Museum open at 12:00pm
Cinema is closed now
Museum open at 12:00pm
Cinema is closed now
Information Clause
regarding the processing of personal data of family members and contacts of employees and persons employed under civil law agreements
Pursuant to the obligation under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (GDPR), we inform you that:
1. The controller of your personal data is the Museum of Modern Art in Warsaw, address: ul. Pańska 3, 00-124 Warsaw, entered in the register of cultural institutions of the Capital City of Warsaw under No. RIK/1/2023, National Business Register Number [REGON]: 140187435, NIP (Tax Identification Number): 525-234-18-32 (hereinafter also 'Controller' or 'Museum'). In matters concerning the protection of personal data, the Museum can be contacted:
a) by post: to the address of the Museum's registered office,
b) by e-mail: iod@artMuseum.pl.
2. The Data Controller has appointed a Data Protection Officer who can be contacted by email at:iod@artmuseum.pl.
3. The Data Controller is entitled to process personal data of:
a) the next of kin of the Museum’s employees and of persons employed by the Museum on the basis of a civil law contract, in particular in connection with the performance of obligations in the field of social security, and in connection with registering the next of kin for social insurance purposes;
b) persons who may be contacted by the data controller on matters concerning a given employee or employed person, including in the event of an accident – provided that the employee or employed person has consented to providing the personal data of such a person.
4. In the case referred to in point 3(a) above, the Data Controller may process personal data within the scope required by the applicable provisions of law, including the following personal data: first name and surname, date of birth, degree of relationship with the employee, PESEL (Polish Resident Identification Number), NIP (Tax Identification Number), information on undertaking education (including school details), information on sharing a joint household with the employee or employed person, residential address, and information on being subject to social insurance under another title.
5. In the case referred to in point 3(b) above, the Data Controller may process, in particular: the first name, surname, and contact details of the contact person (including a telephone number or email address).
6. The Data Controller obtains personal data from the employee or employed person, or directly from the data subject.
7. The legal basis for the processing of personal data is:
a) in the case referred to in point 3(a) above – Article 6(1)(c) of the GDPR, which means that the data are processed for compliance with legal obligations to which the Data Controller is subject, arising from the provisions of labour law and social security law;
b) in the case referred to in point 3(b) above – Article 6(1)(f) of the GDPR, which means that processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, whereby such legitimate interests include the necessity for the Museum to contact the person indicated by the employee or employed person on a matter concerning that employee or employed person.
8. Personal data may also be processed on the basis of Article 6(1)(f) of the GDPR, which means that processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, whereby such legitimate interests include the establishment, exercise, or defence of claims, in particular those related to the performance by the Data Controller of legal obligations arising from the provisions of labour law or social security law.
9. The provision of personal data referred to in point 3(a) above is an obligation arising from the provisions of labour law or social security law. The consequence of failure to provide the data may be a refusal to perform specific actions or a refusal to take into account employee entitlements or entitlements granted to the next of kin of the employee or employed person, or to other persons indicated by them, under labour law or social security law. The provision of the personal data specified in point 3(b) above is voluntary, but necessary for the purpose of initiating contact.
10. The recipients of personal data may include: providers of email hosting services, entities providing accounting, auditing, or advisory services, including legal or tax advisory, specified medical facilities, and public law institutions performing tasks in the field of social insurance (including ZUS).
11. Personal data will be processed for the duration of employment of the employee or employed person who provided the personal data of their next of kin or contact details, and may also be processed subsequently – i.e. for a maximum period for which employee documentation of the employee is stored, determined in accordance with the applicable provisions of law, provided that these data form part of the employee documentation. In the case of ZUS registration and settlement documentation, the documents will be stored for a period of 5 years. Personal data provided for the purpose of contact on matters concerning an employee or employed person will be processed in each case no longer than until the withdrawal of consent by the employee or employed person for the provision of such data, or until an objection against the processing of data is raised by the data subject, unless there are no grounds to uphold such an objection.
12. You have the right to request access to the provided personal data, the rectification thereof, and to request the erasure thereof, as well as to request the restriction of processing of the data.
13. In the case referred to in point 7(b) above, you also have the right to object to the processing of personal data on grounds relating to your particular situation.
