Museum open at 12:00pm
Cinema is closed now
Museum open at 12:00pm
Cinema is closed now
Information Clause
regarding the processing of personal data of events participants
In accordance with the obligation arising from Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR), we hereby inform you that:
1. The controller of your personal data is the Museum of Modern Art in Warsaw, address: ul. Pańska 3, 00-124 Warsaw, entered in the register of cultural institutions of the Capital City of Warsaw under No. RIK/1/2023, National Business Register Number [REGON]: 140187435, NIP (Tax Identification Number): 525-234-18-32 (hereinafter also 'Controller' or 'Museum'). In matters relating to personal data protection, you can contact the Museum:
a) by post: to the address of the Museum's registered office,
b) e-mail: iod@artmuseum.pl
2. The Data Controller has appointed a Data Protection Officer who can be contacted by email at: iod@artmuseum.pl.
3. Your personal data will be processed in connection with the organisation and staging of the event by the Museum.
4. The legal basis is:
a) Article 6(1)(f) of the GDPR, which means that processing is necessary for the purposes of the legitimate interests pursued by the Museum as the Data Controller or by a third party, which include the organisation and staging of the event and enabling the participants to take part in the event;
b) Article 6(1)(e) of the GDPR, which means that processing is necessary for the performance of a task carried out by the Museum in the public interest, namely the fulfilment of its educational, cultural, and research mission.
5. The basis for processing personal data may also be:
a) Article 6(1)(a) of the GDPR, which means that you have given your consent to the processing of personal data for a specific purpose; this may concern, in particular, the processing of personal data in the form of an image in connection with documenting the event through photographs or video or audio-video recordings;
b) Article 6(1)(c) of the GDPR, which means that the processing of data is necessary for compliance with a legal obligation by the Museum as the Data Controller, i.e. the archiving obligation arising from the provisions of the Act on the National Archival Asset and Archives, or obligations concerning the retention of documents for tax and accounting purposes;
c) Article 6(1)(f) of the GDPR, which means that processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, such as the establishment, exercise, or defence of claims.
6. As a general rule, the Museum collects personal data directly from the event participants registering their attendance. Data may also be obtained from persons other than the data subject – in particular from the person or entity making the registration, including on behalf of the event participant.
7. As a general rule, the Museum collects ordinary data, which include, in particular: the first name and surname of the participant of a given Event, the contact details of the person making the registration (telephone, email address), and in the case of children – information on the degree of relationship between the child and the guardian (if applicable). In the case of recording a given event in the form of photographs, video, or audio-video recordings, the Museum may also process the participant’s image.
8. The provision of personal data is voluntary, but necessary to take part in the event. The consequence of failure to provide the data may be the inability to take part in the event. Where data are processed on the basis of consent, as a general rule, no consequences are foreseen for failure to provide the data; however, in the case of recorded events, the consequence of refusing to grant consent to the dissemination of the image may be the inability to take part in the event.
9. The recipients of your personal data may include, in particular, providers of email hosting services, other IT service providers, entities providing property security services, entities providing advisory services, including legal, tax, and other advisory, entities – including contractors of the Museum – to whom the data are disclosed in connection with the staging of the event, as well as external entities organising or co-organising the event. In connection with the potential publication of materials, the recipients of the images may also include social networking service providers where the Museum maintains its social media profiles (Facebook, Instagram, LinkedIn, X), visitors to the websites where the prepared materials will be available, including the Museum’s website and social media channels operated by the Museum, as well as recipients of other materials from the event.
10. Your personal data will be processed by the Museum for the duration of the event and for a period of the subsequent 3 months. Personal data may also be processed subsequently, i.e. for the period necessary for the establishment, exercise, or defence of legal claims in accordance with the applicable provisions of law (i.e. 3 or 6 years), or in connection with the necessity to comply with legal obligations incumbent on the Museum as the Data Controller, in particular the archiving obligation concerning documents stored for tax and accounting purposes (i.e. for a period of 5 years from the end of the year in which the tax was paid), whichever period is longer. Materials containing the recorded image may also be processed by the Museum for archiving purposes in the public interest, provided that such processing shall not concern the dissemination of the image. This processing is carried out in accordance with the provisions on the archiving of documentation and in accordance with the document classification system applicable at the Museum, i.e. as a general rule, for a period of 25 years.
11. You have the right to request access to the provided personal data, the rectification thereof, to request the erasure thereof, and to request the restriction of processing of the data.
12. In the case of data processed on the basis of consent, you have the right to data portability and to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
13. You have the right to object to the processing of personal data on grounds relating to your particular situation.
14. You also have the right to lodge a complaint with the supervisory authority, which is the President of the Personal Data Protection Office.
15. In relation to the personal data provided, decisions will not be made in an automated manner, including based on profiling.
16. When posting content containing images on social media platforms (Facebook, Instagram, LinkedIn, X), personal data may be transferred to the US. This takes place on the basis of the European Commission’s adequacy decision (the EU-US Data Privacy Framework).
