Privacy Policy of the University of Wrocław

This Privacy Policy sets out the rules governing the processing of personal data collected via the website https://uwr.edu.pl/ and all its subdomains. The University of Wrocław (hereinafter: UWr) takes particular care to respect users’ privacy by acting in accordance with the GDPR. This document sets out how UWr processes personal data and the rights of data subjects.

1. The data controller is the University of Wrocław, pl. Uniwersytecki 1, 50-137 Wrocław, NIP: 8960005408, REGON: 000001301. The Data Protection Officer can be contacted by email: iod@uwr.edu.pl or by telephone: +48 71 375 26 04.
2. The University of Wrocław collects and processes users’ personal data for the following purposes:
   1. Contact forms – first name, surname, email address and telephone number are collected in order to facilitate contact and respond to enquiries submitted (legal basis: Article 6(1)(f) of the GDPR – necessity for the performance of a service).
   2. Newsletter subscriptions – we collect your first name, surname and email address in order to send you regular information and updates about the University of Wrocław (legal basis: Article 6(1)(a) of the GDPR – consent of the data subject).
   3. University admissions – personal data required by legislation on higher education and admissions regulations is processed, such as first name, surname, address, PESEL number, date of birth, information regarding education and other data necessary to carry out the admissions process (legal basis: Article 6(1)(c) of the GDPR – compliance with a legal obligation).
   4. Hotel services – first name, surname and contact details are collected for the purpose of making bookings and providing hotel services (legal basis: Article 6(1)(b) of the GDPR – performance of a contract).
   5. Job vacancies – personal data of candidates applying for positions, such as first name, surname, contact details, information on education and professional experience, solely for the purpose of conducting the recruitment process (legal basis: Article 6(1)(a) of the GDPR – the candidate’s consent to the extent that it goes beyond a legal obligation, and Article 6(1)(c) and (f) of the GDPR – a legal obligation and the controller’s legitimate interest).
   6. Statistical and analytical purposes – data on user activity on the website is collected to analyse website traffic, improve the quality of services and tailor content to users’ preferences (legal basis: Article 6(1)(f) of the GDPR – the controller’s legitimate interest).
   7. Ensuring security – technical data such as IP address, browser type, time of access and information about users’ activities within the systems are collected to protect the website against misuse and to maintain the integrity of the IT infrastructure (legal basis: Article 6(1)(f) of the GDPR – the controller’s legitimate interest).
3. The University of Wrocław may disclose users’ personal data solely to service providers who assist the University in fulfilling its obligations relating to the provision of IT services (e.g. technical support). Data hosting is carried out directly by the University of Wrocław. As the University of Wrocław uses popular social media platforms such as Facebook, Instagram and YouTube, users’ data may be transferred outside the European Economic Area (EEA), mainly to the United States and other third countries. In such cases, the University of Wrocław applies safeguards in accordance with the requirements of the GDPR, in particular the standard contractual clauses approved by the European Commission, which ensure an adequate level of protection for personal data. Detailed information on the security measures applied when transferring data outside the EEA can be obtained by contacting the Data Protection Officer: iod@uwr.edu.pl.
4. The University of Wrocław retains the personal data of website users for the period necessary to fulfil the purpose for which it was collected:
   1. Data processed on the basis of consent – retained until consent is withdrawn or the provision of the service ceases.
   2. Data relating to the performance of a contract or the provision of services – retained for the duration of the service provision and its settlement, and for the limitation period of any potential claims.
   3. Data relating to recruitment processes – retained until the end of the relevant recruitment process or for longer if the candidate consents to participating in future recruitment rounds.
   4. Technical and analytical data – retained for no longer than is necessary for the purposes for which they were collected, after which they are deleted or anonymised.
5. Every data subject has the following rights under the provisions of the GDPR:
   1. Right of access to data – the right to obtain information about the user’s data processed by the University of Wrocław and to receive a copy thereof.
   2. Right to rectification – the data subject may request that their data be corrected or supplemented if it is incorrect or incomplete.
   3. Right to erasure (‘right to be forgotten’) – the data subject may request the erasure of their personal data, provided there are no grounds for its further processing.
   4. The right to restrict processing – the user may request a temporary or permanent restriction on the processing of their personal data.
   5. The right to data portability – the user may receive their data in a commonly used, machine-readable format and transfer it to another data controller where processing is based on consent or a contract.
   6. Right to object to data processing – the user may object to the processing of data based on the controller’s legitimate interests.
   7. Right to lodge a complaint – the user has the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO) if they consider that the processing of data infringes the law.
6. The website uses session and persistent cookies, both first-party and third-party (Google Analytics, Facebook, Instagram, YouTube), for functional, statistical, marketing and analytical purposes. You may withdraw your consent to cookies in your browser settings. Detailed privacy policies of the service providers are available on the Google, Facebook, Instagram and YouTube websites. UWr reserves the right to state that disabling cookies necessary for authentication, security and the retention of user preferences may hinder, and in extreme cases prevent, the use of the website. Users may choose whether or not to accept cookies in their browser settings.
7. When using the website, the University of Wrocław automatically collects technical data relating to user activity, including the device’s IP address, browser type, operating system used, date and time of access, and information about the pages and subpages visited on the website. This data is used for the following purposes:
   1. to ensure the proper functioning and security of the website, including protection against cyber-attacks and misuse;
   2. to administer the website and diagnose any technical issues;
   3. to carry out anonymous statistical analyses and tailor content to users’ preferences.
      
      The legal basis for the processing of the above data is the controller’s legitimate interest (Article 6(1)(f) of the GDPR), which consists in ensuring security, technical efficiency and the optimisation of the services provided. This data is stored for a maximum period of 12 months, after which it is deleted or permanently anonymised.
8. The UWr website may contain links to external websites managed by other entities. UWr does not control nor is it responsible for the data protection practices of these websites. We therefore recommend that users familiarise themselves with the privacy policy and data processing rules applicable to these websites each time before using them or providing their personal data to them.
9. UWr reserves the right to update this Privacy Policy in order to bring it into line with changes in legislation or in the way the website operates.

Information regarding any changes to the Policy will be published on the University of Wrocław’s website, together with the date on which the changes come into effect. In the event of significant changes concerning the processing of personal data, users will also be notified electronically (e.g. by email) at least 30 days in advance, so that they have the opportunity to familiarise themselves with the changes.