Policy on the processing of personal data of the Stefan Batory Foundation (“Data Processing Policy” or “Policy”)
The protection of privacy and the lawful processing of personal data is a top priority for the Stefan Batory Foundation (“Foundation”, “We”). The Foundation takes appropriate measures to ensure that the personal data of individuals with whom we work or whose data we otherwise process is protected. In this Policy we set out how we collect, use, store and otherwise process personal data. The Policy also sets out the rights of those whose data the Foundation processes and the basis on which those rights can be exercised. This Data Processing Policy applies to all cases where the Foundation processes personal data. Please read this document carefully. The Foundation may amend this Policy in response to changes in its operations, as well as the need to adapt its operations to the latest technological security requirements and as the law changes. The Foundation will provide advance notice of changes to this Policy.
The Foundation has developed the Policy by applying the principles arising from the General Data Protection Regulation 679/2016 (“GDPR”).
Who is responsible for processing personal data?
The Stefan Batory Foundation, with its registered office at ul. Sapieżyńska 10a, 00-215 Warsaw, NIP 526-10-46-481, KRS 0000101194, is responsible for the processing of personal data. The Foundation is the controller of personal data within the meaning of Article 4(7) of the GDPRGDPR.
At the same time, within the scope of the Active Citizens – National Fund programme, other entities are responsible, in addition to the Foundation, for the processing of personal data, which together with the Foundation are the so-called joint controllers of personal data. The Foundation has entered into appropriate personal data jointcontrollership agreements with these entities. For more on the processing of personal data in this programme, please see the section below.
For matters relating to the processing of personal data, the Foundation’s Data Protection Officer can be contacted at [email protected].
How does the Foundation protect personal data?
We provide appropriate technical, physical, electronic and administrative safeguards to protect personal data from unauthorised access. We adhere to generally accepted standards to protect the personal information transmitted to us, both during transmission and once received. Unfortunately, the transmission of information over the Internet (including by email) is not completely secure. While we will do our best to protect personal information, we cannot guarantee the security of data sent to us – any transmission is at the sender’s own risk. Once we receive information that constitutes personal data, we will apply appropriate security procedures and policies to prevent unauthorised access to that data.
What rights do individuals have in relation to the processing of their personal data by the Foundation?
Individuals whose personal data is processed by the Foundation have the following rights under the provisions of the DPA:
In order to exercise your rights, you can contact the Foundation directly. Any request for access to data should be made in writing or by email. If there is any doubt about the identity of the person making the request, the Foundation will ask you to complete the request, in particular with the necessary identification data.
The Foundation will endeavour to respond to each request within 1 month. However, in more complex cases or in the event of multiple requests made at the same time, the Foundation may extend the deadline for response and we will inform you of this.
We strive to ensure that the information we process is correct and up-to-date. Therefore, if your data changes, please inform the Foundation so that the data we process can be updated. We will update data that is incorrect or out of date.
This information is for those who have registered for or are participating in the Your Voice campaign, as well as in webinars, trainings or workshops organised as part of the campaign.
I. Processing of personal data of participants and registrants of the Your Voice campaign
If you register your participation in the Your Vote campaign through the campaign website: www.maszglos.pl, the Foundation obtains personal data directly from you. The scope of the personal data that the Foundation obtains from you includes:
In addition, the Foundation asks you to provide information on whether you have taken part in the Your Vote campaign in previous years, as well as information on your motivation for taking part.
If you provide additional personal data (e.g. an additional telephone number) during the registration process or as part of your participation in the action, the Foundation will process this together with the above-mentioned personal data catalogue.
The purpose of the Foundation’s processing of personal data is:
Once you have applied to take part in the Your Vote campaign, the Foundation processes your data in accordance with Article 6(1)(b) of the GDPR (taking action prior to the performance of the contract). Once you are accepted into the action, the Foundation processes your data on the same legal basis (i.e. to perform the contract), but contacts you acting on the basis of its legitimate interest, which is in accordance with Article 6(1)(f) of the GDPR.
II. Processing of data in connection with the implementation of a grant agreement or donation agreement in the framework of the Your Voice campaign
If you enter into a grant or donation agreement with the Foundation as part of the Your Voice campaign, the Foundation processes the following personal data:
The personal data is processed for the purposes of contract performance and grant settlement, i.e. Article 6(1)(b) of the GDPR.
III. Processing of data of registrants of webinars, trainings and workshops organised within the framework of Your Voice action
If you are not a participant in the Your Voice campaign, but wish to participate in webinars, trainings or workshops organised as part of the campaign, the Foundation collects the personal data necessary to register for such an event and to conduct it, such as your name, email address or telephone number. The purpose of the processing of the personal data is to carry out the webinar, training or workshop. The legal basis for the processing of your personal data is Article 6(1)(a) GDPR, i.e. your consent to the processing.
