Privacy Policy

Privacy Policy and Cookie Policy

The Privacy Policy and Cookie Policy have been issued in accordance with applicable laws in Poland and European Union, particularly the Act of July 16, 2004, on Telecommunications Law (Journal of Laws 2017, item 1907, as amended) and Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC, hereinafter referred to as GDPR.

1. Information About the Data Controller:
   “Website Administrator” – The Villa Decius Institute of Culture, located in Kraków, 28 Lipca Street 17A, 30-233 Kraków, a municipal cultural institution entered in the register of cultural institutions maintained by the City of Kraków under number 35, with VAT ID (NIP) 6772440713, and REGON 382172593, hereinafter referred to as the “Institute,” email: willa@willadecjusza.pl, phone: +48 12 425 36 38.
   Data Protection Officer (DPO): email: willa@willadecjusza.pl, phone: +48 12 425 36 38.
2. Your personal data will be processed for the following purposes:
   1. To conclude and execute agreements (legal basis: Article 6(1)(b) GDPR);
   2. To fulfill the Institute’s legal obligations, particularly issuing and storing invoices and accounting documents (legal basis: Article 6(1)(c) GDPR);
   3. For purposes related to participation in projects implemented by the Institute (legal basis: Article 6(1)(b) GDPR);
   4. For marketing and promotion of the Institute’s products and services (legal basis: Article 6(1)(a) and (f) GDPR);
   5. For archival (evidence-based) purposes, establishing, pursuing, or defending claims, and ensuring the safety of people and property based on the legitimate interests of the Institute (legal basis: Article 6(1)(f) GDPR);
   6. For employment and fulfilling employer obligations under Article 6(1)(a), (b), and (c) GDPR and the Act of June 26, 1974 – Labor Code.
3. Your personal data may be shared with the following categories of recipients:
   1. Entities authorized by universally binding legal provisions;
   2. Entities processing data on behalf of the Institute, i.e., subcontractors processing data under an agreement and exclusively per the Institute’s instructions.
4. Your personal data will be processed for the duration necessary to achieve the specified purposes for which they were collected, following criteria outlined by law, including securing potential claims until their limitation periods expire.
   The Administrator may store personal data longer, but only for justified reasons where the law permits such storage.
   For marketing purposes, based on your consent (Article 6(1)(a) GDPR), data will be processed until you withdraw your consent.
5. Regarding your personal data, you have the following rights, subject to exceptions provided by GDPR or other legal provisions:
   1. The right to request access to your personal data;
   2. The right to request rectification of your personal data;
   3. The right to request deletion of unjustifiably processed data;
   4. The right to request restriction of data processing;
   5. The right to object to data processing;
   6. The right to data portability as specified in Article 20 GDPR;
   7. The right to lodge a complaint with the Polish Personal Data Protection Office (UODO) if you believe that the processing of your personal data violates data protection regulations.
   Providing personal data is voluntary but necessary to achieve the specified purposes.