EN-Polityka Prywatności / Rodo - CUMA Szkolne Schronisko Młodzieżowe

PRIVACY POLICY / GDPR

INFORMATION OBLIGATION UNDER ARTICLE 13(1) AND (2) AND ARTICLE 14 GDPR

Information about the Data Protection Officer

The Data Protection Officer at the School Youth Hostel CUMA in Szczecin is Agnieszka Marciniak, and the deputy Data Protection Officer is Rafał Malujda. They can be contacted by email at iod@spnt.pl or by phone at +48 91 85 22 093.

Information Clause for Children/Youth and Parents – Implementation of Tasks as an Educational and Welfare Institution

The data controller for the personal data of children, youth, and parents/legal guardians is the School Youth Hostel “CUMA.” You can contact the Administrator by mail at: ul. Monte Cassino 19a, 70-467 Szczecin, by email at: ssm@miasto.szczecin.pl, or by phone at: 91-422-4761.

The Data Protection Officer and the Deputy Data Protection Officer can be contacted by email at iod@spnt.pl or by phone at +48 91 85 22 093.

Personal data is processed for the purpose of fulfilling the tasks as an educational and welfare institution by providing affordable accommodation for children and youth and ensuring care and education for children and youth staying in the hostel. This processing is based on Article 6(1)(c) and Article 9(2)(g) of the GDPR, i.e., for the execution of a legal obligation imposed by Articles 145, 149, and 150 of the Act of December 14, 2016, the Education Law, and § 7 of the Regulation of the Minister of National Education of August 11, 2017, on public educational and welfare institutions, youth correctional centers, youth social therapy centers, special educational and welfare centers, special correctional centers, revalidation-educational centers, and institutions providing care and education to students during their studies outside their permanent place of residence.

Recipients of personal data include authorized employees of the Administrator, entities to whom personal data must be provided under legal provisions, as well as those to whom data will be entrusted to fulfill the processing purposes.

Personal data will be processed for the period necessary to achieve the above purpose, taking into account the retention periods defined in separate regulations, including archival regulations.

You have the right to request access to your personal data from the Administrator, to rectify, delete, or restrict the processing of your data, as well as the right to data portability.

You have the right to lodge a complaint with the supervisory authority, which is the President of the Personal Data Protection Office, if you believe that the processing of your personal data by the Administrator violates personal data protection regulations.

Providing personal data is voluntary. However, to use the accommodation and ensure care and education for children and youth staying at the hostel, you are required to provide the data. Failure to provide data will result in the refusal of accommodation and care services.

Information Clause for Individuals Using Accommodation

The data controller for the personal data of individuals using the accommodation is the School Youth Hostel “CUMA.” You can contact the Administrator by mail at: ul. Monte Cassino 19a, 70-467 Szczecin, by email at: ssm@miasto.szczecin.pl, or by phone at: 91-422-4761.

The Data Protection Officer and the Deputy Data Protection Officer can be contacted by email at iod@spnt.pl or by phone at +48 91 85 22 093.

Personal data is processed for the purpose of fulfilling the tasks as an educational and welfare institution in the scope of providing accommodation based on:
a) Article 6(1)(c) in connection with Articles 145, 149, and 150 of the Act of December 14, 2016, the Education Law, and § 7 of the Regulation of the Minister of National Education of August 11, 2017, on public educational and welfare institutions, youth correctional centers, youth social therapy centers, special educational and welfare centers, special correctional centers, revalidation-educational centers, and institutions providing care and education to students during their studies outside their permanent place of residence,
b) Article 6(1)(f) of the GDPR, i.e., processing is necessary for the purposes of legitimate interests pursued by the institution, including maintaining a registry of individuals using the accommodation, maintaining registration and financial documentation, collecting fees for services, and issuing invoices.

The legitimate interests pursued by the Administrator in connection with the processing of data are ensuring the safety of individuals using the accommodation.

Recipients of personal data include authorized employees of the Administrator, entities to which personal data must be provided in order to fulfill a legal obligation, and entities to whom data will be entrusted to carry out the processing purposes.

Your personal data will be stored for the duration of the contract or until the mutual claims arising from the concluded agreement expire.

You have the right to request access to your personal data, its rectification, deletion, or restriction of processing, the right to object to the processing, and the right to data portability.

