

8.3.3. which purposes of processing the request concerns (for example marketing purposes, analytical purposes, etc.).

8.4. If the Controller is unable to determine the content of the request or to identify the person making it on the basis of the notification received, it will ask the applicant for further information.

8.5. A response to a request will be provided within one month of its receipt. Should it be necessary to extend that period, the Controller will inform the applicant of the reasons for the extension.

8.6. The response will be sent to the e-mail address from which the request was sent; in the case of requests sent by post, by ordinary letter to the address given by the applicant, unless the letter indicates that a reply by e-mail is preferred (in which case an e-mail address should be provided).

9RECIPIENTS OF DATA

9.1. In connection with the provision of services, personal data will be disclosed to external entities, in particular to suppliers responsible for operating IT systems.

9.2. The Controller reserves the right to disclose selected information concerning the User to the competent authorities or to third parties who request such information on an appropriate legal basis and in accordance with the applicable law.

10TRANSFERS OF DATA OUTSIDE THE EEA

10.1. The Controller does not transfer data outside the European Economic Area.

11SECURITY OF PERSONAL DATA

11.1. The Controller carries out ongoing risk analysis in order to ensure that personal data is processed securely – above all so that only authorised persons have access to the data, and only to the extent necessary for the tasks they perform. The Controller makes sure that all operations on personal data are recorded and carried out only by authorised employees and associates.

11.2. The Controller takes all necessary steps to ensure that its subcontractors and other cooperating entities also guarantee appropriate security measures whenever they process personal data on the Controller instructions.

12DATA PROTECTION OFFICER

12.1. The Controller may be contacted on all matters relating to the processing of data through the designated data protection officer at the e-mail address iodo@pack.edu.pl or by post at: PACK, ul. Karmelicka 45, 31-128 Krakow

13CHANGES TO THE PRIVACY POLICY

13.1. The Policy is reviewed on an ongoing basis and updated where necessary.

13.2. Changes to the Policy take effect seven days after they are made available on the website.