Privacy policy

Policy on the processing of personal data of the Stefan Batory Foundation (“Data Processing Policy” or “Policy”)

Introduction

The protection of privacy and the lawful processing of personal data is a top priority for the Stefan Batory Foundation (“Foundation”, “We”). The Foundation takes appropriate measures to ensure that the personal data of individuals with whom we work or whose data we otherwise process is protected. In this Policy we set out how we collect, use, store and otherwise process personal data. The Policy also sets out the rights of those whose data the Foundation processes and the basis on which those rights can be exercised. This Data Processing Policy applies to all cases where the Foundation processes personal data. Please read this document carefully. The Foundation may amend this Policy in response to changes in its operations, as well as the need to adapt its operations to the latest technological security requirements and as the law changes. The Foundation will provide advance notice of changes to this Policy.

The Foundation has developed the Policy by applying the principles arising from the General Data Protection Regulation 679/2016 (“GDPR”).

Who is responsible for processing personal data?

The Stefan Batory Foundation, with its registered office at ul. Sapieżyńska 10a, 00-215 Warsaw, NIP 526-10-46-481, KRS 0000101194, is responsible for the processing of personal data. The Foundation is the controller of personal data within the meaning of Article 4(7) of the GDPRGDPR.

At the same time, within the scope of the Active Citizens – National Fund programme, other entities are responsible, in addition to the Foundation, for the processing of personal data, which together with the Foundation are the so-called joint controllers of personal data. The Foundation has entered into appropriate personal data jointcontrollership agreements with these entities. For more on the processing of personal data in this programme, please see the section below.

For matters relating to the processing of personal data, the Foundation’s Data Protection Officer can be contacted at [email protected].

How does the Foundation protect personal data?

We provide appropriate technical, physical, electronic and administrative safeguards to protect personal data from unauthorised access. We adhere to generally accepted standards to protect the personal information transmitted to us, both during transmission and once received. Unfortunately, the transmission of information over the Internet (including by email) is not completely secure. While we will do our best to protect personal information, we cannot guarantee the security of data sent to us – any transmission is at the sender’s own risk. Once we receive information that constitutes personal data, we will apply appropriate security procedures and policies to prevent unauthorised access to that data.

What rights do individuals have in relation to the processing of their personal data by the Foundation?

Individuals whose personal data is processed by the Foundation have the following rights under the provisions of the DPA:

Every person has the right to receive information regarding the processing of his or her personal data (in particular, information on the purpose for which the data is being processed, by whom it is being processed and to whom it has been disclosed, etc.).
Any data subject has the right to lodge a complaint with the Foundation regarding the processing of data and may lodge a complaint with the Office for the Protection of Personal Data, ul. Stawki 2, Warsaw, (https://uodo.gov.pl/).
Every data subject has the right to receive a copy of the data we process.
Any data subject has the right to request the erasure of personal data (if he or she considers that the Foundation has no right to process it) or to object to its processing.
Any data subject has the right to request the restriction of the processing of personal data.
Every data subject has the right to request the rectification or amendment of personal data.
You have the right to portability of your personal data.

In order to exercise your rights, you can contact the Foundation directly. Any request for access to data should be made in writing or by email. If there is any doubt about the identity of the person making the request, the Foundation will ask you to complete the request, in particular with the necessary identification data.

The Foundation will endeavour to respond to each request within 1 month. However, in more complex cases or in the event of multiple requests made at the same time, the Foundation may extend the deadline for response and we will inform you of this.

We strive to ensure that the information we process is correct and up-to-date. Therefore, if your data changes, please inform the Foundation so that the data we process can be updated. We will update data that is incorrect or out of date.

Information for those who register or participate in the Your Vote campaign

This information is for those who have registered for or are participating in the Your Voice campaign, as well as in webinars, trainings or workshops organised as part of the campaign.

I. Processing of personal data of participants and registrants of the Your Voice campaign

If you register your participation in the Your Vote campaign through the campaign website: www.maszglos.pl, the Foundation obtains personal data directly from you. The scope of the personal data that the Foundation obtains from you includes:

name,
email address,
telephone number,
address with postcode,
the name of the organisation or informal group,
your function in the NGO.

In addition, the Foundation asks you to provide information on whether you have taken part in the Your Vote campaign in previous years, as well as information on your motivation for taking part.

If you provide additional personal data (e.g. an additional telephone number) during the registration process or as part of your participation in the action, the Foundation will process this together with the above-mentioned personal data catalogue.

