Museum open at 12:00pm
Cinema is closed now
Museum open at 12:00pm
Cinema is closed now
Information Clause
on the processing of personal data of counterparties, persons authorised to represent counterparties, contact persons of counterparties and artists
Pursuant to the obligation under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (GDPR), we inform you that:
1. The controller of your personal data is the Museum of Modern Art in Warsaw, address: ul. Pańska 3, 00-124 Warsaw, entered in
the register of cultural institutions of the Capital City of Warsaw under No. RIK/1/2023, National Business Register Number [REGON]: 140187435, NIP (Tax Identification Number): 525-234-18-32 (hereinafter also ‘Controller’ or ‘Museum’). In matters relating to personal data protection, you can contact the Museum:
a) by post: to the address of the Museum's registered office,
b) by e-mail: iod@artMuseum.pl.
2. The Data Controller has appointed a Data Protection Officer who can be contacted by email at:iod@artmuseum.pl.
3. Personal data is processed:
a) in the case of the Museum's counterparties, including persons who hold the rights to dispose of the work or works - in order
to establish and perform the agreement to which they are a party; in this case, the basis for the processing of personal data is Article 6(1)(b) of the GDPR,
b) in the case of employees, collaborators of the Museum's counterparty and persons authorised to represent the Museum's counterparty, including counterparties holding the rights to dispose of the work or works - for the purpose of concluding and/or performing an agreement; in this case, the basis for the processing of personal data is Article 6(1)(f) of the GDPR, while
the conclusion and performance of the agreement constitutes the legitimate interest of the Museum as the Data Controller,
c) in the case of creators of a work which is the subject of an agreement, in order to exercise the creator's right to label the work; in this case, the basis for data processing is Article 6(1)(f) of the GDPR, while the obligation to label the work constitutes
a legitimate interest of the Museum as the Data Controller.
4. Personal data may also be processed on the basis of:
a) Article 6(1)(f) of the GDPR, i.e. where processing is necessary for the purposes of the legitimate interests pursued by
the controller or by a third party, such as the establishment, exercise, or defence of claims in connection with the conclusion
and performance of a contract concluded by the Museum with a contractor or a person holding the rights to dispose of a work or works;
b) Article 6(1)(c) of the GDPR, i.e. where processing is necessary for compliance with a legal obligation to which the controller is subject, including in respect of archiving obligations concerning the retention of documents for tax purposes, and archiving documentation related to the conclusion and performance of the contract pursuant to the provisions on the national archival asset and archives;
c) Article 6(1)(a) of the GDPR, if you have given your consent to the processing of specific categories of personal data for a specific purpose; this may concern, in particular, the processing of personal data in the form of an image in connection with documenting an event through photographs and/or video or audio-video recordings.
5. The Museum processes ordinary data including, in particular:
a) in the case of natural persons, with whom it concludes an agreement: name, surname, residential address, PESEL, and in the case of self-employed persons: company name, business address, NIP, REGON, contact details (including e-mail address, telephone number),
b) in the case of employees, associates of the Museum's counterparty and persons authorised to represent the Museum's counterparty, including counterparties holding the rights to dispose of the work or works: name, surname, official position, data concerning the employer/counterparty, official contact details (e-mail address, telephone number),
c) in the case of authors, first and last name, nickname.
6. The Museum obtains personal data directly from the data subjects as a matter of principle. In the case of employees and associates
of counterparties, including those with rights to dispose of the work(s) and creators of the works (if they are not a party to the agreement) - personal data is obtained from the counterparty. Some personal data may also be obtained from public sources (publicly available registers such as CEIDG, KRS).
7. The provision of personal data is voluntary but necessary for the conclusion and performance of the agreement concluded between the Museum and the counterparty, and in the case of creators, for the marking of the work. The consequence of not providing data may be the inability to conclude and perform the agreement, and in the case of refusal to provide data by the creator – the work will be made available anonymously. Where personal data is processed on the basis of consent, as a general rule, no consequences are foreseen for failure to provide such data.