I. Processing of personal data of participants and applicants to the Local Government Workshop
If you apply to participate in the Local Government Workshop project through our website, the Foundation obtains personal data directly from you. The scope of personal data that the Foundation obtains from you includes:
If you provide the Foundation with additional personal data (e.g. an additional telephone number) during the registration process or as part of your participation in the project, the Foundation will process this together with the above-mentioned personal data catalogue.
The purpose of the Foundation’s processing of personal data is:
As soon as you apply to participate in the Local Government Workshop, the Foundation processes your data in accordance with Article 6(1)(b) of the GDPR (taking action prior to the performance of the contract). Once you have been accepted to participate, the Foundation processes your data on the same legal basis (i.e. to perform the contract), but contacts you acting on the basis of its legitimate interest, which is in accordance with Article 6(1)(f) of the GDPR.
For information purposes, the Foundation publishes on its website the names and functions of the people who participate in the Local Government Workshop project. The legal basis for the processing of personal data is: Article 6(1)(b), (c) and (f) of the GDPR.
II. Processing of data of persons registering for webinars, trainings and workshops organised within the framework of the Local Government Workshop
If you are not a participant of the Self-Governance Workshop, but wish to participate in webinars, trainings or workshops organised as part of it, the Foundation collects personal data necessary to register for such an event and to carry out the event, such as your name, email address or telephone number. The purpose of the processing of the personal data is to carry out the webinar, training or workshop. The legal basis for the processing of your personal data is Article 6(1)(a) GDPR, i.e. your consent to its processing.
This information is intended for persons who are representatives of entities applying for support under the Active Citizens – National Fund programme (Applicants) or implementing projects supported under the programme (Grantees), as well as other persons interested in participating in events (seminars, meetings, training courses) organised under the programme.
I. Who is responsible for the processing of personal data under the Active Citizens – National Fund programme?
The Active Citizens programme is a programme run jointly by the Foundation and (1) the Stocznia Foundation with its registered office in Warsaw KRS no. 0000324413 and (2) the Academy of Civic Organisations Foundation with its registered office in Warsaw KRS no. 0000447236, hereinafter jointly referred to as the “Organisers”. The Organisers are the jointcontrollers of the personal data processed within the framework of the Active Citizens – National Fund programme and in this respect have entered into an appropriate agreement for the jointcontrollership of personal data in accordance with Article 26 GDPR.
II. What personal data are collected under this programme, on what legal basis and for what purposes are they processed?
If you apply to the Active Citizens – National Fund programme as a representative of grant applicants (Applicants), registering for events organised by the programme and in particular submitting a grant application via the programme website www.aktywniobywatele.org.pl or implementing projects supported by the programme (Grantees), the Organisers obtain personal data directly from you. The scope of personal data that the Organisers obtain from you includes (this is the broadest possible scope of personal data obtained by the Organisers):
The purpose of the Organisers’ processing of personal data is:
For the purpose of verifying the correctness of the settlement of the Active Citizens – National Fund programme and confirming your participation in it, the Foundation may ask you to send additional information that includes personal data, such as: attendance lists for workshops or events, the fact that you have a contract with the person who conducts the workshop, information about the delegation of your employees to participate in the activities carried out under the programme.
The legal basis for the processing of personal data is: Article 6(1)(b), (c) and (f) of the GDPR.
2. Persons who act as experts assessing applications in the programme Active Citizens – National Fund
If you apply to act as an expert(s) or are an expert(s) of the Active Citizens – National Fund programme, the Organisers will process your personal data for the purposes and to the extent necessary to assess your competence and conclude a contract with you to act as an expert.
The scope of personal data processed includes:
We also publish the data in terms of your names and competences on the Programme website.
The legal basis for the processing of your personal data is Article 6(1)(b) and (c) GDPR, i.e. the performance of the contract and the Organisers’ legal obligations. We also process the data to enable us to contact you as experts of the Foundation, also after the contract has ended. The legal basis for the processing is Article 6(1)(f) GDPR, i.e. our legitimate interest.
More extensive information can be found on the programme website: https://aktywniobywatele.org.pl/en/privacy-policy/
If you apply for support under grant programmes or entrusted funds, either as a representative of grant applicants (Applicants), or implement projects supported under the programme (Grantees), the Foundation obtains personal data directly from you. The scope of personal data they obtain from you includes (this is the broadest possible scope of personal data obtained by the Foundation):
A) In terms of representatives of legal entities (NGOs and institutions) that contract with the Foundation and participate in its implementation:
B) In terms of individuals who enter into a scholarship or donation agreement with the Foundation and participate in its implementation as individuals or as representatives of an informal group:
The purpose of the Foundation’s processing of personal data is:
The legal basis for the processing of personal data is Article 6(1)(b) and (c) of the GDPR, i.e. the performance of a contract and the legal obligations of the Foundation.
