Museum open at 12:00pm
Cinema is closed now
Museum open at 12:00pm
Cinema is closed now
Information Clause
concerning the processing of personal data of the contractors, persons authorised to represent the contractors and the contractors' contact persons
Pursuant to the obligation resulting from the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR), we would like to inform you that:
1. The controller of your personal data is Museum of Modern Art in Warsaw (Muzeum Sztuki Nowoczesnej w Warszawie), address: ul. Pańska 3, 00-124 Warsaw, entered in the register of cultural institutions of the Capital City of Warsaw under No. RIK/1/2023, REGON (National Business Registry Number): 140187435, NIP [Tax Identification Number]: 525-234-18-32 (hereinafter also ‘Controller’ or ‘Museum’). In matters concerning the protection of personal data, the Museum can be contacted:
a) by post: to the address of the Museum's registered office,
b) by e-mail: iod@artmuseum.pl.
2. The Data Controller has appointed a Data Protection Officer who can be contacted by email at:iod@artmuseum.pl.
3. Your personal data is processed:
a) if you are a counterparty of the Museum, for the purpose of entering into and performing a contract to which you are a party, in which case the legal basis for data processing is Article 6(1)(b) of the GDPR, or
b) if you are an employee or co-worker of the Museum's counterparty or a person authorised to represent the Museum's counterparty, and your data has been provided by your employer, principal or directly by you - in order to conclude and perform a contract concluded between the Museum and your employer or principal; in this case, the basis for data processing is Article 6(1)(f) of the GDPR, while the conclusion and performance of the aforementioned contract constitutes the legitimate interest of the Museum as a controller.
4. Personal data may also be processed on the basis of:
a) Article 6(1)(f) of the GDPR, i.e. where the processing is necessary for the purposes of the legitimate interests of the Museum or of a third party, such as the establishment, assertion or defence of claims in connection with the performance of a contract concluded between the Museum and a counterparty,
b) Article 6(1)(c) of the GDPR, i.e. where processing is necessary for compliance with a legal obligation to which the Controller is subject, including archiving obligations relating to the retention of documents for tax purposes and the archiving
of documentation concerning the conclusion and performance of a contract in accordance with the provisions on the national archival resource and archives.
5. The Museum processes ordinary data including, in particular:
a) in the case of business partners: first name, surname, company name, business address, TIN, REGON, contact details (including e-mail address, telephone number),
b) in the case of employees/co-workers of the counterparties and persons representing the counterparties: name, surname, official position, employer/principal details, business contact details (e-mail address, telephone number).
6. The Museum obtains personal data directly from the data subjects as a matter of principle. In the case of the persons referred to
in point 3(b), their personal data may be provided by a counterparty acting as their employer/principal. Some personal data may also be obtained from public sources (publicly available registers such as CEIDG, KRS).
7. The provision of personal data is voluntary, but necessary for the performance of the agreement concluded between the Museum and the counterparty. The consequence of failing to provide data may be the impossibility of concluding and performing
the aforementioned agreement.
8. The recipients of your personal data may include: providers of email hosting services and other IT service providers, contractors
of the Museum to whom it has outsourced the performance of all or part of the services in connection with the execution of
the specific-task contract, entities providing accounting, auditing, or advisory services, including legal and tax advisory, as well as
the Head of the National Revenue Administration in connection with the issuance of structured invoices within the National System of e-Invoices (KSeF). Your personal data may also be disclosed under the access to public information procedure (if the terms
and conditions of the agreement can constitute public information within the meaning of the regulations on access to public information), and in addition, the personal data of counterparties who are natural persons may be disclosed to an unlimited circle of addressees via the Internet through the Central Register of Agreements of the Capital City of Warsaw.
9. Your personal data will be processed by the Museum for the duration of the contract and may also be processed subsequently, i.e. for the period necessary for the establishment, exercise, or defence of legal claims in accordance with the applicable provisions of law (i.e. 3 years), or in connection with the necessity to comply with legal obligations incumbent on the Museum as the data controller, in particular the archiving obligation concerning documents stored for tax and accounting purposes (i.e. for a period of 5 years from the end of the year in which the tax was paid), whichever period is longer. Separate regulations may also provide for a longer period of document storage, including personal data, for selected categories of cases. This may concern, in particular, documentation of archival value, where data may be stored for a longer period in the public interest in accordance with the provisions on archiving. This processing is carried out in accordance with the document classification system applicable at the Museum, i.e. as a general rule, for a period of 25 years, and in strictly defined cases, perpetually.
10. You have the right to: request access to the personal data you have provided, rectify your personal data, request the erasure of your personal data, and restrict the processing of your personal data.
11. If your data are processed on the basis of points 3(a) above, you also have the right to portability of your personal data, provided that the processing is carried out by automated means.
12. If your personal data is processed on the basis of points 3(b) or 4(a) above, you also have the right to object to the processing of your personal data on the grounds of your particular situation.
