Experyment Science Centre in Gdynia (further: ESC) diligently protects the privacy of its visitors and any persons it works with in pursuing its statutory tasks.
Any personal data collected and used by ESC ESC (defined as any information identifying a natural person) are processed in accordance with legal regulations and internal security policies.
ESC pursues its tasks and obligations as data controller, as provided for in the relevant personal data protection regulations, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (further: GDPR).
Data transparency is important to us. Please read the information below to understand the purpose, scope and manner of storing your personal data.
The person in charge of your personal data is the Data Protection Officer appointed by ESC. Agnieszka Czerwińska, [email protected], +48 58 72 73 985
I BASIC INFORMATION
Data Controller
Experyment Science Centre in Gdynia,
al. Zwycięstwa 96/98
81-451 Gdynia
Data Protection Officer
Agnieszka Czerwińska
[email protected]
+48 58 72 73 985
Rights of the data subject
1. Right to access the personal data.
2. Right to demand rectification of inaccurate data or demand completion of incomplete data.
3. Right to demand erasure of data if they are no longer necessary in relation to the purposes for which they were orinigally collected, if their processing was based on your consent or if you conclude that they were processed unlawfully.
4. Right to demand restriction of data processing, i.e. right to demand that any processing operations be stopped (for the period necessary to verify the data) if you question the correctness of the data or if you conclude that the data are processed unlawfully, but you do not want the data to be erased.
5. To the extent that data processing requires your consent (Article 6, (1)(a) GDPR), you have the right to withdraw your consent. The withdrawal of consent does not affect the lawfulness of any processing prior to such withdrawal.
6. To the extent that data are processed for the purposes of legitimate interests of ESC (Article 6, (1)(f) GDPR), you have the right to object to data processing. Your objection should point to a reason related to your particular situation, as the grounds for such objection.
To execute your rights, write to the ESC’s Data Protection Officer ([email protected]), who will get in touch with you, in order to process your request.
Transfers of personal data
The data we collect are disclosed exclusively to entities which process data on behalf of ESC, to support us in pursuing particular processing goals. These entities are not authorised to process the entrusted data for marketing purposes. We transfer the data:
1. Entities which provide ESC with IT support: the ticket sales service, the newsletter service, the contact form, the email server and the internal ESC network.
2. Entities which provide us with legal support.
3. Entities which provide payment services, e.g. PayU (data needed to process payments).
4. Entities which print printed diplomas and similar papers for ESC (data such as first and last name).
Personal data are freely given
Personal data are provided voluntarily and freely.
ESC processes personal data for specific purposes, which means that if you withhold your data, we will not be able to provide the service, for which we collect the data.
Periods of data storage
We make sure that any personal data are erased as soon as the purpose for which they were collected is achieved, however, we may not erase all of them. The data processed in order to fulfil ESC’s legal obligations shall be stored for the duration provided for in the relevant regulations: for instance, contracts and invoices must be stored for 5 years from the end of the calendar year in which they were produced, and any information, including personal data, needed to pursue business related claims are stored for 3 years.
Automated decision making
Your data are never used in automated decision making, including profiling.
Complaints
If you believe that your personal data were processed by ESC in violation of the law, you have the right to file a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa.
II INFORMATION OF ESC’S CLIENTS
Visiting our website www.experyment.gdynia.pl
You do not need to give your personal data when you visit our website. ESC website collects and, in a limited scope also stores, the following information: data needed for the proper operation of the service (e.g. cookies), analytical data (Google Analytics).
These data do not identify specific individuals and are not linked to any other data collected by ESC. The detailed principles describing how the cookies and the analytical tools work can be found in our cookie files policy: „Cookies policy”.
Buying tickets online
Booking and buying your tickets online is governed by the ticket sales regulations: „Ticket sales regulations at Experyment Science Centre in Gdynia” [PDF, 1 MB]. Tickets may be booked via a website or by phone.
The purpose of data processing: booking and buying tickets, supporting visits to ESC.
The purpose of data processing: booking and buying tickets, supporting visits to ESC.
Postal codes are processed for statistical purposes. This piece of data anonymised before processing. The basis for data processing: Article 6 (1) (b) GDPR – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
The scope of the data: governed by the ticket sales regulations: „Ticket sales regulations at Experyment Science Centre in Gdynia” [PDF, 1 MB].
Erasing data: the data are stored in the system for 3 years from the last login to the account or, for purchases without a login for 3 years from purchase date.
