Museum open at 12:00pm
Cinema is closed now
Museum open at 12:00pm
Cinema is closed now
Information Clause
regarding the processing of personal data of events participants, including educational and development events
In accordance with the obligation arising from Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR), we hereby inform you that:
1. The controller of your personal data is the Museum of Modern Art in Warsaw, address: ul. Pańska 3, 00-124 Warsaw, entered in the register of cultural institutions of the Capital City of Warsaw under No. RIK/1/2023, National Business Register Number [REGON]: 140187435, NIP (Tax Identification Number): 525-234-18-32 (hereinafter also 'Controller' or ‘Museum’). In matters relating to personal data protection, you can contact the Museum:
a) by post: to the address of the Museum's registered office,
b) e-mail: iod@artmuseum.pl
2. The Data Controller has appointed a Data Protection Officer who can be contacted by email at: iod@artmuseum.pl.
3. Your personal data will be processed in connection with the organisation and staging of the event by the Museum.
4. The legal basis for the processing of personal data is:
a) Article 6(1)(f) of the GDPR, which means that processing is necessary for the purposes of the legitimate interests pursued by the Museum as the Data Controller or by a third party, which include the organisation and staging of the event and enabling the participants to take part in the event;
b) Article 6(1)(e) of the GDPR, which means that processing is necessary for the performance of a task carried out by the Museum in the public interest, namely the fulfilment of its educational, cultural, and research mission.
5. Some of the events may be dedicated to persons with special needs, at a specific level of development, or in a specific physical or mental condition. In such a case, the Data Controller may process sensitive personal data, in particular data concerning health (solely within the scope necessary to confirm the right to participate in a given event), including information on disability (in connection with the necessity to ensure accessibility). The legal basis for the processing of the indicated personal data in this case is Article 9(2)(g) of the GDPR – which means that processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject; the substantial public interest is the fulfilment of the educational, cultural, and research mission by the Museum.
6. The basis for processing personal data may also be:
a) Article 6(1)(a) of the GDPR, which means that you have given your consent to the processing of personal data for a specific purpose; this may concern, in particular, the processing of personal data in the form of an image in connection with documenting the event through photographs or video or audio-video recordings;
b) Article 6(1)(c) of the GDPR, which means that the processing of data is necessary for compliance with a legal obligation by the Museum as the Data Controller, i.e. the archiving obligation arising from the provisions of the Act on the National Archival Asset and Archives, or obligations concerning the retention of documents for tax and accounting purposes;
c) Article 6(1)(f) of the GDPR, which means that processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, such as the establishment, exercise, or defence of claims; in the case of sensitive data, the legal basis for their processing for the purpose referred to in the preceding sentence is Article 9(2)(f) of the GDPR.
7. The Museum collects personal data directly from the participants registering their attendance at a given event, as well as from persons other than the data subject – in particular from the person or entity making the registration on behalf of or for the benefit of the participant of a given event (in particular where the registration concerns a child or an incapacitated person).
8. As a general rule, the Museum collects ordinary data, which include, in particular: the first name and surname of the participant of a given Event, the contact details of the person making the registration (telephone, email address), and in the case of children – information on the degree of relationship between the child and the guardian (if applicable); in the case referred to in point 5 above, the Museum may also collect sensitive data concerning health, including information on disability. In the case of recording a given event in the form of photographs, video, or audio-video recordings, the Museum may also process the participant’s image.
9. The provision of personal data is voluntary, but necessary to take part in the event. The consequence of failure to provide the data may be the inability to take part in the event. Where data are processed on the basis of consent, as a general rule, no consequences are foreseen for failure to provide the data; however, in the case of recorded events, the consequence of refusing to grant consent to the dissemination of the image may be the inability to take part in the event.