14. You also have the right to lodge a complaint with the supervisory authority, which is the President of the Personal Data Protection Office.
15. No automated decision-making, including profiling, will be carried out regarding the personal data provided.
1. The controller of your personal data is the Museum of Modern Art in Warsaw, address: ul. Pańska 3, 00-124 Warsaw, entered in the register of cultural institutions of the Capital City of Warsaw under No. RIK/1/2023, National Business Register Number [REGON]: 140187435, NIP (Tax Identification Number): 525-234-18-32 (hereinafter also 'Controller' or 'Museum'). In matters concerning the protection of personal data, the Museum can be contacted:
a) by post: to the address of the Museum's registered office,
b) by e-mail: iod@artMuseum.pl.
2. The Data Controller has appointed a Data Protection Officer who can be contacted by email at:iod@artmuseum.pl.
3. The Data Controller is entitled to process personal data of:
a) the next of kin of the Museum’s employees and of persons employed by the Museum on the basis of a civil law contract, in particular in connection with the performance of obligations in the field of social security, and in connection with registering the next of kin for social insurance purposes;
b) persons who may be contacted by the data controller on matters concerning a given employee or employed person, including in the event of an accident – provided that the employee or employed person has consented to providing the personal data of such a person.
4. In the case referred to in point 3(a) above, the Data Controller may process personal data within the scope required by the applicable provisions of law, including the following personal data: first name and surname, date of birth, degree of relationship with the employee, PESEL (Polish Resident Identification Number), NIP (Tax Identification Number), information on undertaking education (including school details), information on sharing a joint household with the employee or employed person, residential address, and information on being subject to social insurance under another title.
5. In the case referred to in point 3(b) above, the Data Controller may process, in particular: the first name, surname, and contact details of the contact person (including a telephone number or email address).
6. The Data Controller obtains personal data from the employee or employed person, or directly from the data subject.
7. The legal basis for the processing of personal data is:
a) in the case referred to in point 3(a) above – Article 6(1)(c) of the GDPR, which means that the data are processed for compliance with legal obligations to which the Data Controller is subject, arising from the provisions of labour law and social security law;
b) in the case referred to in point 3(b) above – Article 6(1)(f) of the GDPR, which means that processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, whereby such legitimate interests include the necessity for the Museum to contact the person indicated by the employee or employed person on a matter concerning that employee or employed person.
8. Personal data may also be processed on the basis of Article 6(1)(f) of the GDPR, which means that processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, whereby such legitimate interests include the establishment, exercise, or defence of claims, in particular those related to the performance by the Data Controller of legal obligations arising from the provisions of labour law or social security law.
9. The provision of personal data referred to in point 3(a) above is an obligation arising from the provisions of labour law or social security law. The consequence of failure to provide the data may be a refusal to perform specific actions or a refusal to take into account employee entitlements or entitlements granted to the next of kin of the employee or employed person, or to other persons indicated by them, under labour law or social security law. The provision of the personal data specified in point 3(b) above is voluntary, but necessary for the purpose of initiating contact.
10. The recipients of personal data may include: providers of email hosting services, entities providing accounting, auditing, or advisory services, including legal or tax advisory, specified medical facilities, and public law institutions performing tasks in the field of social insurance (including ZUS).
11. Personal data will be processed for the duration of employment of the employee or employed person who provided the personal data of their next of kin or contact details, and may also be processed subsequently – i.e. for a maximum period for which employee documentation of the employee is stored, determined in accordance with the applicable provisions of law, provided that these data form part of the employee documentation. In the case of ZUS registration and settlement documentation, the documents will be stored for a period of 5 years. Personal data provided for the purpose of contact on matters concerning an employee or employed person will be processed in each case no longer than until the withdrawal of consent by the employee or employed person for the provision of such data, or until an objection against the processing of data is raised by the data subject, unless there are no grounds to uphold such an objection.
12. You have the right to request access to the provided personal data, the rectification thereof, and to request the erasure thereof, as well as to request the restriction of processing of the data.
13. In the case referred to in point 7(b) above, you also have the right to object to the processing of personal data on grounds relating to your particular situation.
14. You also have the right to lodge a complaint with the supervisory authority, which is the President of the Personal Data Protection Office.
15. No automated decision-making, including profiling, will be carried out regarding the personal data provided.