INFORMATION CLAUSE

Pursuant to the obligation arising from the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/WE (General Data Protection Regulation – the “GDPR”), we inform that:

1. Muzeum Sztuki Nowoczesnej w Warszawie (Museum of Modern Art in Warsaw), address: ul. Pańska 3, post code: 00-124 Warsaw, Poland, entered into the register of cultural institutions of the Capital City of Warsaw under the number: RIK/1/2023, REGON (statistical number): 140187435, NIP (tax identification number): 525-234-18-32 is the controller of your personal data (hereinafter referred to as the “Controller” of the “Museum”). In matters relating to the protection of personal data, you can contact the Museum:
a) by post: to the address of the registered office of the Museum,
b) by e-mail: iod@artmuseum.pl.

2. The Controller of personal data has appointed a Data Protection Officer (DPO) and you can contact the DPO by e-mail at: iod@artmuseum.pl.

3. Your personal data shall be processed in connection with establishing and maintaining communication with the Museum or solving an individual case and will include, in particular, name, surname, contact details and other data regarding an individual case. The Museum obtains personal data, as a rule, directly from the data subjects.

4. The legal basis for the processing of personal data is:

a) in case of persons who report an individual case via e-mail and persons with whom cooperation may be potentially established, including persons acting on behalf of potential contractors or clients of the Museum, if the Museum sends an inquiry or an offer – Article 6(1)(f) of the GDPR, which means that processing is necessary for the purposes of the legitimate interests pursued by the Museum or a third party, which may include the need to communicate, consider an individual case or direct marketing,
b) in case of the persons with whom cooperation may potentially be established, including persons acting on behalf of potential contractors or clients of the Museum, if these persons or entities on behalf of whom they act submit an inquiry or offer to the Museum - Article 6(1)(b) of the GDPR, which means that processing is necessary in order to take steps at the request of the data subject prior to entering into a contract.
5. Your personal data shall also be processed on the basis of:

a) Article 6(1)(f) of the GDPR – if processing is necessary for the purposes of the legitimate interests pursued by the Museum or a third party, such as establishment, exercise or defence of legal claims,
b) Article 6(1)(a) of the GDPR – if you granted consent to processing of certain categories of personal data, including for the purpose of sending commercial information by electronic means,
c) Article 6(1)(c) of the GDPR – if processing is necessary for compliance of the legal obligation to which the data Controller is a subject, including the archiving obligations of the documents for tax purposes
6. Proving personal data is voluntary, but necessary to establish contact, correspond with the Museum or examine an individual case reported to the Muzeum. The consequence of not providing data may be the inability to continue communication and failure to consider the reported case or the inability to receive an offer, negotiate and conclude a contract with the Museum. In the case of data processed for the purpose of sending commercial information by electronic means (if consent has been given), failure to provide data may result in the inability to receive such information.

7. The recipient of your personal data shall include: entities providing e-mail hosting services and other IT service providers, contractors of the Museum to whom it commissioned to perform of all or part of the customer services, entities proving accounting, auditing or consulting services, including legal and tax services.

8. Your personal data shall be process by the Museum for the duration of communication or consideration of your individual case. Personal data may also be processed later, if it is necessary to settle an individual case or to establishment, exercise or defence of legal claims, or if necessary, for the period of storing documents for tax purposes (depending on which period is longer).

9. You have the right to: request the access to your personal data, rectification of your personal data, erasure of your personal data, as well as the right to request the restriction of your personal data processing.

10. If your personal data are processed on the basis of point 4(b) or 5(b) above (taking steps prior to entering into a contract or under the consent granted), you also have the right to data portability, if the processing is carried out by automated means.

11. If your personal data are processed on the basis of point 4(a) above (legitimate interests of the Controller of personal data), you also have the right to object to processing of personal data on grounds relating to your particular situation.

12. If your personal data are processed on the basis of point 5(b) above (under the consent granted), you also have the right to withdraw the consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

13. You have the right to lodge a complaint with a supervisory authority; in Poland it is: the President of the Personal Data Protection Office (address: ul. Stawki 2, post code: 00-193 Warsaw, Poland).

14. There shall be no automated decision-making, including profiling, as regards to your personal data.