17. Personal data may also be processed in connection with visits to the Museum of Modern Art in Warsaw. Further information on the processing of personal data during visits can be found in the Visitor Regulations of the Museum of Modern Art in Warsaw.
1. The controller of your personal data is the Museum of Modern Art in Warsaw, address: ul. Pańska 3, 00-124 Warsaw, entered in the register of cultural institutions of the Capital City of Warsaw under No. RIK/1/2023, National Business Register Number [REGON]: 140187435, NIP (Tax Identification Number): 525-234-18-32 (hereinafter also 'Controller' or 'Museum'). In matters relating to personal data protection, you can contact the Museum:
a) by post: to the address of the Museum's registered office,
b) e-mail: iod@artmuseum.pl
2. The Data Controller has appointed a Data Protection Officer who can be contacted by email at: iod@artmuseum.pl.
3. Your personal data will be processed in connection with the organisation and staging of the event by the Museum.
4. The legal basis is:
a) Article 6(1)(f) of the GDPR, which means that processing is necessary for the purposes of the legitimate interests pursued by the Museum as the Data Controller or by a third party, which include the organisation and staging of the event and enabling the participants to take part in the event;
b) Article 6(1)(e) of the GDPR, which means that processing is necessary for the performance of a task carried out by the Museum in the public interest, namely the fulfilment of its educational, cultural, and research mission.
5. The basis for processing personal data may also be:
a) Article 6(1)(a) of the GDPR, which means that you have given your consent to the processing of personal data for a specific purpose; this may concern, in particular, the processing of personal data in the form of an image in connection with documenting the event through photographs or video or audio-video recordings;
b) Article 6(1)(c) of the GDPR, which means that the processing of data is necessary for compliance with a legal obligation by the Museum as the Data Controller, i.e. the archiving obligation arising from the provisions of the Act on the National Archival Asset and Archives, or obligations concerning the retention of documents for tax and accounting purposes;
c) Article 6(1)(f) of the GDPR, which means that processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, such as the establishment, exercise, or defence of claims.
6. As a general rule, the Museum collects personal data directly from the event participants registering their attendance. Data may also be obtained from persons other than the data subject – in particular from the person or entity making the registration, including on behalf of the event participant.
7. As a general rule, the Museum collects ordinary data, which include, in particular: the first name and surname of the participant of a given Event, the contact details of the person making the registration (telephone, email address), and in the case of children – information on the degree of relationship between the child and the guardian (if applicable). In the case of recording a given event in the form of photographs, video, or audio-video recordings, the Museum may also process the participant’s image.
8. The provision of personal data is voluntary, but necessary to take part in the event. The consequence of failure to provide the data may be the inability to take part in the event. Where data are processed on the basis of consent, as a general rule, no consequences are foreseen for failure to provide the data; however, in the case of recorded events, the consequence of refusing to grant consent to the dissemination of the image may be the inability to take part in the event.
9. The recipients of your personal data may include, in particular, providers of email hosting services, other IT service providers, entities providing property security services, entities providing advisory services, including legal, tax, and other advisory, entities – including contractors of the Museum – to whom the data are disclosed in connection with the staging of the event, as well as external entities organising or co-organising the event. In connection with the potential publication of materials, the recipients of the images may also include social networking service providers where the Museum maintains its social media profiles (Facebook, Instagram, LinkedIn, X), visitors to the websites where the prepared materials will be available, including the Museum’s website and social media channels operated by the Museum, as well as recipients of other materials from the event.
10. Your personal data will be processed by the Museum for the duration of the event and for a period of the subsequent 3 months. Personal data may also be processed subsequently, i.e. for the period necessary for the establishment, exercise, or defence of legal claims in accordance with the applicable provisions of law (i.e. 3 or 6 years), or in connection with the necessity to comply with legal obligations incumbent on the Museum as the Data Controller, in particular the archiving obligation concerning documents stored for tax and accounting purposes (i.e. for a period of 5 years from the end of the year in which the tax was paid), whichever period is longer. Materials containing the recorded image may also be processed by the Museum for archiving purposes in the public interest, provided that such processing shall not concern the dissemination of the image. This processing is carried out in accordance with the provisions on the archiving of documentation and in accordance with the document classification system applicable at the Museum, i.e. as a general rule, for a period of 25 years.
11. You have the right to request access to the provided personal data, the rectification thereof, to request the erasure thereof, and to request the restriction of processing of the data.
12. In the case of data processed on the basis of consent, you have the right to data portability and to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
13. You have the right to object to the processing of personal data on grounds relating to your particular situation.
14. You also have the right to lodge a complaint with the supervisory authority, which is the President of the Personal Data Protection Office.
15. In relation to the personal data provided, decisions will not be made in an automated manner, including based on profiling.
16. When posting content containing images on social media platforms (Facebook, Instagram, LinkedIn, X), personal data may be transferred to the US. This takes place on the basis of the European Commission’s adequacy decision (the EU-US Data Privacy Framework).
17. Personal data may also be processed in connection with visits to the Museum of Modern Art in Warsaw. Further information on the processing of personal data during visits can be found in the Visitor Regulations of the Museum of Modern Art in Warsaw.