Privacy policy

The following document defines the rules of processing User's personal data and access to information collected through Cookies, in order to fulfill the obligations and services provided to the User electronically by the POLIN Museum of the History of Polish Jews, 00-157 Warsaw, ul. Anielewicza 6.


I. Definitions

Controller – POLIN Museum of the History of Polish Jews, Warsaw, 6 Anielewicza St. as the owner and operator of the www.polin.pl portal, hereinafter also referred to as the “POLIN Museum”.

Cookies – IT data, especially small text files, recorded and stored on devices used to access the Portal websites by the User.

Controller's Cookies – Cookies placed by the Controller, related to the provision of services by electronic means by the Controller via the Portal.

External Cookies – Cookies placed by the Controller's partners (e.g. Google, Facebook) via the Website.

Server Logs – files located on the server that collect information about server activity, e.g. requests sent by an internet browser or errors in the functioning of an application.

Portal – www.polin.pl website, used by the Controller to conduct its activity in the internet.

Device – electronic device used by the User to obtain access to the Portal.

User – an entity which, in accordance with the Rules and the provisions of applicable laws, may be provided services by electronic means or which may conclude an Agreement on provision of services by electronic means.

Personal Data – means information about an identified or identifiable natural person – data subject; an identifiable natural person is a person who can be identified, directly or indirectly, in particular based on an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processing – means an operation or a set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Profiling – means any form of automated processing of personal data consisting in the use of personal data to evaluate certain personal aspects of a natural person, in particular to analyse or predict aspects concerning the effects of the natural person’s work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

II. Sources of data

The Portal obtains data, including personal data about the User and his/her behaviour, by:

  1. Voluntary provision of data by the User in a form.
  2. Placing Cookies on a Device.
  3. Collecting web server logs by the hosting operator.

III. Type of collected data

  1. When ordering a newsletter, the User provides the following information:
    1. e-mail address (obligatory);
    2. newsletter for teachers (optional): first name;
    3. newsletter for teachers (optional): surname;
    4. newsletter for teachers (optional): phone number;
    5. newsletter for teachers (optional): name of school;
    6. newsletter for teachers (optional): city;
    7. newsletter for teachers (optional): street;
    8. newsletter for teachers (optional): building no.;
    9. newsletter for teachers (optional): post code;
    10. newsletter for teachers (optional): school level.
  2. When completing the form for the organisation of birthday in the King Matt’s Family Education Centre, the User provides:
    1. full name (obligatory);
    2. e-mail address (obligatory);
    3. phone number (obligatory);
    4. child's name;
    5. child's date of birth.
  3. When completing the participation form for free-of-charge educational workshops for groups of children and teenagers in a difficult financial and/or social situation, the User provides:
    1. full name (obligatory);
    2. e-mail address (obligatory);
    3. phone number (obligatory);
    4. name of institution [making the request] (obligatory);
    5. address of institution (obligatory);
    6. justification of the necessity to use the pool of free workshops for persons in a difficult social and/or financial situation (obligatory);
    7. important information about the participants, such as intellectual impairments, sensory hypersensitivity, mobility, sight, and hearing impairments (obligatory).
  4. When completing the form for submitting an object to the “Archive of March '68” display case and the Museum’s collection, the User provides:
    1. full name (obligatory);
    2. correspondence address (obligatory);
    3. e-mail address (obligatory);
    4. phone number (obligatory);
    5. details of the keepsake owner (obligatory).
  5. When completing a Museum’s Friends Club application form, the User provides:
    1. first name (obligatory);
    2. surname (obligatory);
    3. town/city (obligatory);
    4. post code (obligatory);
    5. street, no. (obligatory);
    6. phone number (obligatory);
    7. e-mail address.
  6. The Portal may also record information about connection parameters. The viewed resources are identified by URL addresses. The following may also be subject to recording:
    1. time of request;
    2. time of response;
    3. client’s workstation name – identification via HTTP protocol;
    4. information about errors that occurred during HTTP transaction;
    5. URL address of the previously visited website (referrer link) – if the User entered the Portal through a link;
    6. information about the user’s browser;
    7. information about the IP address.

