Privacy Policy

Clause for processing of personal data provided electronically

I. General Information

The website is operated by: Narodowy Instytut Fryderyka Chopina (Frederic Chopin Institute), hereinafter referred to as the “Institute”.
The operator of the website acts in the capacity of the controller of personal data provided, on a voluntary basis, by the users while establishing accounts, while taking advantage of the services provided or while taking advantage of various marketing campaigns that may be conducted by the operator (such as contests, newsletters, etc.).
Personal data provided by the users in order to take advantage of the services rendered are relied upon while activating and while rendering such services. The tasks performed with the use of the data provided include, in particular, the following:
- technical activation of the services,
- informing about changes to applicable rules and regulations,
- rendering technical services, including providing answers to questions asked by users,
- submitting marketing information by e-mail / via other channels – if the user consents to such forms of contact (e.g. by signing up to the newsletter, ticking a proper consent box, signing up for a service or using the customer panel – details concerning the consent, its scope and references to applicable legal regulations are provided at the location at which the consent is granted),
The website collects information about users and their behaviors in the following manner:
- based on data provided via the forms, on a voluntary basis, and then entered into the Operator’s systems.
- by saving cookie files on the users’ devices.

II. Detailed information on the processing of personal data

Personal data are processed pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119), hereinafter referred to as GDPR, with the provisions of the Act on the Provision of Electronic Services and of other applicable legal regulations taken into consideration.

Personal data controller. Details of the personal data controller: Narodowy Instytut Fryderyka Chopina with its registered office in Warsaw, at ul. Tamka 43, NIP (Tax ID): 525-22-14-269, entered into the Register of Institutions of Culture under the number 51/2001.
Data protection officer. The Controller has appointed a Data Protection Officer who may be contacted in writing via:
- traditional mail sent to: ul. Tamka 43, 00-355 Warszawa
- email: iod@nifc.pl
No obligation to provide personal data. The Institute wishes to inform that unless the wording of the specific forms provides otherwise (e.g. by stating that the provision of data is voluntary), the services provided by the Institute cannot be taken advantage of on an anonymous basis or with the use of pseudonyms.
In order to create a customer account and sign up for the Institute's services, one has to create a login and provide the following data:
Individuals not conducting any business activity
- first name and surname
- e-mail address
- login
- home address
- country of residence
- phone number

Types of data processed, objectives and legal basis for processing the data by the Institute and expected retention period

Types of processed personal data, purposes, legal bases and retention periods
Type of data	Purpose of processing	Legal basis	Retention period
Obligatory data	Maintaining the customer’s account, providing the services ordered, establishing contact in connection with the performance of services	Article 18(1) of the Act on Provision of Electronic Services; Article 6(1)(b) GDPR (data is indispensable in order to perform the agreement)	Until the customer’s account is deleted
	Seeking the satisfaction of or defense against potential claims	Article 6(1)(f) GDPR (legitimate interest)	Until the expiry of the limitation period for claims, if any
	Marketing and direct marketing of the Controller’s products and services, including customer satisfaction surveys, etc.	Article 6(1)(f) GDPR (legitimate interest)	Until an objection is filed
	Submitting commercial information electronically	Article 6(1)(a) GDPR	Until the consent is withdrawn or an objection is filed
	Processing data for the purposes of the Facebook fanpage of the National Frederic Chopin Institute and the Frederic Chopin Museum	Article 6(1)(f) GDPR (legitimate interest). The data are controlled jointly by the Institute and by Facebook.	Until an objection to their processing is filed
Compulsory data required to perform orders, including, in particular: - Bank account from which the payment was made - Data included in the bills (VAT invoices) issued	Order/service-related settlements	Article 18(2) of the Act on Provision of Electronic Services; Article 6(1)(b) GDPR (data is indispensable in order to perform the agreement)	Until the expiry of the limitation period for claims, if any
	Performing legal obligations related to accounting	Article 6(1)(c) GDPR (performance of legal obligations related to accounting)
	Seeking the satisfaction of or defense against potential claims	Article 6(1)(f) GDPR (legitimate interest)	Until the expiry of the limitation period for claims, if any
Data contained in correspondence exchanged with the Controller (in contact forms, via the submission system, e-mail, chats, traditional mail)	Exchanging correspondence, handling reports, requests, queries or complaints; presenting the wording of representations or requests submitted by a given data subject	Article 6(1)(c) GDPR (performance of legal obligations in connection with answering requests of data subjects); Article 6(1)(f) GDPR (legitimate interest)	Until the expiry of the limitation period for claims, if any
	Seeking the satisfaction of or defense against potential claims	Article 6(1)(f) GDPR (legitimate interest)	Until the expiry of the limitation period for claims, if any
All aforementioned types of personal data processed by the Controller with the use of IT systems	Making and storing backup copies; ensuring ability to permanently ensure confidentiality, integrity, availability and resilience of systems and processing services; ensuring ability to quickly restore availability of personal data and access thereto in the event of a physical or technical event	Article 6(1)(c) in conjunction with Article 32(1)(b) and (c) GDPR (performance of legal obligations related to ensuring security, integrity and availability of data)	Pursuant to the internal backup creation time schedule