You have the right to file a complaint with the supervisory authority, which is the President of the Personal Data Protection Office, if you believe that the processing of your personal data by the Administrator violates personal data protection regulations.

Providing personal data is voluntary but necessary for the conclusion and performance of the contract. Refusal to provide data may result in the inability to conclude and perform the contract.

Information Clause for Job Applicants

The administrator of your personal data is the School Youth Hostel “CUMA.” You can contact the administrator by mail at: ul. Monte Cassino 19 a, 70-467 Szczecin, by email at: ssm@miasto.szczecin.pl, or by phone at: 91-422-4761.

You can contact the data protection officer and the deputy data protection officer by email at: iod@spnt.pl or by phone at: +48 91 85 22 093.

Your personal data will be processed for the purpose of conducting recruitment for a position at Primary School No. 5 in Szczecin, based on: a) Article 6(1)(c) of the GDPR, i.e., when processing is necessary to fulfill a legal obligation imposed on the institution, including obligations arising from Article 221 § 1 and 4 of the Labor Code; b) In the case of the exercise of rights arising from the execution of a task carried out in the public interest – Article 6(1)(e) of the GDPR; c) Article 6(1)(a) of the GDPR, i.e., based on consent given for the purposes specified in the consent forms provided; d) Article 6(1)(b) of the GDPR – actions taken at the request of the data subject prior to the conclusion of the contract.

The recipients of the data are authorized employees of the administrator, entities to which personal data must be provided in order to fulfill a legal obligation, and entities to whom the data will be entrusted for the purposes of processing.

Your personal data will be stored until the end of the recruitment process, unless you consent to their processing for further recruitment purposes – in which case, the data will be deleted after one year.

You have the right to request access to your personal data, their rectification, deletion, or restriction of processing, as well as the right to data portability.

In the case of data processed based on consent, you have the right to withdraw your consent at any time without affecting the lawfulness of the processing carried out based on consent prior to its withdrawal.

Providing personal data is voluntary, but in order to participate in the recruitment process, you are required to provide your data. Failure to provide the data will result in a refusal to participate in the recruitment process.

Information Clause for Employees

You can contact the data protection officer and the deputy data protection officer by email at: iod@spnt.pl or by phone at: +48 91 85 22 093.

Your personal data will be processed for the purpose of establishing an employment relationship, keeping employee records in accordance with the Labor Code, reporting employees and their family members to ZUS, updating them, providing information about dismissals, conducting settlements with employees, and fulfilling other employment benefits, calculating deductions, and determining ZUS contributions, based on: a) Article 6(1)(c) and Article 9(2)(b) of the GDPR, i.e., when processing is necessary to fulfill a legal obligation imposed on the institution and processing is necessary to fulfill obligations and exercise special rights by the administrator or the data subject in the fields of labor law, social security, and social protection, including obligations imposed by Articles 221 § 1, 2, and 4 in conjunction with Article 94(9a) and (9b) of the Labor Code, Article 6 and 6a of the Act of October 13, 1998, on the Social Security System, Article 6(1)(a) of the GDPR, i.e., based on consent given for the purposes specified in the consent forms provided; b) Article 6(1)(b) of the GDPR – processing is necessary for the performance of a contract to which the data subject is a party; c) Article 6(1)(e) of the GDPR in conjunction with Article 94(91) and (9b) of the Labor Code – when exercising rights arising from the execution of a task carried out in the public interest.

Your personal data will be stored for 50 years from the cessation of employment or 10 years from the end of the calendar year in which you terminate employment, if employed after December 31, 2018, or if an informational report has been submitted, as referred to in Article 4(6a) of the Act of October 13, 1998, on the Social Security System.

You have the right to request access to your personal data, their rectification, deletion, or restriction of processing, as well as the right to data portability.

Providing personal data is a legal requirement – you are obligated to provide the data. Failure to provide the data will result in a refusal to establish an employment relationship.

Information Clause for Individuals in the Monitoring Area

MONITORED FACILITY

The administrator of your personal data is the School Youth Hostel “CUMA”. You can contact the administrator by mail at: ul. Monte Cassino 19 a, 70-467 Szczecin, by email at: ptsm@home.pl, or by phone at: 91-422-47-61.

You can contact the data protection officer and the deputy data protection officer by email at: iod@spnt.pl or by phone at: +48 91 85 22 093.