10. The recipients of your personal data may include, in particular, providers of email hosting services, other IT service providers, entities providing property security services, entities providing advisory services, including legal, tax, and other advisory, entities – including contractors of the Museum – to whom the data are disclosed in connection with the staging of the event, as well as external entities organising or co-organising the event. In connection with the potential publication of materials, the recipients of the images may also include social networking service providers where the Museum maintains its social media profiles (Facebook, Instagram, LinkedIn, X), visitors to the websites where the prepared materials will be available, including the Museum’s website and social media channels operated by the Museum, as well as recipients of other materials from the event.
11. Your personal data will be processed by the Museum for the duration of the event and for a period of the subsequent 3 months. Personal data may also be processed subsequently, i.e. for the period necessary for the establishment, exercise, or defence of legal claims in accordance with the applicable provisions of law (i.e. 3 or 6 years), or in connection with the necessity to comply with legal obligations incumbent on the Museum as the Data Controller, in particular the archiving obligation concerning documents stored for tax and accounting purposes (i.e. for a period of 5 years from the end of the year in which the tax was paid), whichever period is longer. Materials containing the recorded image may also be processed by the Museum for archiving purposes in the public interest, provided that such processing shall not concern the dissemination of the image. This processing is carried out in accordance with the provisions on the archiving of documentation and in accordance with the document classification system applicable at the Museum, i.e. as a general rule, for a period of 25 years.
12. You have the right to request access to the provided personal data, the rectification thereof, to request the erasure thereof, and to request the restriction of processing of the data.
13. In the case of data processed on the basis of consent, you have the right to data portability and to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
14. You have the right to object to the processing of personal data on grounds relating to your particular situation.
15. You also have the right to lodge a complaint with the supervisory authority, which is the President of the Personal Data Protection Office.
16. In relation to the personal data provided, decisions will not be made in an automated manner, including based on profiling.
17. When posting content containing images on social media platforms (Facebook, Instagram, LinkedIn, X), personal data may be transferred to the US. This takes place on the basis of the European Commission’s adequacy decision (the EU-US Data Privacy Framework).
18. Personal data may also be processed in connection with visits to the Museum of Modern Art in Warsaw. Further information on the processing of personal data during visits can be found in the Visitor Regulations of the Museum of Modern Art in Warsaw.
1. The controller of your personal data is the Museum of Modern Art in Warsaw, address: ul. Pańska 3, 00-124 Warsaw, entered in the register of cultural institutions of the Capital City of Warsaw under No. RIK/1/2023, National Business Register Number [REGON]: 140187435, NIP (Tax Identification Number): 525-234-18-32 (hereinafter also 'Controller' or ‘Museum’). In matters relating to personal data protection, you can contact the Museum:
a) by post: to the address of the Museum's registered office,
b) e-mail: iod@artmuseum.pl
2. The Data Controller has appointed a Data Protection Officer who can be contacted by email at: iod@artmuseum.pl.
3. Your personal data will be processed in connection with the organisation and staging of the event by the Museum.
4. The legal basis for the processing of personal data is:
a) Article 6(1)(f) of the GDPR, which means that processing is necessary for the purposes of the legitimate interests pursued by the Museum as the Data Controller or by a third party, which include the organisation and staging of the event and enabling the participants to take part in the event;
b) Article 6(1)(e) of the GDPR, which means that processing is necessary for the performance of a task carried out by the Museum in the public interest, namely the fulfilment of its educational, cultural, and research mission.
5. Some of the events may be dedicated to persons with special needs, at a specific level of development, or in a specific physical or mental condition. In such a case, the Data Controller may process sensitive personal data, in particular data concerning health (solely within the scope necessary to confirm the right to participate in a given event), including information on disability (in connection with the necessity to ensure accessibility). The legal basis for the processing of the indicated personal data in this case is Article 9(2)(g) of the GDPR – which means that processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject; the substantial public interest is the fulfilment of the educational, cultural, and research mission by the Museum.