When you participate in conferences, debates, workshops, trainings or other meetings organised by the Foundation, the Foundation processes your personal data for the purposes of such an event. The personal data we collect includes:
The legal basis for the processing of personal data is Article 6(1)(b) and (f) GDPR, i.e. the performance of the contract and our legitimate interest.
If you are interested in the Foundation’s activities or wish to support the Foundation’s activities, the Foundation will process your personal data:
1) If you agree to receive ongoing information from the Foundation, in which we will inform you about the Foundation’s activities, opportunities to support the Foundation, planned events and new initiatives
We process your personal data on the basis of Article 6(1)(a) GDPR, i.e. on the basis of your consent to the processing of your personal data. Your Consent may be withdrawn at any time, which does not affect the validity of personal data processing carried out prior to the withdrawal of consent; the scope of personal data processed by the Foundation includes your email address and telephone number.
2) When making a donation to the Foundation or supporting the Foundation in other ways, including by donating 1% of income tax
We process personal data to the extent necessary to handle such a donation and the 1% donation, including its proper accounting and reporting, and to thank you for your support. The legal basis for the processing of personal data is Article 6(1)(f) GDPR, i.e. our legitimate interest.
Can the Foundation transfer personal data to other entities?
As a general rule, the Foundation does not transfer personal data to other entities. However, in certain situations the transfer of personal data may be necessary or essential to achieve the purposes of the processing.
We use the Google Analytics tool for analytical purposes. Google will therefore use the personal data of our site users when they consent to the use of relevant cookies on our site, in accordance with Google’s Privacy Policy and Terms of Service.
The Foundation, running the Active Citizens – National Fund programme in consortium with the Stocznia Foundation and the Academy of Civic Organisations Foundation, is jointly responsible for the processing of personal data under this programme.
The Foundation may also transfer data to entities that help to achieve the Foundation’s objectives or help to carry out its activities. The purpose of the transfer of personal data is to enable the Foundation to fulfil its objectives and to carry out its activities. Most of these entities act as so-called processors (in accordance with Article 28 of the GDPR), but some of them may act as independent controllers of personal data. The entities to whom we may transfer personal data include the following categories:
We may also make personal data available in order to respond to requests made to the Foundation by authorised state and judicial authorities (e.g. prosecutors, courts, police, offices), as well as at the request of entities that co-fund our activities and control our use of funds.
Otherwise, we will not share data with third parties unless we have the consent of the data subjects to do so or we have an appropriate legal basis for doing so.
Does the Foundation process personal data outside the European Economic Area?
Some of our subcontractors (processors) are based outside the European Economic Area. When using their services, we may transfer data outside this area. However, we ensure that the transfer of data outside the EEA always respects the principles of the GDPR and is carried out in accordance with the law.
How long will we process personal data?
We will process personal data for the period necessary to fulfil the purposes referred to above and until we have fulfilled the legal obligations imposed on us. As a general rule, we will process personal data for 6 years after the end of the legal relationship between the Foundation and participants or grantees of programmes and projects run by the Foundation. This period is justified by the applicable limitation period for civil and tax claims in Poland. More detailed information is available in the table below:
| Purpose of processing Processing period | |
| Application, registration and participation in programmes run by the Foundation | 6 years from the date of completion of the programme or 6 years from the date of settlement of the programme grant agreement, whichever is later |
| Implementation of a grant/donation/scholarship agreement | 6 years from the settlement date of the grant/donation/scholarship agreement |
| Implementation of the expert contract | 6 years from the date of termination of the contract |
| Giving your consent to receive information from the Foundation | Until your consent to data processing is withdrawn |
| Participation in events organised by the Foundation, including debates, conferences, webinars, workshops, etc. | Up to 6 years after the end of the workshop, webinar
|
| Making a donation to the Foundation or paying 1% tax | 6 years from the end of the financial year in which the donation was made |
Does the Foundation carry out profiling?
The Foundation does not make any decisions on the basis of automated data processing systems. We also do not carry out profiling.
Links to other websites
The Foundation’s pages may contain links to websites. We endeavour to ensure that the links we include lead to websites with a high standard of personal data protection. However, we are not responsible for the use of personal data, security or content of these websites. Please read the privacy policies of these websites and their terms and conditions, as your use of these websites implies your compliance with the rules set out by their owners.
This version of the privacy policy was published on 25 February 2022.