Personal data is processed for the purpose of ensuring safety and order at the facility, based on Article 6(1)(e) of the GDPR and Article 108a of the Act of December 14, 2016 – Education Law, in connection with Article 68(1)(6).

The recipients of the data are authorized employees of the Administrator, entities to whom personal data must be disclosed in order to fulfill a legal obligation, and entities to whom data will be entrusted to achieve the processing purposes.

Personal data collected through monitoring will be stored for up to 3 months from the date of recording.

You have the right to request access to your personal data, its rectification (limited scope), its erasure, or restriction of processing, as well as the right to object to the processing of your data.

Providing personal data is mandatory. Failure to provide data will result in refusal of entry to the facility.

Regulations for the Disclosure of Personal Data from Video Surveillance

The purpose of video surveillance in the School Youth Hostel “CUMA” is to ensure safety and order at the facility. Video surveillance aims to increase the safety of students/residents, employees, and other individuals present on the premises, as well as the property located there. Another reason for using surveillance is to monitor individuals entering the facility. Recorded video footage can often serve as evidence of an incident, conflict, or violation of the law (hereinafter referred to as “incident”) at the facility.

In view of the protection of personal data, the following procedures should be followed when requesting access to video recordings:

Requests for access to video footage may be made by:

Participants in the incident or their representatives (e.g., parents/legal guardians),
Law enforcement authorities (e.g., Police, Municipal Guard, Prosecutor’s Office), and other public authorities.

If the requester is a participant in the incident or their representative:

The facility’s management will independently verify the video footage and, without disclosing the footage to the requester, will attempt to resolve the issue (through individual discussions with the participants in the incident).

If the request is maintained, the management, after consultations with the DPO Team (whose representative should view the footage), will invite the requester and the individuals or their legal representatives whose images are identified in the footage for a meeting to view the footage at the facility (without the possibility of recording the footage) – unless viewing the footage by individuals not directly involved in the incident could significantly infringe or threaten the personal rights of those directly involved. Additionally, the facility will minimize the scope of the footage viewed, and where possible, only selected “still frames” will be shown. The condition for allowing access to the footage is verification by the management and the DPO Team to confirm that the requester has a legitimate interest in exercising this right.

Access to the footage for VIEWING cannot lead to the issuance of a COPY of the footage or allow the viewer to RECORD the footage during the viewing.

If the requester is a law enforcement authority or another public body:

The facility is required to make the video footage available for review by law enforcement authorities or other public authorities. The footage will be provided only upon a WRITTEN REQUEST from the authority.

If law enforcement authorities request the footage, the facility management will refuse to grant access to the footage to individual requesters (e.g., parents) only when the authorities, in writing (via letter or email), instruct the management not to disclose the footage, which the facility management will always verify with these authorities (services).

Each request for access to surveillance footage will be considered on an individual basis.

In matters not regulated above, the facility’s management will decide.

These regulations come into force on June 30, 2020.

Information Clause for Contractors

The administrator of your personal data is the School Youth Hostel “CUMA”. You can contact the administrator by mail at: ul. Monte Cassino 19 a, 70-467 Szczecin, by email at: ssm@miasto.szczecin.pl, or by phone at: 91-422-4761.

You can contact the data protection officer and the deputy data protection officer by email at: iod@spnt.pl or by phone at: +48 91 85 22 093.

Personal data is processed based on:

Article 6(1)(b) of the GDPR for the purpose of concluding and performing contracts;
Article 6(1)(c) of the GDPR to fulfill a legal obligation under the Public Procurement Law of September 11, 2019, the Real Estate Management Act of August 21, 1997, Presidential Decree No. 657/20 of December 28, 2020, regarding public procurement procedures, and the Szczecin City Council’s Tender Committee Work Regulations.

Your personal data will be stored for the duration of the contract or until the expiration of mutual claims arising from the concluded contract.

You have the right to request access to your personal data, rectification, erasure, or restriction of processing.

Providing personal data is voluntary but necessary to conclude and perform the contract. Refusal to provide data may result in the inability to conclude and perform the contract.

Information Clause for Individuals Using the Employee Social Benefits Fund

You can contact the data protection officer and the deputy data protection officer by email at: iod@spnt.pl or by phone at: +48 91 85 22 093.