Personal data will be stored for periods longer than those specified in the table if this results from applicable legal regulations.

Right to withdraw consent. Where the Controller processes personal data based on consent, such consent may be withdrawn at any time. The withdrawal of consent shall not affect the lawfulness of processing performed prior to its withdrawal.
Rights of data subjects concerning the processing of their personal data. Data subjects may exercise the following rights in connection with their personal data:
- Right of access to data. Article 15 GDPR – The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning them are being processed, and, where that is the case, access to the personal data and the information specified in this provision.
- Right to rectification and supplementation. Article 16 GDPR – The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
- Right to erasure. Article 17 GDPR – The data subject shall have the right to obtain from the controller the erasure of personal data concerning them without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the grounds provided for in this provision applies.
- Right to restriction of processing. Article 18 GDPR – Restriction of processing shall mean labeling the personal data stored in order to restrict their future processing. Where data have been so labeled, they may only be processed, with the exception of storage, with the data subject’s consent or for purposes set forth in this provision. The restriction of processing may be requested in situations set forth in this provision.
- Right to data portability. Article 20 GDPR – The data subject shall have the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format, and have the right to transmit those data to another controller without hindrance from the controller.
- Right to object. Article 21 GDPR – If the data are processed in connection with direct marketing purposes, the data subject shall have the right to object, at any time, to the processing of their personal data for such direct marketing, including profiling, to the extent that it is related to such direct marketing. The right to object may also be exercised in other cases specified in Articles 21–22 GDPR.
A data subject may exercise the above rights by contacting the Controller via any of the channels presented above. The same applies to the withdrawal of consent. When contacting via means of distance communication, the Controller may require that personal data be provided in order to identify the data subject.
Data recipients. Data may be disclosed to entities operating to the order of the Controller or performing services for the benefit of the Controller, including, in particular:
- business operators rendering services related to seeking the satisfaction of or defending against claims, as well as providing legal and accounting services (debt recovery companies, law firms, tax advisors, accounting offices);
- subcontractors and service technicians;
- auditors;
- postal service providers and courier companies.
Data may also be disclosed to:
- authorities which are entitled, pursuant to applicable legal regulations, to demand that personal data be disclosed to them, including, in particular, courts, prosecutors, the Police, fiscal and customs authorities;
- other entities authorized to access data pursuant to applicable laws.
Right to complain. The data subject has the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) if they believe that their personal data are processed in violation of applicable laws.

III. Selected data protection measures.

The Operator uses various measures to protect personal data. These include, in particular:
- protection against unauthorized access,
- protection against data loss.
User passwords are not stored in the database in an unencrypted form. They are also not encrypted in a reversible manner.
Transmission of data from log-in sites and data forms is protected (SSL certificate).
The Operator protects data against loss (e.g. disk arrays, regular backup copies).
The Operator applies adequate fire protection measures at data processing locations (e.g. special fire suppression systems).
The Operator applies adequate protection measures to data processing systems to protect against power outages (e.g. redundant power supply lines, power generators, uninterruptible power supply systems).
The Operator applies physical protection measures to prevent access to data processing locations (e.g. access control, CCTV).
The Operator ensures that servers, as elements of the data processing system, operate under adequate environmental conditions (e.g. environmental controls, specialized air conditioning systems).
The Operator applies organizational solutions to ensure the highest possible level of protection and privacy (training, internal regulations, password policies, etc.).
The Operator has appointed a Data Protection Officer.

