GDPR

General information clause on personal data protection

Pursuant to Article 13 (1) and (2) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ. L 2016, No. 119, p. 1), we would like to inform you about the principles of processing personal data provided by you (information obligation):

Zamek Królewski na Wawelu – Państwowe Zbiory Sztuki with its registered office in Kraków at Wawel 5, 31-001 Kraków („Wawel”) is the controller of your personal data.
Wawel designated Data Protection Officer who can be contacted via electronic mail at iod@wawelzamek.pl or directly at the registered office of the data controller.
Wawel processes personal data based on Article 6(1)(a), (b) or (c) of General Data Protection Regulation.
Your personal data will be processed:
a) in order to comply with legal obligations to which the Wawel is subject (Article 6(1)(c) of General Data Protection Regulation),
b) in order to perform contracts concluded with the Wawel (Article 6(1)(b) of General Data Protection Regulation),
c) based on your consent to the processing of your personal data in the scope and for the purposes specified in the consent (Article 6(1)(a) of General Data Protection Regulation).
If the processing of your personal data is based on your consent, you provide the personal data voluntarily.
If the processing of your personal data results from the generally applicable laws or a duly concluded contract, the provision of personal data is necessary to perform the obligations arising from such laws or contracts.
If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. Doing so does not affect the lawfulness of processing based on your consent prior to its withdrawal.
Your personal data will be processed from the moment they have been collected as long as it is necessary to achieve the purposes indicated in point 4, and after this period also for the period and within the scope required by the generally applicable laws.
The recipients of your personal data may only be entities authorised to collect personal data based on the generally applicable laws.
Your personal data may be transferred for processing to third party companies or individuals commissioned to provide services. Such third parties process data based on personal data transfer contracts, and are also obliged to keep the data being processed confidential.
In connection with our processing of your personal data, you have the right to: access your personal data, correct your personal data, limit the processing of your personal data, and if it is possible under the General Data Protection Regulation, also to transfer them to another organisation, to object to us processing your data and to request that they should be erased.
You have the right to lodge a complaint with the President of the Office of Personal Data Protection if the General Data Protection Regulation is violated.
Your data will be profiled and any data transfer to third countries will be subject to a separate consent (if applicable).