GDPR

INFORMATION CLAUSE REGARDING THE PROCESSING OF PERSONAL DATA

Pursuant to Articles 13 section 1 and 2 art. 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – hereinafter referred to as "GDPR") (OJ EU L 119, 2016, p. 1, as amended), we hereby inform you that:

1. The controller of your personal data, i.e. the entity deciding on the purposes and methods of processing your data, is the Institute of Human Genetics, Polish Academy of Sciences, ul. Strzeszyńska 32, 60-479 Poznań, hereinafter referred to as the “Controller.”
2. Who is the Data Protection Officer (DPO)?
   The Data Protection Officer is the person you can contact if you have any questions or concerns regarding the scope of data processing by the Controller. This role is performed by: Rafał Andrzejewski. You can contact him by email: iod.r.andrzejewski@szkoleniaprawnicze.com.pl.
3. We process your data for the following purposes and on the following legal bases:
   a) To conduct research in the fields of human genetics and medical biology, to carry out development work, and to implement research results into the economy – pursuant to Article 6 section 1 point c and e GDPR in connection with the Act of 30 April 2010 on the Polish Academy of Sciences and Resolution No. 17/02 of the Presidium of the Polish Academy of Sciences of 17 December 2002 on the establishment of the Institute of Human Genetics of the Polish Academy of Sciences, as well as other legal acts)
   b) For archiving purposes (evidentiary purposes) – based on Article 6 section 1 point c GDPR in connection with Articles 7 section 1 and 3 GDPR and Article 9 section 2 and j GDPR;
   c) To comply with legal obligations imposed on the Controller (Article 6 section 1 point c GDPR), e.g. for accounting and tax purposes, or archiving;
   d) For the establishment, exercise, or defense of legal claims, which constitutes our legitimate interest under Article 6 section 1 point f GDPR;
   e) For technical purposes, website functionality, and communication, which is our legitimate interest under Article 6 section 1 point f GDPR.
4. Recipients of personal data:
   Your data may be shared with entities with whom we have concluded a data processing agreement under Article 28 GDPR. In particular, this may include providers of technological solutions (e.g. IT service providers) or organizational support (e.g. security companies). If you wish to receive more detailed information about the scope of services provided by these processors, you can always contact the Controller.
5. Your personal data will not be transferred to a third country.
6. Data retention period – how long will we process your personal data?
   We will process your data only for as long as necessary.
   1) For data processed by the Controller on the basis of Article 6(1)(c) and (e) GDPR and Article 9(2)(j) GDPR – for the period necessary as required by law, e.g. for accounting or tax purposes. Under current regulations, this period is 5 years counted from the end of the calendar year in which the tax obligation arose;
   2) After the original purpose for which your data was collected has been fulfilled (e.g. completion of a scientific project), your data will be processed for archiving purposes for a period compliant with the archiving regulations in force at our institution, as well as for the period necessary to protect against or pursue legal claims (i.e. until the expiry of the statute of limitations).
7. You have the following rights related to the processing of your personal data:
   a) Under Article 15 of the GDPR – the right to access your personal data, including the right to obtain a copy of the data;
   b) Under Article 16 of the GDPR – the right to request rectification (correction) of your personal data;
   c) The right to erasure of data – applicable under the conditions specified in Article 17 of the GDPR,
   d) The right to restrict processing – applicable under the conditions specified in Article 18 of the GDPR,
   e) The right to data portability – applicable under the conditions specified in Article 20 of the GDPR,
   f) The right to object to processing – applicable under the conditions specified in Article 21 of the GDPR,
   g) The right to lodge a complaint with the supervisory authority (President of the Personal Data Protection Office).
8. Obligation to provide data
   For data processed by the Controller under Article 6 sec. 1 point c and e of the GDPR, providing your personal data is mandatory. Failure to provide such data may prevent the Institute from achieving its objectives, such as conducting scientific research or implementing a research project.
9. Your data will not be subject to profiling, nor will any automated decision-making take place.