Information on processing of personal data
1. Controller
The controller of personal data is SGH Warsaw School of Economics with its seat in Warsaw, al. Niepodległości 162, hereinafter referred to as SGH.
2. Data Protection Officer
You may contact the Data Protection Officer designated by SGH via e-mail iod@sgh.waw.pl.
3. The purposes of processing of personal data
Personal data will be processed for the purposes of taking part in a mobility programme.
4. The legal basis of processing of personal data
The legal basis for processing of personal data is as follows:
- Point (b) of Art. 6 (1) GDPR1 (processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract – if a contract is concluded);
- Point (e) of Art. 6 (1) GDPR (processing is necessary for the performance of a task carried out in the public interest - enabling participation in the mobility programme) in relation to the Act of 20 July 2018 – Law on Higher Education and Science2;
- Point (c) of Art. 6 (1) GDPR (processing is necessary for compliance with a legal obligation to which the controller is subject - keeping the study record) in relation to the Act of 20 July 2018 – Law on Higher Education and Science;
- Point (c) of Art. 6 (1) GDPR (necessity for compliance with a legal obligation to report for statistical purposes) in relation to the provisions of The Act of 29 June 1995 on public statistics3 and The Act of 20 July 2018 – Law on Higher Education and Science.
5. The period for which the personal data will be processed
Personal data will be processed during the course of studies, and then will be archived and stored for 50 years.
6. The recipients or categories of recipients of the personal data
Personal data will be disclosed to your home institution (personal data concerning the studying process e.g. information about passed subjects and grades) and institutions financing the participation in the programme for purposes related to project settlement, expenditure control and evaluation, on the terms set out in the regulations of the programme and in agreement.
If the controller uses the services of other entities, personal data may be disclosed to them on the basis of contracts entrusting the processing of personal data, and these entities will be obliged to preserve the confidentiality of the data being processed.
The recipients of the data are the minister competent for higher education and science and the Central Statistical Office.
7. Obligation to provide personal data and consequences of failure to provide such data
Processing of personal data is necessary for taking part in a mobility programme and entering into a contract - if a contract is concluded. Failure to provide personal data will render it impossible to take part in a mobility programme.
8. The categories of personal data concerned and the source of personal data originate
Your personal data (name, surname, e-mail address, home institution, sex, mobility programme, level of studies) were provided by your home institution to confirm your application.
9. Transfer of personal data to third countries
SGH will provide to your home institution your personal data concerning the studying process (e.g. information about passed subjects and grades).
In case of students, whose home institutions have their seat in Argentina, Israel, Japan, New Zealand, Uruguay, Switzerland, South Korea or United Kingdom, transfer of personal data is based on Art. 45 (1) GDPR (European Commission’s decisions on the adequate protection of personal data).
In case of students, whose home institutions have their seat in Australia, Armenia, Azerbaijan, Lebanon, Belarus, Bosnia and Herzegovina, Brazil, China, Canada, Montenegro, Indonesia, Kenya, Malaysia, Morocco, North Macedonia, Mauritius, Vietnam, Taiwan, Hong Kong, Egypt, Georgia, India, Mexico, Peru, Russia, Senegal, Singapore, Thailand, Tanzania, Turkey, Jordan, the Republic of South Africa, Ukraine, Moldova or the United States of America – which are third countries – transfer of personal data is based on Point (b) Art. 49 (1) GDPR (transfer is necessary for the performance of a contract). There is no adequacy decision by the European Commission concerning these states. In connection with the lack of an adequate level of data protection corresponding to EU regulations, personal data may be processed in a manner not restricted by mentioned regulations.
10. The rights of data subject
You have the right to access and rectify your data or restrict the processing thereof.
You have the right to object to processing of personal data on grounds relating to your particular situation.
11. The right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority, i.e. the President of the Personal Data Protection Office, if you consider that the processing of your personal data infringes upon GDPR.
12. Automated individual decision-making
Your data will not undergo profiling and no automated decision-making will be conducted based on these data.
---
1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the European Union, L 119, 4 May 2016, p. 1 as amended).
2 The Act of 20 July 2018 – Law on Higher Education and Science (Journal of Laws [Dz.U.] of 2022 item 574).
3 The Act of 29 June 1995 on public statistics (Journal of Laws [Dz. U.] of 2022 item 459).