The purpose of the Foundation’s processing of personal data is:

enabling you to register for the Your Vote campaign,
assessment of your application for admission to the action,
implementation of the Your Vote campaign,
contacting you about the campaign and future editions,
to comply with reporting obligations and other legal obligations imposed on the Foundation.

Once you have applied to take part in the Your Vote campaign, the Foundation processes your data in accordance with Article 6(1)(b) of the GDPR (taking action prior to the performance of the contract). Once you are accepted into the action, the Foundation processes your data on the same legal basis (i.e. to perform the contract), but contacts you acting on the basis of its legitimate interest, which is in accordance with Article 6(1)(f) of the GDPR.

II. Processing of data in connection with the implementation of a grant agreement or donation agreement in the framework of the Your Voice campaign

If you enter into a grant or donation agreement with the Foundation as part of the Your Voice campaign, the Foundation processes the following personal data:

With regard to representatives of legal entities (NGOs and institutions) that enter into a contract with the Foundation and participate in its implementation: name and surname, email address of the person representing the contractual entity, contact person details,
With regard to natural persons who enter into a donation agreement with the Foundation and participate in its implementation by representing an informal group: name and surname, residential address, identity card number and other personal data of the person representing the informal group that will be necessary for the tax and accounting settlement of the donation.

The personal data is processed for the purposes of contract performance and grant settlement, i.e. Article 6(1)(b) of the GDPR.

III. Processing of data of registrants of webinars, trainings and workshops organised within the framework of Your Voice action

If you are not a participant in the Your Voice campaign, but wish to participate in webinars, trainings or workshops organised as part of the campaign, the Foundation collects the personal data necessary to register for such an event and to conduct it, such as your name, email address or telephone number. The purpose of the processing of the personal data is to carry out the webinar, training or workshop. The legal basis for the processing of your personal data is Article 6(1)(a) GDPR, i.e. your consent to the processing.

Information for those who register or participate in the Local Government Workshop project

I. Processing of personal data of participants and applicants to the Local Government Workshop

If you apply to participate in the Local Government Workshop project through our website, the Foundation obtains personal data directly from you. The scope of personal data that the Foundation obtains from you includes:

name,
email address,
telephone number,
address with postcode,
the details of the local authority you represent,
your function in the local authority.

If you provide the Foundation with additional personal data (e.g. an additional telephone number) during the registration process or as part of your participation in the project, the Foundation will process this together with the above-mentioned personal data catalogue.

The purpose of the Foundation’s processing of personal data is:

enabling you to apply for the Self-Government Workshop project
assessment of your application,
implementation of the Local Government Workshop project,
contact you regarding this project and future editions,
to comply with reporting obligations and other legal obligations imposed on the Foundation.

As soon as you apply to participate in the Local Government Workshop, the Foundation processes your data in accordance with Article 6(1)(b) of the GDPR (taking action prior to the performance of the contract). Once you have been accepted to participate, the Foundation processes your data on the same legal basis (i.e. to perform the contract), but contacts you acting on the basis of its legitimate interest, which is in accordance with Article 6(1)(f) of the GDPR.

For information purposes, the Foundation publishes on its website the names and functions of the people who participate in the Local Government Workshop project. The legal basis for the processing of personal data is: Article 6(1)(b), (c) and (f) of the GDPR.

II. Processing of data of persons registering for webinars, trainings and workshops organised within the framework of the Local Government Workshop

If you are not a participant of the Self-Governance Workshop, but wish to participate in webinars, trainings or workshops organised as part of it, the Foundation collects personal data necessary to register for such an event and to carry out the event, such as your name, email address or telephone number. The purpose of the processing of the personal data is to carry out the webinar, training or workshop. The legal basis for the processing of your personal data is Article 6(1)(a) GDPR, i.e. your consent to its processing.

Information for those applying for or implementing projects supported by the Active Citizens – National Fund programme

This information is intended for persons who are representatives of entities applying for support under the Active Citizens – National Fund programme (Applicants) or implementing projects supported under the programme (Grantees), as well as other persons interested in participating in events (seminars, meetings, training courses) organised under the programme.

I. Who is responsible for the processing of personal data under the Active Citizens – National Fund programme?

The Active Citizens programme is a programme run jointly by the Foundation and (1) the Stocznia Foundation with its registered office in Warsaw KRS no. 0000324413 and (2) the Academy of Civic Organisations Foundation with its registered office in Warsaw KRS no. 0000447236, hereinafter jointly referred to as the “Organisers”. The Organisers are the jointcontrollers of the personal data processed within the framework of the Active Citizens – National Fund programme and in this respect have entered into an appropriate agreement for the jointcontrollership of personal data in accordance with Article 26 GDPR.

