Information clause regarding the processing of personal data

Compliant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation GDPR) we inform about rules and rights of processing your personal data in order to conclude and perform contracts, fulfill legal obligations and legally legitimate interests as well as granted consents.

The administrator of your personal data is: Galeria Labirynt with office in Lublin, at ul. ks. J. Popiełuszki 5, entered under number 6 in the register of cultural institutions, organized by the City of Lublin, NIP 946-182-98-01, REGON 000276506, hereinafter referred to as the Administrator. The Administrator appoints a data protection officer, who can be contacted via e-mail at iodo@labirynt.com or in writing to the aforementioned address of the Administrator’s headquarters.

The Administrator processes your personal data under applicable law and / or contracts and / or to implement the legitimate interests of the Administrator, and / or on the basis of granted consent. Your personal data shall not be transferred to a third country outside the EEA.

Your personal data will be processed in order to:
conclude and perform contracts with the Administrator’s contractors (legal basis: art. 6 paragraph 1b GDPR). for the duration of the contract and settlements after its completion,
b) fulfill legal obligations of the Administrator, such as issuing or storing invoices and other accounting documents, responding to complaints, providing public information (legal basis: article 6 paragraph 1c GDPR) for a period required by law to store data,
c) establish, defend and pursue claims (legal basis: article 6 paragraph 1f GDPR) for a period after which claims arising from the contract are time-barred,
d) detect and prevent frauds (legal basis: article 6 paragraphs 1c and 1f GDPR) for the duration of the contract, and then for the period after which claims expire or for the duration of proceedings conducted by the competent public authorities,
e) in other cases, your personal data is processed only on the basis of the previously granted consent to the extent and purpose specified in its wording (article 6 paragraph 1f GDPR) for the period from granting consent to its withdrawal.

Due to the processing of data for the purposes mentioned in Point 4, the recipients of your personal data constitute entities of the following categories:
a) entities processing personal data on behalf of the Administrator on the basis of relevant agreements, e.g. handling Administrator’s IT systems, subcontractors, entities providing consulting, legal, auditing, correspondence and parcels delivery services to the Administrator
b) entities authorized to receive them on the basis of applicable laws, e.g. courts and country bodies.

Entitlements arising from the processing of personal data by the Administrator:
a) the right to access your data, including obtaining copies of them,
b) the right to request the rectification (correction) of personal data – if the data is incorrect or incomplete,
c) the right to request the deletion of personal data (the so-called right to be forgotten), where:
– the data is no longer necessary for the purposes for which it was collected or otherwise processed,
– the data subject has objected to the processing of personal data,
– the data subject has withdrawn his consent to the processing of personal data, which is the basis for data processing and there is no other legal ground for data processing,
– personal data have been processed in breach of the law,
– personal data must be removed in order to comply with the legal obligation,
d) the right to request a restriction on the processing of personal data when:
– the data subject questions the correctness of personal data,
– data processing is unlawful and the data subject opposes the deletion of data, demanding their limitation instead,
– the administrator no longer needs data for its purposes, but they are required for the subject to establish, defend, or exercise legal claims,
– the data subject has objected to the processing of data, pending determination of whether the legitimate grounds on the part of the Administrator are overriding grounds of objection,
e) the right to data transfer when the following conditions are met:
– the data are processed on the basis of an agreement concluded with the data subject or on the basis of the consent expressed by that person,
– the processing is carried out by automated means.
f) the right to object to the processing of data when the following conditions are met:
– there are reasons related to your special situation, in the case of data processing on the basis of a task carried out in the public interest or under the public authority by the Administrator,
– processing is necessary for purposes arising from legitimate interests pursued by the Administrator or by a third party, except for situations in which the interests or fundamental rights and freedoms of the data subject, requiring the protection of personal data, in particular their interests when the data subject is a child.

If the processing of personal data by the Administrator is conducted on the basis of the Customer’s consent (article 6 paragraph 1 (a) GDPR), the Customer has the right to withdraw given consent at any time. The withdrawal does not affect the compliance of the processing, which was made on the basis of the consent prior to its withdrawal, according to the applicable law.

If you are informed of illegal processing of your personal data by the Administrator, you have the right to make a complaint to the supervisory body – the President of the Personal Data Protection Office.

When the processing of personal data is carried out on the basis of the consent of the data subject, providing your personal data to the Administrator is voluntary. When concluding the contract, providing personal data is voluntary, but necessary for the conclusion and performance of the contract.

Your personal data can be processed in an automated way. Your data will not be profiled.