6. The basis for processing personal data may also be:
a) Article 6(1)(a) of the GDPR, which means that you have given your consent to the processing of personal data for a specific purpose; this may concern, in particular, the processing of personal data in the form of an image in connection with documenting the event through photographs or video or audio-video recordings;
b) Article 6(1)(c) of the GDPR, which means that the processing of data is necessary for compliance with a legal obligation by the Museum as the Data Controller, i.e. the archiving obligation arising from the provisions of the Act on the National Archival Asset and Archives, or obligations concerning the retention of documents for tax and accounting purposes;
c) Article 6(1)(f) of the GDPR, which means that processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, such as the establishment, exercise, or defence of claims; in the case of sensitive data, the legal basis for their processing for the purpose referred to in the preceding sentence is Article 9(2)(f) of the GDPR.
7. The Museum collects personal data directly from the participants registering their attendance at a given event, as well as from persons other than the data subject – in particular from the person or entity making the registration on behalf of or for the benefit of the participant of a given event (in particular where the registration concerns a child or an incapacitated person).
8. As a general rule, the Museum collects ordinary data, which include, in particular: the first name and surname of the participant of a given Event, the contact details of the person making the registration (telephone, email address), and in the case of children – information on the degree of relationship between the child and the guardian (if applicable); in the case referred to in point 5 above, the Museum may also collect sensitive data concerning health, including information on disability. In the case of recording a given event in the form of photographs, video, or audio-video recordings, the Museum may also process the participant’s image.
9. The provision of personal data is voluntary, but necessary to take part in the event. The consequence of failure to provide the data may be the inability to take part in the event. Where data are processed on the basis of consent, as a general rule, no consequences are foreseen for failure to provide the data; however, in the case of recorded events, the consequence of refusing to grant consent to the dissemination of the image may be the inability to take part in the event.
10. The recipients of your personal data may include, in particular, providers of email hosting services, other IT service providers, entities providing property security services, entities providing advisory services, including legal, tax, and other advisory, entities – including contractors of the Museum – to whom the data are disclosed in connection with the staging of the event, as well as external entities organising or co-organising the event. In connection with the potential publication of materials, the recipients of the images may also include social networking service providers where the Museum maintains its social media profiles (Facebook, Instagram, LinkedIn, X), visitors to the websites where the prepared materials will be available, including the Museum’s website and social media channels operated by the Museum, as well as recipients of other materials from the event.
11. Your personal data will be processed by the Museum for the duration of the event and for a period of the subsequent 3 months. Personal data may also be processed subsequently, i.e. for the period necessary for the establishment, exercise, or defence of legal claims in accordance with the applicable provisions of law (i.e. 3 or 6 years), or in connection with the necessity to comply with legal obligations incumbent on the Museum as the Data Controller, in particular the archiving obligation concerning documents stored for tax and accounting purposes (i.e. for a period of 5 years from the end of the year in which the tax was paid), whichever period is longer. Materials containing the recorded image may also be processed by the Museum for archiving purposes in the public interest, provided that such processing shall not concern the dissemination of the image. This processing is carried out in accordance with the provisions on the archiving of documentation and in accordance with the document classification system applicable at the Museum, i.e. as a general rule, for a period of 25 years.
12. You have the right to request access to the provided personal data, the rectification thereof, to request the erasure thereof, and to request the restriction of processing of the data.
13. In the case of data processed on the basis of consent, you have the right to data portability and to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
14. You have the right to object to the processing of personal data on grounds relating to your particular situation.
15. You also have the right to lodge a complaint with the supervisory authority, which is the President of the Personal Data Protection Office.
16. In relation to the personal data provided, decisions will not be made in an automated manner, including based on profiling.
17. When posting content containing images on social media platforms (Facebook, Instagram, LinkedIn, X), personal data may be transferred to the US. This takes place on the basis of the European Commission’s adequacy decision (the EU-US Data Privacy Framework).
18. Personal data may also be processed in connection with visits to the Museum of Modern Art in Warsaw. Further information on the processing of personal data during visits can be found in the Visitor Regulations of the Museum of Modern Art in Warsaw.