II. What personal data are collected under this programme, on what legal basis and for what purposes are they processed?

Persons applying for support under the programme and implementing projects supported by the programme and participating in events organised under the programme

If you apply to the Active Citizens – National Fund programme as a representative of grant applicants (Applicants), registering for events organised by the programme and in particular submitting a grant application via the programme website www.aktywniobywatele.org.pl or implementing projects supported by the programme (Grantees), the Organisers obtain personal data directly from you. The scope of personal data that the Organisers obtain from you includes (this is the broadest possible scope of personal data obtained by the Organisers):

name,
telephone number,
the name of the organisation you represent.
address of the organisation/residence, e-mail of the contact person of the applicant/grantee,
Name and function of the persons representing the applicant/grantee,
telephone number, e-mail of the contact person of the applicant’s/grantee’s partner,
image (photo taken during workshops, meetings), special needs or requirements, date and location of the event (applies to people who attend residential events organised as part of the programme).

The purpose of the Organisers’ processing of personal data is:

enabling you to participate in the Active Citizens – National Fund programme
assessment of your application,
implementation of the Active Citizens – National Fund programme, including its accounts,
promotion of the programme and its results,
Contact with you regarding the programme
monitoring, evaluation and accountability of the programme and fulfilment of other legal obligations imposed on the Organisers.

For the purpose of verifying the correctness of the settlement of the Active Citizens – National Fund programme and confirming your participation in it, the Foundation may ask you to send additional information that includes personal data, such as: attendance lists for workshops or events, the fact that you have a contract with the person who conducts the workshop, information about the delegation of your employees to participate in the activities carried out under the programme.

The legal basis for the processing of personal data is: Article 6(1)(b), (c) and (f) of the GDPR.

2. Persons who act as experts assessing applications in the programme Active Citizens – National Fund

If you apply to act as an expert(s) or are an expert(s) of the Active Citizens – National Fund programme, the Organisers will process your personal data for the purposes and to the extent necessary to assess your competence and conclude a contract with you to act as an expert.

The scope of personal data processed includes:

name,
contact details,
residential address,
data for the tax settlement of the contract concluded with the Organisers,
Your experience and expertise.

We also publish the data in terms of your names and competences on the Programme website.

The legal basis for the processing of your personal data is Article 6(1)(b) and (c) GDPR, i.e. the performance of the contract and the Organisers’ legal obligations. We also process the data to enable us to contact you as experts of the Foundation, also after the contract has ended. The legal basis for the processing is Article 6(1)(f) GDPR, i.e. our legitimate interest.

More extensive information can be found on the programme website: https://aktywniobywatele.org.pl/en/privacy-policy/

Information for those applying for support under the Foundation’s grant programmes and so-called Trust Funds

If you apply for support under grant programmes or entrusted funds, either as a representative of grant applicants (Applicants), or implement projects supported under the programme (Grantees), the Foundation obtains personal data directly from you. The scope of personal data they obtain from you includes (this is the broadest possible scope of personal data obtained by the Foundation):

A) In terms of representatives of legal entities (NGOs and institutions) that contract with the Foundation and participate in its implementation:

name and surname, function of persons representing the applicant/grantee, identity card or passport number,
the name and address of the organisation you represent,
name, telephone number and e-mail address of the contact person of the applicant/grantee, identity card or passport number,
other personal data that will be necessary for the performance of the contract and the tax and accounting settlement of the donation.

B) In terms of individuals who enter into a scholarship or donation agreement with the Foundation and participate in its implementation as individuals or as representatives of an informal group:

name,
residential address,
e-mail, telephone
identity card or passport number,
other personal data that will be necessary for the performance of the contract and the tax and accounting settlement of the donation.

The purpose of the Foundation’s processing of personal data is:

enabling you to submit a grant/donation application
assessment of your application,
implementation of the agreement,
contact with you regarding the execution of the contract,
monitoring, evaluation of the implementation of the agreement and fulfilment of other legal obligations imposed on the Organisers.

The legal basis for the processing of personal data is Article 6(1)(b) and (c) of the GDPR, i.e. the performance of a contract and the legal obligations of the Foundation.

Information for those who participate in events organised by the Foundation: debates, conferences, seminars, meetings, workshops and trainings

When you participate in conferences, debates, workshops, trainings or other meetings organised by the Foundation, the Foundation processes your personal data for the purposes of such an event. The personal data we collect includes:

name,
mailing address,
email address,
telephone number,
the name of the institution represented.

