Information Clause on the personal data processing at the Wroclaw Medical University with regard to conclusion and execution of contracts

Information Clause on the personal data processing with regard to conclusion and execution of contracts (among others persons representing the contract Parties and persons indicated by the Parties for contact and performance of the contract)

In accordance with the Regulation of the European Parliament and of the Council (EU) 2016/679 of  27 April 2016 (general data protection regulation, hereinafter referred to as GDPR) we would like to inform you that:

  1. The Controller of personal data of persons representing the contract Parties and persons indicated by the Parties for contact and performance of the contract is the Wroclaw Medical University with its regis­tered office at Wybrzeże Pasteura 1, 50-367 Wrocław, hereinafter referred to as the "Controller", represented by the Rector.

  2. The Controller has appointed the Data Protection Officer, whom you can contact in matters relating to the processing of personal data at the following e-mail address: iod@umw.edu.pl

  3. If the Controller has not obtained personal data directly from the persons referred to in para. 1, we inform you that the personal data were obtained from the contract Parties.

  4. Personal data will be processed for the purposes of:
    a) concluding and performing of the contract,
    b) fulfilling of legal obligations of the Controller, including: accounting, reporting and archiving obligations,
    c) possible determination, investigation or defense of claims that the Controller may raise or that may be raised against him.

  5. The legal basis for personal data processing is:
    a) Article 6(1)(b) of the GDPR, i.e. the concluding and performing the contract,
    b) Article 6(1)(c) of the GDPR, i.e. the applicable legislation of the Controller, in particular concerning accounting, reporting and archiving obligations,
    c) Article 6(1)(f) of the GDPR, i.e. the Controller’s legitimate interest in concluding and performing the contract and in establishing, asserting or defending against
    possible claims.

  6. The data processed shall include personal data: name, surname, position or function, place of work, business telephone number, business e-mail address and other data if it is necessary for the proper performance of the contract, e.g. professional qualifications and professional experience.

  7. The Controller may share personal data with other controllers acting under the applicable legislation, e.g. entities providing postal/courier services or institutions co-financing scientific projects. Recipients of the data may also be other entities or authorities in a situation where such an obligation arises from generally applicable laws.

  8. The Controller may entrust another entity, by way of a written agreement, with the processing of your personal data on behalf of the Controller, in particular service providers providing and maintaining IT systems.  

  9. The Controller shall retain personal data for the period necessary for the purposes of the processing, but for no less than the period indicated in the legislation on archiving.

  10. In cases, on the terms and in the manner specified in applicable regulations, the persons referred to in para. 1 above have the right to request: access and correction of their personal data (Articles 15 and 16 of the GDPR), deletion of data (Article 17 of the GDPR), restriction of processing (Article 18 GDPR), object to processing (Article 21 GDPR) and data transfer (Article 20 GDPR).

  11. You have the right to lodge a complaint with a supervisory authority - the President of the Personal Data Protection Office with its registered office at ul. Stawki 2, 00-193 Warszawa - if it is suspected that the processing of personal data by the Controller infringes the provisions of law.

  12. Providing personal data is not mandatory, although necessary for the conclusion and performance of the contract. Refusal to provide data will result in the impossibility to conclude and perform the contract.

  13. Your personal data is not subject to automated decision-making, including "profiling" of data referred to in Article 4(4) GDPR, which means the form of automated processing of personal data, which consists in the use of personal data for the assessment of certain personal factors of a natural person.

  14. Personal data may be transferred to a third country (i.e. outside the territory of the European Union) or an international organization on the terms set out in the law.