Privacy Policy

Sample information clause

INFORMATION CLAUSE (SPECIMEN)

According to the General Data Protection Regulation of 27 April 2016, hereinafter referred to as GDPR, we would like to inform you that:

  1. Your personal data controller is the University of Gdańsk with its seat in (80-309) Gdańsk at ul. Jana Bażyńskiego 8.
  2. The controller has appointed a Data Protection Officer who may be contacted by phone at (58) 523 31 30 or by e-mail at: iod@ug.edu.pl . The Data Protection Officer may be contacted in all matters regarding the processing of personal data and exercising the rights connected with the processing.
  3. The University of Gdańsk will be processing the following personal data …………………
    [specific data e.g. name, surname, address etc. should be indicated]
  4. Your personal data will be processed for the purposes of ……………………………………………………………………………………………..
    [purpose of data processing should be specified, e.g. admissions to study, organisation and management of a conference/competition, granting and provision of social benefits from the Company Social Benefits Fund, management of authorisation to enter UG grounds etc.]
  1. The legal basis for the processing of your personal data is ……………………………………………………………………………
    [legal prerequisite should be indicated, legalising the processing of personal data, as set out in Article 6 of the GDPR, e.g. Article 6 section 1 letter c of the GDPR – processing is necessary for compliance with a legal obligation to which the controller is subject, resulting in particular from the Act ……….]
  2.  Providing your personal data is…………………………….………………………………
    [it should be specified whether the provision of personal data is a statutory or contractual requirement, or a condition for the conclusion of a contract; whether the data subject is obliged to provide the data and the possible consequences of failing to do so]
  1. Your personal data will be processed on behalf of the data controller by authorised personnel solely for the purposes referred to in section 4.
  1. Your personal data will be stored for the period of ..……………………………………………….………………….………………………….
    [period over which personal data will be stored should be specified, and should this be impossible ─ criteria for establishing the period]
  1. Your personal data will not be disclosed to third parties with the exception of cases laid down by law / will be disclosed to the following third parties: ………………………………………………………………..……………………………………………………………………………………………………
    [third parties to whom data will be disclosed should be indicated]
  2. Under the terms of the GDPR you have the right to:
    1. access your data,
    2. rectify your data, should it be inaccurate,
    3. erase your data, restrict the processing of it as well as the right to data portability – in cases laid down by law,
    4. object to the processing of your data,
    5. lodge a complaint with a supervisory authority – President of the Personal Data Protection Office, should you consider that the processing of your data infringes the personal data protection regulations.

Moreover, where appropriate, the information clause should additionally contain the following information: 

  1. when processing is based on consent – information on the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before the withdrawal,
  2. information on the intention to disclose personal data to a third country or international organisation,
  3. information on automated decision-making, including profiling, and vital information on the rules for taking the decisions as well as on the importance and possible consequences of such processing for the data subject.