IV. Cookie Policy.

The website uses cookie files.
Cookie files contain IT data. They usually have the form of text files that are stored on the website user’s device and are intended to assist in using the website. Cookies usually contain the name of the website from which they originate, information on their storage period on a given device, as well as a unique number.
The Operator of the website acts as the entity placing cookies on the website user’s end device and having access to such cookies.
Cookies are used for:
- generating statistical data that help understand how users use the website, which makes it possible to improve its structure and content;
- maintaining the website user’s session (after logging in), thanks to which the user does not have to re-enter their login and password on each subpage of the website;
- storing information on referrals, in connection with the referral program;
- identifying the user’s profile to provide them with tailored advertisements, especially from Google.
The website uses two main types of cookie files: “session” cookies and “persistent” cookies. Session cookies are temporary files that are stored on the end user’s device until the user logs out, leaves the website or shuts down their Internet browser. Persistent cookies are stored on the end user’s device for the duration specified in the cookie parameters or until they are deleted by the user.
Software used for browsing websites (Internet browser) usually accepts, by default, cookie files that are stored on the user’s device. Website users may change their browser’s cookie settings. The Internet browser allows them to delete cookie files. Cookies may also be blocked automatically. Detailed information on these options can be found in the browser’s Help section or documentation.
Please be advised that any restrictions on the use of cookies may affect some of the functionalities available on this website.
Cookie files stored on the website user’s device may also be used by entities cooperating with the website Operator. These include, in particular: Google (Google Inc., USA), Facebook (Facebook Inc., USA), Twitter (Twitter Inc., USA).
The Operator analyzes website traffic using the Google Analytics service.
The Operator uses remarketing, meaning that advertising networks may display advertisements tailored to the user’s behavior shown while using the website. Such activities may only be performed if the browser supports cookies.
Regarding user preferences collected by the Google ad network through cookies, the user can view and edit information derived from cookies using the tool at: https://www.google.com/ads/preferences/

V. Managing cookies – how to express and withdraw consent in practice?

If the user does not wish to receive cookie files, they may change their browser settings accordingly. Please note that disabling cookies that are required for authentication purposes, as well as for ensuring proper levels of security and for storing the user’s preferences, may hinder, and in extreme cases prevent, the use of websites.
To manage your cookie settings, select your Internet browser from the list below and follow the instructions:
- Edge
- Internet Explorer
- Chrome
- Safari
- Firefox
- Opera
Mobile devices:
- Android
- Safari (iOS)
- Windows Phone

Clause for processing of personal data provided electronically

I. General Information

The website is operated by: Narodowy Instytut Fryderyka Chopina (Frederic Chopin Institute), hereinafter referred to as the “Institute”.

The operator of the website acts in the capacity of the controller of personal data provided, on a voluntary basis, by the users while establishing accounts, while taking advantage of the services provided or while taking advantage of various marketing campaigns that may be conducted by the operator (such as contests, newsletters, etc.).

Personal data provided by the users in order to take advantage of the services rendered are relied upon while activating and while rendering such services. The tasks performed with the use of the data provided include, in particular, the following:

technical activation of the services,
informing about changes to applicable rules and regulations,
rendering technical services, including providing answers to questions asked by users,
submitting marketing information by e-mail / via other channels – if the user consents to such forms of contact (e.g. by signing up to the newsletter, ticking a proper consent box, signing up for a service or using the customer panel – details concerning the consent, its scope and references to applicable legal regulations are provided at the location at which the consent is granted),

The website collects information about users and their behaviors in the following manner:

based on data provided via the forms, on a voluntary basis, and then entered into the Operator’s systems.
by saving cookie files on the users’ devices.

II. Detailed information on the processing of personal data

Personal data controller. Details of the personal data controller: Narodowy Instytut Fryderyka Chopina with its registered office in Warsaw, at ul. Tamka 43, NIP (Tax ID): 525-22-14-269, entered into the Register of Institutions of Culture under the number 51/2001.

Data protection officer. The Controller has appointed a Data Protection Officer who may be contacted in writing via:

traditional mail sent to: ul. Tamka 43, 00-355 Warszawa
email: iod@nifc.pl

No obligation to provide personal data. The Institute wishes to inform that unless the wording of the specific forms provides otherwise (e.g. by stating that the provision of data is voluntary), the services provided by the Institute cannot be taken advantage of on an anonymous basis or with the use of pseudonyms.