13. In addition, you have the right to lodge a complaint with the competent supervisory authority, which in Poland is the President of the Office for Personal Data Protection.
14. No decisions in respect of the provided personal data will be taken by automated means, including profiling.
1. The controller of your personal data is Museum of Modern Art in Warsaw (Muzeum Sztuki Nowoczesnej w Warszawie), address: ul. Pańska 3, 00-124 Warsaw, entered in the register of cultural institutions of the Capital City of Warsaw under No. RIK/1/2023, REGON (National Business Registry Number): 140187435, NIP [Tax Identification Number]: 525-234-18-32 (hereinafter also ‘Controller’ or ‘Museum’). In matters concerning the protection of personal data, the Museum can be contacted:
a) by post: to the address of the Museum's registered office,
b) by e-mail: iod@artmuseum.pl.
2. The Data Controller has appointed a Data Protection Officer who can be contacted by email at:iod@artmuseum.pl.
3. Your personal data is processed:
a) if you are a counterparty of the Museum, for the purpose of entering into and performing a contract to which you are a party, in which case the legal basis for data processing is Article 6(1)(b) of the GDPR, or
b) if you are an employee or co-worker of the Museum's counterparty or a person authorised to represent the Museum's counterparty, and your data has been provided by your employer, principal or directly by you - in order to conclude and perform a contract concluded between the Museum and your employer or principal; in this case, the basis for data processing is Article 6(1)(f) of the GDPR, while the conclusion and performance of the aforementioned contract constitutes the legitimate interest of the Museum as a controller.
4. Personal data may also be processed on the basis of:
a) Article 6(1)(f) of the GDPR, i.e. where the processing is necessary for the purposes of the legitimate interests of the Museum or of a third party, such as the establishment, assertion or defence of claims in connection with the performance of a contract concluded between the Museum and a counterparty,
b) Article 6(1)(c) of the GDPR, i.e. where processing is necessary for compliance with a legal obligation to which the Controller is subject, including archiving obligations relating to the retention of documents for tax purposes and the archiving
of documentation concerning the conclusion and performance of a contract in accordance with the provisions on the national archival resource and archives.
5. The Museum processes ordinary data including, in particular:
a) in the case of business partners: first name, surname, company name, business address, TIN, REGON, contact details (including e-mail address, telephone number),
b) in the case of employees/co-workers of the counterparties and persons representing the counterparties: name, surname, official position, employer/principal details, business contact details (e-mail address, telephone number).
6. The Museum obtains personal data directly from the data subjects as a matter of principle. In the case of the persons referred to
in point 3(b), their personal data may be provided by a counterparty acting as their employer/principal. Some personal data may also be obtained from public sources (publicly available registers such as CEIDG, KRS).
7. The provision of personal data is voluntary, but necessary for the performance of the agreement concluded between the Museum and the counterparty. The consequence of failing to provide data may be the impossibility of concluding and performing
the aforementioned agreement.
8. The recipients of your personal data may include: providers of email hosting services and other IT service providers, contractors
of the Museum to whom it has outsourced the performance of all or part of the services in connection with the execution of
the specific-task contract, entities providing accounting, auditing, or advisory services, including legal and tax advisory, as well as
the Head of the National Revenue Administration in connection with the issuance of structured invoices within the National System of e-Invoices (KSeF). Your personal data may also be disclosed under the access to public information procedure (if the terms
and conditions of the agreement can constitute public information within the meaning of the regulations on access to public information), and in addition, the personal data of counterparties who are natural persons may be disclosed to an unlimited circle of addressees via the Internet through the Central Register of Agreements of the Capital City of Warsaw.
9. Your personal data will be processed by the Museum for the duration of the contract and may also be processed subsequently, i.e. for the period necessary for the establishment, exercise, or defence of legal claims in accordance with the applicable provisions of law (i.e. 3 years), or in connection with the necessity to comply with legal obligations incumbent on the Museum as the data controller, in particular the archiving obligation concerning documents stored for tax and accounting purposes (i.e. for a period of 5 years from the end of the year in which the tax was paid), whichever period is longer. Separate regulations may also provide for a longer period of document storage, including personal data, for selected categories of cases. This may concern, in particular, documentation of archival value, where data may be stored for a longer period in the public interest in accordance with the provisions on archiving. This processing is carried out in accordance with the document classification system applicable at the Museum, i.e. as a general rule, for a period of 25 years, and in strictly defined cases, perpetually.
10. You have the right to: request access to the personal data you have provided, rectify your personal data, request the erasure of your personal data, and restrict the processing of your personal data.
11. If your data are processed on the basis of points 3(a) above, you also have the right to portability of your personal data, provided that the processing is carried out by automated means.
12. If your personal data is processed on the basis of points 3(b) or 4(a) above, you also have the right to object to the processing of your personal data on the grounds of your particular situation.
13. In addition, you have the right to lodge a complaint with the competent supervisory authority, which in Poland is the President of the Office for Personal Data Protection.
14. No decisions in respect of the provided personal data will be taken by automated means, including profiling.