The legal basis for the processing of personal data is Article 6(1)(b) and (f) GDPR, i.e. the performance of the contract and our legitimate interest.

Information for those who are interested in the activities of the Foundation, including agreeing to receive current information from the Foundation or other communication from the Foundation, or to make a donation or donate 1% of income tax to the Foundation

If you are interested in the Foundation’s activities or wish to support the Foundation’s activities, the Foundation will process your personal data:

1) If you agree to receive ongoing information from the Foundation, in which we will inform you about the Foundation’s activities, opportunities to support the Foundation, planned events and new initiatives

We process your personal data on the basis of Article 6(1)(a) GDPR, i.e. on the basis of your consent to the processing of your personal data. Your Consent may be withdrawn at any time, which does not affect the validity of personal data processing carried out prior to the withdrawal of consent; the scope of personal data processed by the Foundation includes your email address and telephone number.

2) When making a donation to the Foundation or supporting the Foundation in other ways, including by donating 1% of income tax

We process personal data to the extent necessary to handle such a donation and the 1% donation, including its proper accounting and reporting, and to thank you for your support. The legal basis for the processing of personal data is Article 6(1)(f) GDPR, i.e. our legitimate interest.

Additional information

Can the Foundation transfer personal data to other entities?

As a general rule, the Foundation does not transfer personal data to other entities. However, in certain situations the transfer of personal data may be necessary or essential to achieve the purposes of the processing.

The Foundation, running the Active Citizens – National Fund programme in consortium with the Stocznia Foundation and the Academy of Civic Organisations Foundation, is jointly responsible for the processing of personal data under this programme.

The Foundation may also transfer data to entities that help to achieve the Foundation’s objectives or help to carry out its activities. The purpose of the transfer of personal data is to enable the Foundation to fulfil its objectives and to carry out its activities. Most of these entities act as so-called processors (in accordance with Article 28 of the GDPR), but some of them may act as independent controllers of personal data. The entities to whom we may transfer personal data include the following categories:

Companies providing IT and server maintenance services,
Companies providing IT security services,
Companies providing telecommunications and similar services,
External legal advisers,
Banks,
Insurance companies,
IT companies that provide IT services,
Auditors.

We may also make personal data available in order to respond to requests made to the Foundation by authorised state and judicial authorities (e.g. prosecutors, courts, police, offices), as well as at the request of entities that co-fund our activities and control our use of funds.

Otherwise, we will not share data with third parties unless we have the consent of the data subjects to do so or we have an appropriate legal basis for doing so.

Does the Foundation process personal data outside the European Economic Area?

Some of our subcontractors (processors) are based outside the European Economic Area. When using their services, we may transfer data outside this area. However, we ensure that the transfer of data outside the EEA always respects the principles of the GDPR and is carried out in accordance with the law.

How long will we process personal data?

We will process personal data for the period necessary to fulfil the purposes referred to above and until we have fulfilled the legal obligations imposed on us. As a general rule, we will process personal data for 6 years after the end of the legal relationship between the Foundation and participants or grantees of programmes and projects run by the Foundation. This period is justified by the applicable limitation period for civil and tax claims in Poland. More detailed information is available in the table below:

Purpose of processing Processing period
Application, registration and participation in programmes run by the Foundation	6 years from the date of completion of the programme or 6 years from the date of settlement of the programme grant agreement, whichever is later
Implementation of a grant/donation/scholarship agreement	6 years from the settlement date of the grant/donation/scholarship agreement
Implementation of the expert contract	6 years from the date of termination of the contract
Giving your consent to receive information from the Foundation	Until your consent to data processing is withdrawn
Participation in events organised by the Foundation, including debates, conferences, webinars, workshops, etc.	Up to 6 years after the end of the workshop, webinar
Making a donation to the Foundation or paying 1% tax	6 years from the end of the financial year in which the donation was made

Does the Foundation carry out profiling?

The Foundation does not make any decisions on the basis of automated data processing systems. We also do not carry out profiling.

Links to other websites

The Foundation’s pages may contain links to websites. We endeavour to ensure that the links we include lead to websites with a high standard of personal data protection. However, we are not responsible for the use of personal data, security or content of these websites. Please read the privacy policies of these websites and their terms and conditions, as your use of these websites implies your compliance with the rules set out by their owners.

This version of the privacy policy was published on 25 February 2022.