Your personal data is processed for purposes related to:

The operation of the Employee Social Benefits Fund, including the realization of social benefits entitled to you, based on Article 6(1)(c) and Article 9(2)(b) of the GDPR, in relation to the legal obligation imposed on the Administrator by Article 3(2) and 8 of the Social Benefits Fund Act of March 4, 1994, and Article 53(2) of the Teacher’s Charter Act of January 26, 1982;
The operation of the program under which funds have been earmarked for healthcare assistance to teachers, based on Article 6(1)(c) and Article 9(2)(b) of the GDPR, in connection with Article 72 of the Teacher’s Charter Act of January 26, 1982.

The recipients of personal data are authorized employees of the Administrator, entities to whom personal data must be disclosed under the law, and those to whom data will be entrusted to achieve the processing purposes.

Your personal data will be stored for no longer than necessary to: 3) Realize your social benefits from the Social Benefits Fund and until the expiration of related rights or claims. After this period, personal data will be stored for archival purposes for the period determined by law; 4) Pay the awarded benefit and until the expiration of related rights or claims. After this period, personal data will be stored for archival purposes for the period determined by law.

You have the right to request access to your personal data, rectification, erasure, or restriction of processing, as well as the right to data portability.

Providing personal data is voluntary, but necessary to access social benefits funded by the Social Benefits Fund and/or healthcare assistance for teachers. Refusal to provide data will result in the inability to receive a benefit from the Social Benefits Fund and/or healthcare assistance for teachers.

INFORMATION OBLIGATION – Facebook Fanpage

The following information clause is dedicated to individuals visiting the Facebook fanpage of the “CUMA” School Youth Hostel, particularly those who: have subscribed to the fanpage by clicking the “Like” or “Follow” icon, or who have published a comment under any post posted on the fanpage.

The administrator of your personal data, posted on this profile (fanpage), is the School Youth Hostel “CUMA”. Personal data is processed in accordance with the provisions of personal data protection law, including Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”) and Polish regulations related to the GDPR, including the Act of May 10, 2018, on the protection of personal data. The Administrator ensures confidentiality and protects personal data against unauthorized access by third parties in accordance with the above-mentioned legal acts.

You can contact the administrator via email at: ptsm@home.pl

You can contact the data protection officer and the deputy officer appointed by the Administrator via email at: iod@spnt.pl and by phone at: +48 91 85 22 093.

The processing of your personal data in connection with the functioning of the fanpage includes:

Data identifying your profile (usually containing your first and last name);
Profile pictures;
Other pictures, particularly related to the current activities of the Administrator;
The content of your comments and the content of conversations conducted via the Messenger application, as referred to in point 6.

Your personal data is processed on the basis of Article 6(1)(a) of the GDPR, i.e., based on the consent you have given when entering the fanpage, and may also be processed based on consent given by you on a separate form.

The purpose of processing your data is to run the fanpage […] on the Facebook social media platform, under the terms and conditions set by Facebook Inc., and to inform you about our activities, promote various events we organize and participate in, including promoting the achievements and skills of our students/participants, and to facilitate communication via the available functionalities of Facebook (comments, chat, messages).

The recipients of your personal data are, in particular: the person representing the Administrator, authorized employees of the Administrator, entities to whom personal data must be disclosed based on legal provisions, as well as those to whom data will be entrusted to carry out the processing purposes. The recipient of your data is also the owner of the social media platform Facebook (Facebook Inc., headquartered in Menlo Park, 94025, California, 1601 Willow Road) under the unchangeable rules regarding data, available at (https://www.facebook.com/about/privacy).

Personal data collected through communication with you will be processed only to the extent necessary to provide a response, if needed.

Your data, which we possess in private messages, is stored until you object to the further processing of such data or until you delete your profile on Facebook. Regarding information we have from the comments you provided, they are available on our fanpage until deleted by the author.

The personal data collected by Facebook, such as post history, activity history in the Messenger app, activity history via the Instagram app, are subject to retention under the rules specified in Facebook’s terms and conditions, available at (https://pl-pl.facebook.com/legal/terms).

You have the following rights:

The right to access your personal data, including obtaining backup copies;
The right to rectify personal data;
The right to delete or restrict the processing of data posted on the fanpage;
The right to transfer your data;
The right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Furthermore, you may file a complaint with the supervisory authority, which is the President of the Personal Data Protection Office, if you believe that the processing of your personal data by the administrator violates the provisions of personal data protection.

Your personal data is not subject to profiling.

Providing data is voluntary, but failing to provide data will result in the inability to view the fanpage or leave comments.