8. The recipients of your personal data may include: providers of email hosting services and other IT service providers, contractors of
the Museum to whom it has outsourced the performance of all or part of the services in connection with the execution of the specific-task contract, entities providing accounting, auditing, or advisory services, including legal and tax advisory, as well as the Head of
the National Revenue Administration in connection with the issuance of structured invoices within the National System of e-Invoices (KSeF). Your personal data may also be disclosed under the access to public information procedure (if the terms and conditions of
the agreement can constitute public information within the meaning of the regulations on access to public information), and in addition, the personal data of counterparties who are natural persons may be disclosed to an unlimited circle of addressees via the Internet through the Central Register of Agreements of the Capital City of Warsaw. In connection with the potential publication of information concerning a person or their image, the recipients thereof may also include social networking service providers where the Museum maintains its social media profiles (Facebook, Instagram, LinkedIn, X), visitors to the websites where the prepared materials will be available, including the Museum’s website and social media channels operated by the Museum, as well as recipients of other materials.
9. Your personal data will be processed by the Museum for the duration of the contract and may also be processed subsequently, i.e.
for the period necessary for the establishment, exercise, or defence of legal claims in accordance with the applicable provisions of law (i.e. 3 years), or in connection with the necessity to comply with legal obligations incumbent on the Museum as the data controller, in particular the archiving obligation concerning documents stored for tax and accounting purposes (i.e. for a period of 5 years from
the end of the year in which the tax was paid), whichever period is longer. Separate regulations may also provide for a longer period of document storage, including personal data, for selected categories of cases. This may concern, in particular, documentation
of archival value, where data may be stored for a longer period in the public interest in accordance with the provisions on archiving. This processing is carried out in accordance with the document classification system applicable at the Museum, i.e. as a general rule, for a period of 25 years, and in strictly defined cases, perpetually.
10. You have the right to: request access to the personal data you have provided, rectify your personal data, request the erasure of your personal data, and restrict the processing of your personal data.
11. If your data are processed on the basis of points 3(a) or 4(c) above, you also have the right to portability of your personal data, provided that the processing is carried out by automated means.
12. If your personal data is processed on the basis of points 3(b) and (c) or 4(a) above, you also have the right to object to the processing of your personal data on the grounds of your particular situation.
13. If your data is processed on the basis of point 4(c) above, you also have the right to withdraw your consent at any time, without affecting the lawfulness of the processing carried out prior to the withdrawal.
14. In addition, you have the right to lodge a complaint with the competent supervisory authority, which in Poland is the President of
the Office for Personal Data Protection.
15. No decisions in respect of the provided personal data will be taken by automated means, including profiling.
16. In the case of publication of materials containing information concerning a person or their image on social networking services (Facebook, Instagram, LinkedIn, X), personal data may be transferred to the USA. This takes place on the basis of the European Commission’s adequacy decision (the EU-US Data Privacy Framework).
1. The controller of your personal data is the Museum of Modern Art in Warsaw, address: ul. Pańska 3, 00-124 Warsaw, entered in
the register of cultural institutions of the Capital City of Warsaw under No. RIK/1/2023, National Business Register Number [REGON]: 140187435, NIP (Tax Identification Number): 525-234-18-32 (hereinafter also ‘Controller’ or ‘Museum’). In matters relating to personal data protection, you can contact the Museum:
a) by post: to the address of the Museum's registered office,
b) by e-mail: iod@artMuseum.pl.
2. The Data Controller has appointed a Data Protection Officer who can be contacted by email at:iod@artmuseum.pl.
3. Personal data is processed:
a) in the case of the Museum's counterparties, including persons who hold the rights to dispose of the work or works - in order
to establish and perform the agreement to which they are a party; in this case, the basis for the processing of personal data is Article 6(1)(b) of the GDPR,
b) in the case of employees, collaborators of the Museum's counterparty and persons authorised to represent the Museum's counterparty, including counterparties holding the rights to dispose of the work or works - for the purpose of concluding and/or performing an agreement; in this case, the basis for the processing of personal data is Article 6(1)(f) of the GDPR, while
the conclusion and performance of the agreement constitutes the legitimate interest of the Museum as the Data Controller,
c) in the case of creators of a work which is the subject of an agreement, in order to exercise the creator's right to label the work; in this case, the basis for data processing is Article 6(1)(f) of the GDPR, while the obligation to label the work constitutes
a legitimate interest of the Museum as the Data Controller.
4. Personal data may also be processed on the basis of:
a) Article 6(1)(f) of the GDPR, i.e. where processing is necessary for the purposes of the legitimate interests pursued by
the controller or by a third party, such as the establishment, exercise, or defence of claims in connection with the conclusion
and performance of a contract concluded by the Museum with a contractor or a person holding the rights to dispose of a work or works;
b) Article 6(1)(c) of the GDPR, i.e. where processing is necessary for compliance with a legal obligation to which the controller is subject, including in respect of archiving obligations concerning the retention of documents for tax purposes, and archiving documentation related to the conclusion and performance of the contract pursuant to the provisions on the national archival asset and archives;
c) Article 6(1)(a) of the GDPR, if you have given your consent to the processing of specific categories of personal data for a specific purpose; this may concern, in particular, the processing of personal data in the form of an image in connection with documenting an event through photographs and/or video or audio-video recordings.
