Personal data processing notice
Personal data processing notice
ERASMUS+ programme (and other academic exchange programmes)
This information defines the rules for data processing connected with ERASMUS+ programme as well as other academic exchange programmes (hereinafter referred to as the “Programme”).
The personal data controller is the Krzysztof Penderecki Academy of Music in Krakow, with its registered office at ul. Św. Tomasza 43, 31-027 Kraków. Contact with the Controller: Data Protection Supervisor: e-mail address: iodo@amuz.krakow.pl.
Purpose of the processing of and legal basis for processing
Your personal data will be processed for:
- recruitment purposes, connected with the participation in the Programme and performance of the contract on the participation in the Programme (legal basis: Art. 6 (1)(b) in connection with f GDPR),
- realization of the general conditions and rules of the Programme, including agreements with partner institutions, including managing the student exchange, preparing relevant recruitment and financial documents, agreements, organizing the stay in the partner institution (legal basis: Art. 6 (1)(c) in connection with f GDPR, in connection with general conditions and rules of the Programme and agreements with partner institutions),
- fulfilling the obligations arising from the financing and accounting provisions of the Programme and audit and reporting requirements, in particular towards the authorities managing the Programme (legal basis: Art. 6(1)(c) GDPR),
- fulfilling the obligations arising from the provisions of law on higher education in connection with the provisions on archiving documents (legal basis: Art. 6(1)(c) GDPR),
- monitoring and evaluation of the Programme, including the preparation of relevant reports and statistics, the claim assertion or defence of any possible claims related to the agreement on participation in the Programme or the general terms and conditions of the Programme (legal basis: Art. 6(1)(f) GDPR),
- fulfilling the purpose of a separately expressed consent, including the consent for publication of information and photographs taken in the course of the Programme for the purpose of its promotion (legal basis: Art. 6(1)(a) GDPR),
If the consent is given, the provision of data is voluntary – failure to provide data has no adverse legal consequences. In other cases, the provision of data is necessary, and failure to provide data may make it impossible to participate in the Programme. Data is not subject to automated processing for decision-making purposes.
Personal data storage period
Personal data will be processed for the period of fulfilling the above purposes, and for 5 years afterwards, or other storage period indicated in the general conditions and rules of the Programme, as well as in accordance with the period indicated in the rules regulating the Programme. If the basis for the processing of personal data is consent, the data will be processed until its withdrawal or until the objective for which it was obtained ends. In addition, data is processed until statute of limitation on claims relating to a Programme expires, which does not apply if the data may constitute or constitute evidence in legal or administrative proceedings – then until the final termination of proceedings.
Data recipients
Personal data are transferred to entities supporting the Administrator in the fulfilment of the aforementioned purposes, including in particular IT and postal service providers and service providers, as well as to partner institutions, the National Agency of the Erasmus+ Programme, institutions financing the Programme as well as other institutions involved in the implementation of the Programme. In other cases data may be communicated to authorised state authorities.
Rights related to the processing of personal data
You have the following rights in connection with the processing of your personal data:
a. the right to withdraw the consent to data processing, which, however, does not affect the period before its withdrawal,
b. the right to access, to request rectification, to erasure, to transmission or to restrict the processing of the personal data,
c. right to object,
– all these according to the GDPR. In order to perform the aforementioned rights, please contact the Controller.
d. right to lodge a complaint with the supervisory body dealing with the protection of personal data in your country or in Poland, i.e. with the President of the Office for Personal Data Protection with its registered office in Warsaw at Stawki 2 street.