GDPR

Information clause

The Castle Museum in Pszczyna provides below information it is required to provide to you according to the provisions of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) – or GDPR.

1. The Controller of your personal data is :

Muzeum Zamkowe w Pszczynie, ul. Brama Wybrańców 1, 43-200 Pszczyna
e-mail: kancelaria@zamek-pszczyna.pl
represented by: Director Maciej Kluss

2. Your Data Protection Officer is:

Elżbieta Pergoł
e-mail: iodo@zamek-pszczyna.pl

3. The Controller processes your personal data based on its own tasks as per the Castle Museum Statute, applicable laws, agreements it concluded and on under your consent.

4. Your personal data is processed for the following purpose(s):

  • Conclusion and performance of the agreement concluded with the Museum;
  • Operating the service, in particular the registration process in the reservation system;
  • Filling the contact form;
  • Delivering the newsletter to your email address;
  • Establishing and delivering the service provided electronically as well as handling orders placed by users, including orders for products offered by the online store;
  • Marketing and promotion of services;
  • Responding letters and requests;
  • Investigation of and defence against potential claims associated with contract concluded;
  • Distributing invitations to events organised by the Museum.
  • Fulfilling legal obligations of the Museum’s Controller as per the applicable laws;
  • For the protection of persons and property the Museum operates a CCTV surveillance within its sire (recording in a 30-day loop)

The legal basis for processing include:

  • GDPR 6(1)(a), the data subject consented to the processing of their personal data for one or more pre-defined purposes,
  • GDPR 6(1)(b), the processing is necessary for the performance of a contract to which the data subject is a party;
  • GDPR 6(1)(c), the processing is necessary for conformity with a legal obligation to which the controller is subject,
  • GDPR 6(1)(e), the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
  • Act of 21 November 1996 on Museums,
  • Act of 25 October 1991 on organising and conducting cultural activity,
  • Act of 22 August 1997 on protection of persons and property.
  • Regulation of the Minister of Culture and National Heritage of 2 September 2014 protecting museum collections against fire, theft or other danger that might result in their damage or loss.

5. In the processing of data for the purposes referred to in point 4, the recipients of your personal data may include public authorities and bodies performing public tasks or acting on commission of public authorities or other entities which, under appropriate entrustment agreements, process personal data in the Controller’s files (such as IT service providers, security services)

6. Your personal data will be kept for the period necessary to achieve the purposes set out in point 4, and thereafter for the period and to the extent required by generally applicable law.

7. In the processing of your personal data, you have the right to access your personal data, the right to correct your data – if the data are incorrect or incomplete, the right to demand that your personal data be erased (or the right to be forgotten), the right to demand that processing be restricted, the right to object to the processing of your personal data, the right to transfer and to lodge a complaint to the President of the Office for Personal Data Protection.

8. Providing personal data is voluntary. If the processing of personal data is based on a consent of data subject to the processing of personal data ( GDPR, Art. 6(1)(a)), you have the right to withdraw this consent at any time. Such withdrawal will not affect the conformity of the processing performed based on the consent prior to its withdrawal.

9. Should you become aware of unlawful processing of your personal data, you have the right to lodge a complaint to the supervisory authority competent for personal data protection.

10. Providing personal data by you is a statutory or contractual requirement or a condition to conclude a contract, where the prerequisite for the processing of personal data is a provision of law or a contract concluded between the parties.

11. Your data will not be processed by automated means and will not be profiled.

12. Your data will not be transferred to a third country/international organisation.