5. The Museum processes ordinary data including, in particular:
a) in the case of natural persons, with whom it concludes an agreement: name, surname, residential address, PESEL, and in the case of self-employed persons: company name, business address, NIP, REGON, contact details (including e-mail address, telephone number),
b) in the case of employees, associates of the Museum's counterparty and persons authorised to represent the Museum's counterparty, including counterparties holding the rights to dispose of the work or works: name, surname, official position, data concerning the employer/counterparty, official contact details (e-mail address, telephone number),
c) in the case of authors, first and last name, nickname.
6. The Museum obtains personal data directly from the data subjects as a matter of principle. In the case of employees and associates
of counterparties, including those with rights to dispose of the work(s) and creators of the works (if they are not a party to the agreement) - personal data is obtained from the counterparty. Some personal data may also be obtained from public sources (publicly available registers such as CEIDG, KRS).
7. The provision of personal data is voluntary but necessary for the conclusion and performance of the agreement concluded between the Museum and the counterparty, and in the case of creators, for the marking of the work. The consequence of not providing data may be the inability to conclude and perform the agreement, and in the case of refusal to provide data by the creator – the work will be made available anonymously. Where personal data is processed on the basis of consent, as a general rule, no consequences are foreseen for failure to provide such data.
8. The recipients of your personal data may include: providers of email hosting services and other IT service providers, contractors of
the Museum to whom it has outsourced the performance of all or part of the services in connection with the execution of the specific-task contract, entities providing accounting, auditing, or advisory services, including legal and tax advisory, as well as the Head of
the National Revenue Administration in connection with the issuance of structured invoices within the National System of e-Invoices (KSeF). Your personal data may also be disclosed under the access to public information procedure (if the terms and conditions of
the agreement can constitute public information within the meaning of the regulations on access to public information), and in addition, the personal data of counterparties who are natural persons may be disclosed to an unlimited circle of addressees via the Internet through the Central Register of Agreements of the Capital City of Warsaw. In connection with the potential publication of information concerning a person or their image, the recipients thereof may also include social networking service providers where the Museum maintains its social media profiles (Facebook, Instagram, LinkedIn, X), visitors to the websites where the prepared materials will be available, including the Museum’s website and social media channels operated by the Museum, as well as recipients of other materials.
9. Your personal data will be processed by the Museum for the duration of the contract and may also be processed subsequently, i.e.
for the period necessary for the establishment, exercise, or defence of legal claims in accordance with the applicable provisions of law (i.e. 3 years), or in connection with the necessity to comply with legal obligations incumbent on the Museum as the data controller, in particular the archiving obligation concerning documents stored for tax and accounting purposes (i.e. for a period of 5 years from
the end of the year in which the tax was paid), whichever period is longer. Separate regulations may also provide for a longer period of document storage, including personal data, for selected categories of cases. This may concern, in particular, documentation
of archival value, where data may be stored for a longer period in the public interest in accordance with the provisions on archiving. This processing is carried out in accordance with the document classification system applicable at the Museum, i.e. as a general rule, for a period of 25 years, and in strictly defined cases, perpetually.
10. You have the right to: request access to the personal data you have provided, rectify your personal data, request the erasure of your personal data, and restrict the processing of your personal data.
11. If your data are processed on the basis of points 3(a) or 4(c) above, you also have the right to portability of your personal data, provided that the processing is carried out by automated means.
12. If your personal data is processed on the basis of points 3(b) and (c) or 4(a) above, you also have the right to object to the processing of your personal data on the grounds of your particular situation.
13. If your data is processed on the basis of point 4(c) above, you also have the right to withdraw your consent at any time, without affecting the lawfulness of the processing carried out prior to the withdrawal.
14. In addition, you have the right to lodge a complaint with the competent supervisory authority, which in Poland is the President of
the Office for Personal Data Protection.
15. No decisions in respect of the provided personal data will be taken by automated means, including profiling.
16. In the case of publication of materials containing information concerning a person or their image on social networking services (Facebook, Instagram, LinkedIn, X), personal data may be transferred to the USA. This takes place on the basis of the European Commission’s adequacy decision (the EU-US Data Privacy Framework).