Sales data for VAT invoiced transactions are stored for 6 years from the end of the calendar year in which the sale was done. In matters related to erasing your data from the system or removing the account in the system, please contact the Data Protection Officer: [email protected].
Visiting ESC
When you buy a ticket at the ticket office or when you enter an exhibition, selected ESC employees are entitled to check your documents that confirm your eligibility for concession price (e.g. student ID).
In selected interactive exhibits it is possible to leave your email, so you can be sent photographs or videos created by that exhibit. The addresses are periodically erased and are not subject to any further processing. As part of its statutory activities, ESC puts together photo and video documentation of its activities. The photos and videos (including group photos of ESC visitors and long shots) are also used for advertising. With the explicit consent of the person presented in the picture or video, we may also take and publish photos or videos of individual visitors.
The purpose of data processing: photographic and video documentation of ESC’s activities and advertising campaigns – group and general photos. The basis for data processing: Article 6 (1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the controller, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
The scope of the data: facial image.
The purpose of data processing: photographic and video documentation of ESC’s activities and advertising campaigns – close up photos, a portrait of an individual. The basis for data processing: Article 6 (1) (a) GDPR – consent of the data subject.
The scope of the data: facial image, first and last name (to document the consent).
Erasing data: data are erased at the data subject’s request. Data processed on the basis of consent are erased as soon as consent is withdrawn. In order to have your data erased, or to withdraw consent for processing, please contact the Data Protection Officer: [email protected].
Newsletter
The newsletter is a service in electronic format, where the latest news and developments related to ESC are delivered electronically. If you sign up for the newsletter, you sing a contract for electronic service with ESC. You can terminate the contract at any time by unsubscribing. Given the nature of ESC’s operations, some of the content sent in this way may include promotional or commercial information.
ESC only sends the newsletter to addresses which you submitted in the special form on our website www.experyment.gdynia.pl, or gave directly to ESC employees for the specific purpose of receiving the newsletter. ESC does not send the newsletter to e-mail addresses which you provided for other purposes.
The newsletter service is provided free of charge for an indefinite period of time. The provision of data is voluntary, but necessary for the service to be provided, i.e. for the newsletter to be sent to the indicated e-mail address.
Under the Act on rendering electronic services, sending a newsletter requires stating that the promotional or commercial information included in the newsletter was ordered by you. We assume that by providing your address in the “Subscribe to Newsletter” window you have ordered such information.
The purpose of data processing: sending information about ESC activities at the request of the data subject. The basis for data processing: Article 6 (1) (b) GDPR – processing is necessary for the performance of a contract to which the data subject is party.
The scope of the data: e-mail address.
Erasing data: you may unsubscribe from the newsletter at any time: each newsletter message includes a link for unsubscribing and erasing the e-mail address. Unsubscribing is purported to be a revocation of consent to process personal data and a termination of the contract for the electronic services.
Contact form
Persons who want to get in touch with ESC electronically, may use the form called “Contact us” at www.experyment.gdynia.pl. Sending an inquiry via the form is only possible after the service user gives consent for personal data processing for this particular purpose, and gives his or her e-mail address, to which ESC would respond.
The data acquired via the form are only processed for the purpose of providing answers to questions sent via the form and, if needed, to clarify the circumstances of an event described in the e-mail message.
The purpose of data processing: sending a response to an enquiry from the data subject at the request of the data subject. The basis for data processing: Article 6 (1) (a) GDPR – consent of the data subject.
The scope of the data: the e-mail address and any additional information in the message sent from our website form. Also, should any further e-mails be exchanged, any data included in Your email footer, as added by your mail server.
Erasing data: ESC’s response containing data entered in the contact form and any further e-mail correspondence is stored on ESC’s mail servers. In order to have your data erased, please contact the Data Protection Officer: [email protected].
Experyment Academy
Booking and payments for Experyment Academy classes are governed by the Experyment Academy regulations: „Regulamin Akademii Experymentu” [PDF, 62 KB]. Classes may be booked only via ESC’s website.
The purpose of data processing: booking and arranging participation in Experyment Academy classes and sending out notifications about the next semester. Postal codes are processed for statistical purposes. This piece of data is anonymised before processing. The basis for data processing: Article 6 (1) (b) GDPR – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
The scope of the data: governed by the Experyment Academy regulations: „Regulamin Akademii Experymentu” [PDF, 62 KB].
