Information clause
Pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) Adam Mickiewicz University in Poznań informs as follows:
1. Controller
The Controller of your personal data is Adam Mickiewicz University (AMU) in Poznań with its registered office at ul. H. Wieniawskiego 1, 61-712 Poznań.
2. Data Protection Officer
The Controller has appointed a Data Protection Officer (DPO) – e-mail contact: iod@amu.edu.pl . The DPO can be contacted about matters relating to the processing of your personal data by AMU and the exercise of your rights in relation to the processing of your personal data. The Data Protection Officer does not provide information regarding the university admissions process, processing the courses, etc.
3. Purpose and legal basis of processing
Your personal data will be processed:
1) for the purpose of conducting the university admissions process pursuant to Article 6(1)(c) of GDPR, i.e. in terms of the legal obligation of the Controller in connection with the performance of tasks set out in the Act of 20 July 2018 – Law on Higher Education and Science (Dz.U. [Polish Official Journal of Laws] of 2022, item 574, consolidated text, as amended) and executive acts issued on its basis;
2) in case of admission for the purposes of performance of the Controller’s legal obligations (performance of the educational process, documenting the course of study, social support, participation in student organizations, participation in student exchange programmes, archiving and statistical purposes) in connection with the performance of tasks set out in the Act of 20 July 2018 – Law on Higher Education and Science (Dz.U. of 2022, item 574, consolidated text, as amended) and executive acts issued on its basis – pursuant to Article 6(1)(c) of GDPR;
3) for purposes arising from bookkeeping, tax and accounting regulations – pursuant to Article 6(1)(c) of GDPR;
4) for the purpose of performance of an agreement or taking action at the request of a person prior to the conclusion of an agreement to which the student is a party – pursuant to Article 6(1)(b) of GDPR;
5) for the purpose of establishing, seeking and defending against counterclaims – pursuant to Article 6(1)(f) of GDPR, i.e. the legitimate interest of the Controller;
6) for the purpose of ensuring and enhancing the safety of members of the university community staying on the premises of Adam Mickiewicz University in Poznań through the use of video surveillance, as well as providing access to the university’s electronic mail and dedicated IT infrastructure of the university, in connection with the performance of a task carried out in the public interest pursuant to Article 6(1)(e) of GDPR in conjunction with Article 50 of the Act of 20 July 2018 – Law on Higher Education and Science;
7) for the purpose of running its own graduate career monitoring programme, pursuant to Article 6(1)(e) of GDPR in conjunction with Article 352(14), (15), (16) of the Act of 20 July 2018 – Law on Higher Education and Science;
8) for purposes other than the ones stated above, personal data will be processed on the basis of your consent, for the purpose and to the extent specified therein, pursuant to Article 6(1)(a) of GDPR, and in the case of special categories of personal data, pursuant to Article 9(2)(a) of GDPR.
4. Period for which the personal data will be stored
Your personal data will be processed:
1) in the case of successful candidates, for the duration of the entire educational process, and the data will then be archived and stored for 50 years;
2) in the case of unsuccessful candidates, for the duration of the admission process and after its completion for a period of 6 months;
3) for the period resulting from bookkeeping, tax and accounting regulations;
4) for the duration of an agreement, as well as until the end of the period during which the Controller is required to demonstrate compliance with the obligations associated with the conclusion and performance of the agreement laid down in generally applicable provisions of law;
5) in the event of counterclaims, for the duration of the proceedings, and thereafter for the period and to the extent required by generally applicable provisions of law;
6) in the form of electronically recorded video surveillance images, for a period of no more than 3 months from the date of recording. If the video recordings constitute evidence in a proceeding carried out under the provisions of law, or if AMU becomes aware that they may constitute evidence in any proceedings, the storage period may be extended until the proceedings are final and non-appealable;
7) in connection with the student’s participation in the alumni career monitoring programme, for a period not exceeding 10 years from the graduation date;
8) in the case of granting consent, for the period necessary until the purpose for which the data were collected is fulfilled or until the consent to the processing of the personal data is withdrawn / the processing is objected to, whichever event occurs first.
5. Recipients of the personal data
Access to your personal data will be granted to authorized employees and associates of the Controller, including members of admission committees, who process your personal data as part of their professional duties and tasks.
The recipients of your personal data may be entities that the Controller orders to carry out certain activities which require the processing of personal data (data processors), in particular IT system operators, e-mail system operators, law firms, accounting and auditing entities.
Your personal data may also be made available to entities authorized by the provisions of law, as well as to other universities in connection with the participation in student exchange programmes (e.g. Erasmus+, MOST). If you participate in a student internship programme, your personal data may be transferred to the entity that is responsible for completing the internship programme.
6. Transfer of data outside the European Economic Area (EEA)
In the case of sending correspondence via student e-mail, your personal data may be processed by our e-mail provider Google at its processing hubs. Your personal data will be protected under standard contractual clauses. This will guarantee an appropriate security level.
Your personal data may be transferred to partner universities based outside the EEA when you wish to pursue a given course of study there as part of student exchange programmes.
7. Rights related to data processing
1) the right of access to personal data, including the right to obtain a copy of such data, is granted under the grounds and under the terms and conditions set out in Article 15 of GDPR,
2) the right to request rectification (amendment) of personal data is granted under the grounds and under the terms and conditions set out in Article 16 of GDPR,
3) the right to erasure is granted under the grounds and under the terms and conditions set out in Article 17 of GDPR,
4) the right to restriction of processing is granted under the grounds and under the terms and conditions set out in Article 18 of GDPR,
5) the right to object to processing is granted under the grounds and under the terms and conditions set out in Article 21 of GDPR,
6) the right to data portability is granted under the grounds and under the terms and conditions set out in Article 20 of GDPR,
7) the right to lodge a complaint with the supervisory authority (President of the Personal Data Protection Office),
8) the right to withdraw your consent to the processing of personal data (in relation to personal data which are processed on the basis of your consent – you have the right to withdraw your consent to the processing of personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent granted before its withdrawal. Withdrawal of consent may be made in the same form in which the consent was granted).
8. Obligation to provide data and consequences of failure to do so
The provision of personal data required by the provisions of law is mandatory, follows from the act, regulatory acts / university regulations and is necessary to fulfil the purpose for which the data were collected. Refusal to provide the requested data will prevent the fulfilment of purposes for which the data were collected. Providing personal data collected on the basis of consent is voluntary and does not affect the purposes for which processing is carried out under the provisions of law.
9. Profiling and automated decision-making
With regard to your personal data, decisions will not be made by automated means and the data will not be subject to profiling, pursuant to Article 22 of GDPR.
