Pursuant to Article 13 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), Adam Mickiewicz University in Poznań informs you that:
The controller of your personal data is Adam Mickiewicz University in Poznań with its seat at H. Wieniawskiego 1 Street, 61-712 Poznań.
2. Data Protection Officer
The controller appointed the Data Protection Officer - e-mail contact firstname.lastname@example.org. The DPO can be contacted in matters concerning the processing of your personal data by AMU and the exercise of your rights in relation to the processing of your personal data. The DPO does not provide information regarding the recruitment process, studies, etc.
3. Purpose and legal basis of processing
Your personal data will be processed:
1) for the purpose of conducting the recruitment process pursuant to Article 6(1)(c) GDPR, i.e. within the scope of the legal obligation incumbent on the Controller in connection with the performance of tasks set out in the Act of 20 July 2018. Law on Higher Education and Science (Journal of Laws of 2020, item 85, as amended) and executive acts issued on its basis;
2) for the purposes of fulfilling the legal obligations incumbent on the Controller (implementation of the educational process, documentation of the course of study, review of scientific achievements in proceedings for the award of the doctoral degree, social support, participation in academic organizations, participation in academic student exchange programmes, archiving and statistical purposes) in connection with the implementation of the tasks set out in the Act of 20 July 2018. Law on Higher Education and Science (Journal of Laws of 2020, item 85, as amended) and executive acts issued on its basis - pursuant to Article 6(1)(c) GDPR;
3) for purposes arising from accounting and tax regulations - pursuant to Article 6(1)(c) GDPR;
4) for the purpose of performing a contract or taking action at the request of a person prior to entering into a contract - pursuant to Article 6(1)(b) GDPR;
5) in order to establish, investigate and defend against mutual claims - pursuant to Article 6(1)(f) GDPR, i.e. the legitimate interest of the Controller;
6) in order to ensure and enhance the safety of members of the academic community residing on the premises of Adam Mickiewicz University in Poznań through the use of video surveillance, as well as to ensure access to the university's email and dedicated IT infrastructure of the university, in connection with the performance of a task carried out in the public interest, pursuant to Article 6(1)(e) GDPR in connection with Article 50 of the Act on Higher Education and Science;
7) for purposes other than the above, personal data will be processed on the basis of your consent, for the purpose and to the extent specified therein, pursuant to Article 6(1)(a) GDPR, and in the case of special categories of personal data, pursuant to Article 9(2)(a) GDPR.
4. Data retention period
Your personal data will be processed:
1) in the case of candidates who have been admitted - for the entire period of the implementation of the educational process, and then they will be archived and stored for 50 years;
2) in the case of candidates who have not been accepted - for the duration of the recruitment process, and after its completion for a period of 6 months or period of 1 year for the postgraduate studies;
3) for the period resulting from accounting and tax regulations;
4) for the duration of the contract, as well as until the end of the period during which the Controller is obliged to prove the fulfilment of obligations related to the conclusion and performance of the contract specified by generally applicable laws;
5) in the case of the occurrence of mutual claims, for the duration of the proceedings, and thereafter for the period and to the extent required by generally applicable law;
6) in the form of an electronically recorded image from video surveillance, for a period no longer than 3 months from the date of recording. In the case where the image recordings constitute evidence in a proceeding conducted in accordance with the provisions of law or where AMU becomes aware that the image recordings may constitute evidence in a proceeding, the storage period may be extended until the proceeding is legally concluded;
7) in the case of consent, for the period necessary to fulfil the purpose for which the data were collected or until the earlier of withdrawal of consent to personal data processing/objection to processing.
5. Data recipients
Access to your personal data will be provided to authorized employees and associates of the Controller, including members of the recruitment committees, who process your personal data as part of their duties and tasks.
The recipients of your personal data may be entities to whom the Controller subcontracts the performance of specific activities which require the processing of personal data (processors), in particular IT system operators, e-mail system operators, law firms, accounting and auditing entities.
Your personal data may also be made available to entities authorised by law, as well as to other universities in connection with participation in academic student exchange programmes (e.g. Erasmus+, MOST).
6. Transferring data outside the European Economic Area (EEA)
In the case of correspondence via university email, your personal data may be processed by our email provider Google in its data processing centres. Your personal data will be protected based on standard contractual clauses. This will ensure an adequate level of security.
Your personal data may be transferred to partner universities based outside the EEA when you wish to pursue a course of study there as part of academic exchange programmes.
7. Rights related to data processing
1) the right of access to your personal data, including the right to obtain a copy of that data shall be within the grounds and under the conditions set out in Article 15 GDPR,
2) the right to demand the rectification (amendment) of personal data shall be granted under the prerequisites and conditions specified in Article 16 GDPR,
3) the right to erasure of data - shall be exercised under the prerequisites and conditions set out in Article 17 GDPR,
4) the right to restrict processing - shall be exercised under the grounds and conditions set out in Article 18 GDPR,
5) the right to object to the processing - shall be exercised under the grounds and conditions set out in Article 21 GDPR,
6) the right to personal data portability - shall be exercised under the grounds and conditions set out in Article 20 GDPR,
7) the right to lodge a complaint to the supervisory authority (President of the Office for Personal Data Protection),
8) the right to withdraw consent to the processing of personal data (in relation to personal data which are processed pursuant to your consent - you have the right to withdraw your consent to the processing of personal data at any time. The withdrawal of consent does not affect the lawfulness of processing, which was carried out pursuant to consent before its withdrawal. Withdrawal of consent may be made in the same form as the consent was given).
8. Obligation to provide data and consequences of failure to do so
Provision of personal data required by law is mandatory, follows from the Act, executive acts / university regulations and is necessary to fulfil the purpose for which they were collected. Refusal to provide the required data will make it impossible to fulfil the purposes for which the data were collected. Providing personal data collected pursuant to consent is voluntary and does not affect the fulfilment of the purposes for which the processing is carried out pursuant to the law.
9. Profiling and automated decision-making
With regard to your personal data, decisions will not be taken by automated means and will not be subject to profiling, pursuant to Article 22 GDPR.