The purpose of data processing: sending information about the next semester of ExperymentAcademy: pursuing ESC’s statutory tasks. The basis for data processing: Article 6 (1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the controller, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
The scope of the data: e-mail address
Erasing data: the data are processed during the Academy semester to which they pertain. Personal data related to the provision of a service shall be erased on the starting day of the next semester of the Academy. The data processed in order to fulfil ESC’s legal obligations shall be stored for the duration provided for in the relevant regulations. In order to have your data erased, or to have the account in the service removed, please contact the Data Protection Officer: [email protected].
Polish Children’s Academy
Participants enrol by sending e-mails to the following address: [email protected].
The purpose of data processing: enrolment and arranging participation in the Polish Children’s Academy: pursuing ESC’s statutory tasks. The basis for data processing: Article 6 (1) (b) GDPR – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
The scope of the data: group leader’s data (first and last name, phone number and e-mail address) and the number of students to accompany the group leader at the lecture (no more than 50 students per school) and the name of the school.
The purpose of data processing: sending information about the next semester of Polish Children’s Academy: pursuing ESC’s statutory tasks.
The basis for data processing: Article 6 (1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the controller, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
The scope of the data: e-mail address of the group leader.
Erasing data: the data are processed during the semester to which they pertain. Personal data related to the provision of a service shall be erased on the starting day of the next semester of lectures. The data processed in order to fulfil ESC’s legal obligations of ESC shall be stored for the duration provided by the relevant regulations.
In order to have your personal data erased from the booking system, or to have the account in the service removed, please contact the Data Protection Officer: [email protected].
SCIENCE CAFE
The purpose of data processing: booking and participation of SCIENCE CAFE’s workshops. Postal codes are processed for statistical purposes. This piece of data is anonymised before processing.
The basis for data processing: Article 6 (1) (b) GDPR – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Booking and buying tickets can be done both at the ticket office and via ESC’s website: ticket purchases at the ticket office are done without giving personal data; for purchases via website: booking and buying your tickets via ESC’s website is governed by the ticket sales regulations: „Ticket sales regulations in Experyment Science Centre in Gdynia” [PDF, 1 MB].
The scope of the data: as defined in the ticket sales regulations: „Ticket sales regulations in Experyment Science Centre in Gdynia” [PDF, 1 MB].
Erasing data: Personal data related to the provision and arranging of a service shall be erased after the service has been delivered. The data processed in order to fulfil ESC’s legal obligations shall be stored for the duration provided for in the relevant regulations. In order to have your data erased from the booking system, or to have the account in the service removed, please contact the Data Protection Officer: [email protected].
Moreover: surveys handed out at the end of the workshops include a field for e-mail address participants may choose to leave their e-mail address, to receive detailed information of future SCIENCE CAFE workshops or other workshops for adult visitors to ESC.
The purpose of data processing: sending information about workshops for adults to those who give relevant consent. The basis for data processing: Article 6 (1) (a) GDPR – consent of the data subject.
The scope of the data: e-mail address.
Withdrawing consent/erasing data: it is possible to withdraw consent for data processing at any time: all it takes is to send a reply which says “no” to the address from which the message was sent, or write to [email protected]. Withdrawing consent for data processing will result in removing any data from ESC’s records, which were processed based on your consent.
Event for senior citizens
Experyment Science Centre in Gdynia organizes events for senior citizens and works with other organizations (such as universities and associations) which organize such activities as part of their statutory tasks.
Booking and buying tickets to events for senior citizens can be done both at the ticket office and via ESC’s website: Ticket purchases at the ticket office are done without giving personal data. For purchases done via ESC’s website, booking and payment for workshops for senior citizens are governed by the ticket sales regulations „Ticket sales regulations at Experyment Science Centre in Gdynia” [PDF, 1 MB], which also sets out the scope of data collected.
The purpose of personal data processing: booking and participation of senior citizens in workshops. The basis for data processing: Article 6 (1) (b) GDPR – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
The scope of the data: first and last name, e-mail address.
Postal codes are processed for statistical purposes. This piece of data is anonymised before processing.
Erasing data: the data are processed during the semester to which they pertain. Personal data related to the service shall be erased after the service has been delivered. The data processed in order to fulfil ESC’s legal obligations shall be stored for the duration provided for in the relevant regulations. In order to have your data erased from the booking system, or to have the account in the service removed, please contact the Data Protection Officer: [email protected].
Moreover: you may leave your phone number to will receive text messages about future workshops for senior citizens.
The purpose of data processing: contacting persons who gave consent, in order to provide information about future workshops.
The basis for data processing: Article 6 (1) (a) GDPR – consent of the data subject. The scope of the data: phone number.
