Data protection policy

The following data protection policy contains the information regarding the purpose, the basis and the principles of personal data processing in the activities of the National Museum in Wrocław.

Who is the administrator of personal data?

The administrator of personal data is the National Museum in Wrocław, pl. Powstańców Warszawy 5, 50-153 Wrocław, NIP: 897-190-01-76 (further on: the Museum).

The source and way of obtaining personal data

Personal data are obtained:

  • due to the statutory activity of the Museum – within the scope defined by the legal regulations,
  • in connection with using the services of the Internet bookshop – in the course of the registration and making orders by the customers of the bookshop and during the transaction itself,
  • in connection with the service of the newsletter informing about the special events organized by the Museum and its new publications,
  • in the course of on-line purchase of tickets to the Museum and its branches – during the registration of an account and the transaction itself,
  • through the automatic gathering of cookies resulting from accessing the Museum websites.

Why and on what basis are personal data processed?

Personal data are processed based on:

  1. legal regulations defining the tasks performed by the Museum in the public interest (Art. 6 ust. 1 lit c and e RODO) – in the course of the statutory activities of the Museum

  2. requirements linked to the execution of contracts (Art. 6 ust. 1 lit b RODO), in order to:

  • supply the on-line service of the Internet bookshop, including the delivery of purchased items, issuance of financial records, performance of customer services including the possible return of the items or handling of complaints, as well as contacts related to the fulfillment of the orders,
  • setting up and managing a user account in the Internet bookshop, including the provision of service for such accounts, the resulting transactions and resolving possible technical problems,
  • receiving customer orders and contacts resulting from their fulfillment,,

  1. requirements necessary to execute a contract (Art. 6 ust. 1 lit b RODO), in order to:

  • provide electronic service related to the on-line sale of tickets to the Museum and its branches, including the completion of purchase, handling payments, issuance of financial records, performance of customer service related to processing possible returns of goods and dealing with complaints, as well as contacts arising from the fulfillment of ticket orders,
  • setting up and managing a user account in the on-line system of ticket sales, ensuring the services for such accounts, conducting transactions, receiving payments and solving technical problems,
  • receiving customer orders and contacts in matters related to fulfillment of ticket orders,

  1. legally justified purpose of the administrator (Art. 6 ust. 1 lit f RODO), in order to:

  • within the scope of visual monitoring – to ensure security for persons and material assets,
  • recognize the preferences of the users, reveal omissions and errors, for the purposes of statistics and direct marketing,
  • in relation to cookies – to adapt the website advertising, including profiling, and for analytical purposes,

  1. based on a user’s permission (Art. 6 ust. 1 lit a RODO), in order to:

  • fulfill orders placed in the Internet bookshop – regarding the facultative data,
  • send commercial and marketing information about the events and exhibition organized by the Museum, and its new publications,

  1. based on a user’s permission (Art. 6 ust. 1 lit a RODO), in order to:

  • use the on-line sales system of tickets to the Museum and its branches – within the scope of facultative data supplied when placing an order or registering an account,
  • to send commercial and marketing information about the events and exhibitions organized by the Museum, and its new publications..

Such a permission may be withdrawn at any moment.

Is the supply of data voluntary? Is the supply of data voluntary?

Users of the services of the Internet bookshop are requested to provide data indispensable to set up and service an account. The supply of such personal data is voluntary yet essential to sign a contract and fulfill the order placed by a user.

Users of the services of the on-line sales of tickets to the Museum and its branches are requested to provide data indispensable to set up and service an account. The supply of such personal data is voluntary yet essential to sign a contract and fulfill the order placed by a user.

The supply of personal data in order to receive the Museum newsletter, gathered in cookie files, is voluntary.

What are cookies and why are they gathered?

Cookies are IT data, in particular text files, which are stored in the appliance with which a user browses through a website. Such data contain information which is automatically obtained during a user’s access to a website, and include the IP address, data of the used search engine, the URL address of the site previously accessed by the user (referrer link), information about the transmission and reports of possible errors.

Cookies are used to adapt the content of a website to the user’s preferences, to create statistics and to analyze the users behaviour, as well as supplementary materials used in server administration. In order to trace the activity and create statistics Google tools are used, including Google Analytics. Data originating from cookies can be also used by such social networks as Facebook, Twitter, Instagram and YouTube, through the links existing on websites which enable sharing the content.

Cookies may be used by advertising networks, especially Google, to display adverts adapted to the way the user utilizes the service. To this end, they may store the information about the user’s navigation path or the length of time of accessing a given website. Detailed information about the scope and the rules of gathering data in relation to this service can be found at: https://www.google.com/intl/pl/policies/privacy/partners.

A user can change the settings regulating the access and storage of cookies using the settings of the search engine or the end appliance with which he/she browses through the content of a website.

Detailed information regarding the policy of cookies is available under “Policy of cookies” ➸

How long will the personal data be processed?

Personal data of the users who set up an account or made purchases in the Internet bookshop will be stored for the duration of the provision of services and fulfillment of orders, and after its termination for the period of time required by the legal regulations (such as accounting law) or until the expiry of the deadline for making any possible claims or registering a legitimate protest against data processing.

Personal data of a user stored in cookies and for marketing purposes will be processed until the point of registering a legitimate protest or the withdrawal of the permission for such processing.

Recipients of personal data

Personal data of users are passed on to the providers of services to the administrator such as IT services, hosting and marketing services, where the transfer of data is made only within the scope and purpose defined by the administrator on the basis of a valid contract for the provision of personal data processing.

Data may be also accessed by the subjects legitimately entitled to obtaining data enforced by the current laws.

The right of persons whose data are processed

Users whose personal data are processed by the administrator have the right to:

  • withdraw their consent for data processing – at any time, without giving any reason;
  • access the personal data – the right to obtain specific information about personal data processing, as well as copies of the data,
  • demand to alter personal data– the right to request correcting or altering expired data,
  • demand the cancellation of personal data – the so-called right to forget, in the situation where the processing of data is no longer legally justified by law,
  • demand limited processing of personal data – the right to request limited processing for the purposes of storage or other operations with the use of data, until the legitimate reasons are established,
  • protest against the processing – in view of a particular situation of a person whose data are being processed, or if data are processed for marketing purposes,
  • transfer of personal data – the right to obtain the records of data in a structured format, in the scope in which the data are processed in lieu with the binding contract or the permission granted.

A user has also the right of complaint against the processing of personal data to the relevant supervisory body, i.e. Chair of the Office for the Protection of Personal Data.

Monitoring

To ensure the safety of the Museum staff and customers the entire area of the Museum and its branches is subject to monitoring. Visual monitoring data containing personal data are gathered on the basis of the justified interest of the administrator (provision of personal and material security) and for these purposes are transferred to the legal bodies in charge of security. These records are stored for a period of up to 30 days.

Whom to contact in matters related to personal data?

In all matters relating to the principles of personal data processing within the scope of the Museum’s activities and in order to execute the rights of the persons the data refer to, one should contact the appointed Inspectors for Data Protection: Dominika Jeżewska, e-mail: iodo@mnwr.pl.

 

print