In order to create a customer account and sign up for the Institute's services, one has to create a login and provide the following data:

Individuals not conducting any business activity

first name and surname
e-mail address
login
home address
country of residence
phone number

Types of data processed, objectives and legal basis for processing the data by the Institute and expected retention period

Types of processed personal data, purposes, legal bases and retention periods
Type of data	Purpose of processing	Legal basis	Retention period
Obligatory data	Maintaining the customer’s account, providing the services ordered, establishing contact in connection with the performance of services	Article 18(1) of the Act on Provision of Electronic Services; Article 6(1)(b) GDPR (data is indispensable in order to perform the agreement)	Until the customer’s account is deleted
	Seeking the satisfaction of or defense against potential claims	Article 6(1)(f) GDPR (legitimate interest)	Until the expiry of the limitation period for claims, if any
	Marketing and direct marketing of the Controller’s products and services, including customer satisfaction surveys, etc.	Article 6(1)(f) GDPR (legitimate interest)	Until an objection is filed
	Submitting commercial information electronically	Article 6(1)(a) GDPR	Until the consent is withdrawn or an objection is filed
	Processing data for the purposes of the Facebook fanpage of the National Frederic Chopin Institute and the Frederic Chopin Museum	Article 6(1)(f) GDPR (legitimate interest). The data are controlled jointly by the Institute and by Facebook.	Until an objection to their processing is filed
Compulsory data required to perform orders, including, in particular: - Bank account from which the payment was made - Data included in the bills (VAT invoices) issued	Order/service-related settlements	Article 18(2) of the Act on Provision of Electronic Services; Article 6(1)(b) GDPR (data is indispensable in order to perform the agreement)	Until the expiry of the limitation period for claims, if any
	Performing legal obligations related to accounting	Article 6(1)(c) GDPR (performance of legal obligations related to accounting)
	Seeking the satisfaction of or defense against potential claims	Article 6(1)(f) GDPR (legitimate interest)	Until the expiry of the limitation period for claims, if any
Data contained in correspondence exchanged with the Controller (in contact forms, via the submission system, e-mail, chats, traditional mail)	Exchanging correspondence, handling reports, requests, queries or complaints; presenting the wording of representations or requests submitted by a given data subject	Article 6(1)(c) GDPR (performance of legal obligations in connection with answering requests of data subjects); Article 6(1)(f) GDPR (legitimate interest)	Until the expiry of the limitation period for claims, if any
	Seeking the satisfaction of or defense against potential claims	Article 6(1)(f) GDPR (legitimate interest)	Until the expiry of the limitation period for claims, if any
All aforementioned types of personal data processed by the Controller with the use of IT systems	Making and storing backup copies; ensuring ability to permanently ensure confidentiality, integrity, availability and resilience of systems and processing services; ensuring ability to quickly restore availability of personal data and access thereto in the event of a physical or technical event	Article 6(1)(c) in conjunction with Article 32(1)(b) and (c) GDPR (performance of legal obligations related to ensuring security, integrity and availability of data)	Pursuant to the internal backup creation time schedule

Personal data will be stored for periods longer than those specified in the table if this results from applicable legal regulations.

Right to withdraw consent. Where the Controller processes personal data based on consent, such consent may be withdrawn at any time. The withdrawal of consent shall not affect the lawfulness of processing performed prior to its withdrawal.

Rights of data subjects concerning the processing of their personal data. Data subjects may exercise the following rights in connection with their personal data:

Right of access to data. Article 15 GDPR – The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning them are being processed, and, where that is the case, access to the personal data and the information specified in this provision.
Right to rectification and supplementation. Article 16 GDPR – The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to erasure. Article 17 GDPR – The data subject shall have the right to obtain from the controller the erasure of personal data concerning them without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the grounds provided for in this provision applies.
Right to restriction of processing. Article 18 GDPR – Restriction of processing shall mean labeling the personal data stored in order to restrict their future processing. Where data have been so labeled, they may only be processed, with the exception of storage, with the data subject’s consent or for purposes set forth in this provision. The restriction of processing may be requested in situations set forth in this provision.
Right to data portability. Article 20 GDPR – The data subject shall have the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format, and have the right to transmit those data to another controller without hindrance from the controller.
Right to object. Article 21 GDPR – If the data are processed in connection with direct marketing purposes, the data subject shall have the right to object, at any time, to the processing of their personal data for such direct marketing, including profiling, to the extent that it is related to such direct marketing. The right to object may also be exercised in other cases specified in Articles 21–22 GDPR.