Withdrawing consent/erasing data: it is possible to withdraw consent for data processing at any time: just send a text message which says “no” to the number from which the message was sent, or write to [email protected]. Withdrawing consent for data processing will result in removing any data from ESC’s records, which were processed based on your consent.
Special workshops at ESC
Persons who would like to organize special workshops at ESC make their bookings over the phone. An ESC employee will ask for data which are necessary for booking, making payments and organizing workshops. At each stage of data collection, persons making a booking will be fully informed about the purpose of data processing, their rights, the planned processing operations and expected period after which data are erased. In addition, the e-mails sent as part of the service include a link to the website www.experyment.gdynia.pl and this policy.
The purpose of data processing: organizing special workshops.
The basis for data processing: Article 6 (1) (b) GDPR – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
The scope of the data: personal data of the person making the booking (first and last name, phone number, e-mail address), and data related to the provision of service (name of the birthday person, age). Postal codes and address are processed for statistical purposes. The data are anonymised before processing.
Erasing data: the filled in booking forms or their parts are stored for a period needed to provide the service, pay for services and determine and defend claims of both parties, i.e. for 3 years. Data related to payments are stored for 5 years. In order to have your data erased, please contact the Data Protection Officer: [email protected].
Other events and workshops
Persons who would like to participate in the events and workshops organized by ESC, make bookings directly via www.experyment.gdynia.pl or through a link to an order form on that page. For any data entered directly via our website www.experyment.gdynia.pl, ESC become personal data controller as of the moment the data are entered and confirmed. If the data are entered via another website, ESC becomes data controller when such data are transferred by the entity in charge of the given website. ESC collaborates in the area of electronic bookings with entities which guarantee the security of the collected and transferred data and fulfil their obligations under the personal data protection regulations.
The purpose of data processing: booking a place at an event. Postal codes and address of residence are processed for statistical purposes. The data are anonymised before processing.
The basis for data processing: Article 6 (1) (b) GDPR – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
The scope of the data: paid events are governed by the ticket sales regulations: „Ticket sales regulations at Experyment Science Centre in Gdynia” [PDF, 1 MB]. For events that are free of charge: first and last name, e-mail address.
Erasing data: In order to have your data erased, please contact the Data Protection Officer: [email protected].
III INFORMATION FOR PERSONS COLLABORATING WITH ESC
Teachers and school representatives
ESC pursues its statutory tasks in close cooperation with school representatives and teachers, working together on special projects and events and staying in touch about our educational offering. Moreover, school representatives who give consent receive ESC’s newsletter.
Each time, at each stage of data collection, ESC provides each data subject with the full information package about the purpose of data processing, their rights, the planned processing operations and expected period after which data are erased.
The purpose of data processing: involving teachers in events and projects.
The basis for data processing: Article 6 (1) (b) GDPR – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
The purpose of data processing: building a database of contacts with school representatives.
The basis for data processing: Article 6 (1) (a) GDPR – consent of the data subject.
The purpose of data processing: providing information about our offering for teachers: ESC’s statutory activities.
The basis for data processing: Article 6 (1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the controller, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Erasing data: in order to have your data erased, please contact the Data Protection Officer: [email protected].
Project participants
Experyment Science Centre organizes and co-organizes numerous scientific and cultural projects. Persons who would like to participate in a project, if the participation involves personal data processing by ESC, are provided at each stage of data collection with the full information package about the purpose of data processing, their rights, the planned processing operations and expected period after which data are erased.
The data collected during projects may be transferred to project organizers as set out in project regulations. Persons whose data is collected are each time notified prior to data collection about possible future data transfer.
The purpose of data processing: participation in projects organised or co-organized by ESC.
The basis for data processing: Article 6 (1) (b) GDPR – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Erasing data: in order to have your data erased, please contact the Data Protection Officer: [email protected].
Persons who work with ESC under civil-law contracts
ESC protects the natural persons’ data that are processed under civil-law agreements or public procurement contracts performed by ESC.
Natural persons who work with ESC under civil-law agreements (e.g. contract of mandate, contract to perform a specific task, voluntary work agreement), each time at the stage of data collection are provided with the full information package about the purpose of data processing, their rights, the planned processing operations and expected period after which data are erased.
The purpose of data processing: concluding and performing contracts.
The basis for data processing: Article 6 (1) (b) GDPR – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
The purpose of data processing: meeting ESC’s legal obligations.
The basis for data processing: Article 6 (1) (c) GDPR – processing is necessary for the performance of a contract to which the data subject is party.
Erasing data: personal data shall be stored for the duration necessary for ESC to fulfil the legal obligations that follow from signing the contracts.