A data subject may exercise the above rights by contacting the Controller via any of the channels presented above. The same applies to the withdrawal of consent. When contacting via means of distance communication, the Controller may require that personal data be provided in order to identify the data subject.

Data recipients. Data may be disclosed to entities operating to the order of the Controller or performing services for the benefit of the Controller, including, in particular:

business operators rendering services related to seeking the satisfaction of or defending against claims, as well as providing legal and accounting services (debt recovery companies, law firms, tax advisors, accounting offices);
subcontractors and service technicians;
auditors;
postal service providers and courier companies.

Data may also be disclosed to:

authorities which are entitled, pursuant to applicable legal regulations, to demand that personal data be disclosed to them, including, in particular, courts, prosecutors, the Police, fiscal and customs authorities;
other entities authorized to access data pursuant to applicable laws.

Right to complain. The data subject has the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) if they believe that their personal data are processed in violation of applicable laws.

III. Selected data protection measures.

The Operator uses various measures to protect personal data. These include, in particular:

protection against unauthorized access,
protection against data loss.

User passwords are not stored in the database in an unencrypted form. They are also not encrypted in a reversible manner.

Transmission of data from log-in sites and data forms is protected (SSL certificate).

The Operator protects data against loss (e.g. disk arrays, regular backup copies).

The Operator applies adequate fire protection measures at data processing locations (e.g. special fire suppression systems).

The Operator applies adequate protection measures to data processing systems to protect against power outages (e.g. redundant power supply lines, power generators, uninterruptible power supply systems).

The Operator applies physical protection measures to prevent access to data processing locations (e.g. access control, CCTV).

The Operator ensures that servers, as elements of the data processing system, operate under adequate environmental conditions (e.g. environmental controls, specialized air conditioning systems).

The Operator applies organizational solutions to ensure the highest possible level of protection and privacy (training, internal regulations, password policies, etc.).

The Operator has appointed a Data Protection Officer.

IV. Cookie Policy.

The website uses cookie files.

Cookie files contain IT data. They usually have the form of text files that are stored on the website user’s device and are intended to assist in using the website. Cookies usually contain the name of the website from which they originate, information on their storage period on a given device, as well as a unique number.

The Operator of the website acts as the entity placing cookies on the website user’s end device and having access to such cookies.

Cookies are used for:

generating statistical data that help understand how users use the website, which makes it possible to improve its structure and content;
maintaining the website user’s session (after logging in), thanks to which the user does not have to re-enter their login and password on each subpage of the website;
storing information on referrals, in connection with the referral program;
identifying the user’s profile to provide them with tailored advertisements, especially from Google.

The website uses two main types of cookie files: “session” cookies and “persistent” cookies. Session cookies are temporary files that are stored on the end user’s device until the user logs out, leaves the website or shuts down their Internet browser. Persistent cookies are stored on the end user’s device for the duration specified in the cookie parameters or until they are deleted by the user.

Software used for browsing websites (Internet browser) usually accepts, by default, cookie files that are stored on the user’s device. Website users may change their browser’s cookie settings. The Internet browser allows them to delete cookie files. Cookies may also be blocked automatically. Detailed information on these options can be found in the browser’s Help section or documentation.

Please be advised that any restrictions on the use of cookies may affect some of the functionalities available on this website.

Cookie files stored on the website user’s device may also be used by entities cooperating with the website Operator. These include, in particular: Google (Google Inc., USA), Facebook (Facebook Inc., USA), Twitter (Twitter Inc., USA).

The Operator analyzes website traffic using the Google Analytics service.

The Operator uses remarketing, meaning that advertising networks may display advertisements tailored to the user’s behavior shown while using the website. Such activities may only be performed if the browser supports cookies.

Regarding user preferences collected by the Google ad network through cookies, the user can view and edit information derived from cookies using the tool at: https://www.google.com/ads/preferences/

V. Managing cookies – how to express and withdraw consent in practice?

If the user does not wish to receive cookie files, they may change their browser settings accordingly. Please note that disabling cookies that are required for authentication purposes, as well as for ensuring proper levels of security and for storing the user’s preferences, may hinder, and in extreme cases prevent, the use of websites.

To manage your cookie settings, select your Internet browser from the list below and follow the instructions:

Edge
Internet Explorer
Chrome
Safari
Firefox
Opera

Mobile devices:

Android
Safari (iOS)
Windows Phone