IV. Automated processing of personal data (profiling)

The Controller uses profiling, i.e. tracks the User’s history of the use of information newsletters sent by the POLIN Museum in order to adapt its communication and provide the Users with content tailored to their needs and interests.

V. The purpose of data processing

  1. The data, including the personal data provided by the User at the time of signing up for the newsletter, are used for the purpose of sending information about exhibitions, program events, and other messages related to POLIN Museum’s activity.
  2. The data provided at the time of ordering birthday in the King Matt’s Family Education Centre are used for the purpose of:
    1. performance of orders on Room rental and hiring a birthday animator (optional);
    2. sending the User information about POLIN Museum’s activities, if the User ordered a newsletter.
  3. The data provided in the participation form for free-of-charge educational workshops are used to:
    1. enable groups of children and teenagers in a difficult financial and/or social situation to take part in educational workshops organised by the POLIN Museum;
    2. send the User information about POLIN Museum’s activities, if the User ordered a newsletter.
  4. The data provided in the submission form concerning an object for the ‘Archive of March '68’ display case and the Museum’s collection are used for the purpose of:
    1. correct archiving of historical keepsakes, in accordance with the statute and mission of the POLIN Museum;
    2. sending the User information about POLIN Museum’s activities, if the User ordered a newsletter.
  5. The data provided in the submission form for the Museum Friends Club are used for the purpose of performing the order, i.e.:
    1. sending a chosen Museum Friends Club card to the address provided by the User;
    2. enabling the User to enjoy the benefits offered to Museum Friends Club card holders;
    3. sending the User information about upcoming events, organised especially for the members of the Museum Friends Club.

VI. The purpose of data processing in cookies

  1. This website uses Cookies.
  2. Cookies are stored on the Device until the User leaves our website, closes the Internet browser or until they are deleted by the User.
  3. The Data Controller is the entity that places Cookies on the Device and obtains access to them.
  4. The Controller’s Cookies are used for the following purposes:
    1. compiling statistics about the ways in which the users of the Portal use the websites, which allows to improve their structure and content.
  5. External Cookies are used for the following purposes:
    1. collecting general and anonymous statistical data via Google Analytics analytic tools (Cookies controller: Google Inc. with its registered office in the USA).
    2. promoting the Portal with the use of interactive features of the Facebook.com social website (Cookies controller: Facebook Inc. with its registered office in the USA or Facebook Ireland with its registered office in Ireland).
  6. Restricting the use of Cookies may affect some of the functionalities available on the Portal’s websites.
  7. The Data Controller recommends reading Google’s and Facebook’s privacy policies, which set out the rules for using Cookies used to compile statistics.
  8. The User may view and edit information stored in Cookies collected by the Google advertising network using: google.com/ads/preferences/.
  9. The default settings of the internet browser typically allow for storing Cookies on the Device. The User may delete the collected Cookies and block their further collecting by changing the settings of his/her internet browser.

VII. The purpose of data processing in server logs

  1. Information about certain behaviours of the Users are recorded on the Controller’s server, on which the Portal is hosted. The data are used only for the administration of the Portal and the above-mentioned server.
  2. The Data collected in server log files will not be combined with the User’s personal data.

VIII. Sharing and processing of data

  1. The data provided by the User in any of the forms will not be shared with third parties without the User’s consent.
  2. The data provided by the User will not be shared with third parties, with the exception of IT companies that enable the POLIN Museum to provide relevant services and who have concluded agreements on outsourcing of personal data processing.
  3. The Data Controller is obligated to share information collected by the Portal with authorised bodies on the basis of lawful requests, to the extent resulting from such requests.

IX. Period of data processing

  1. The period of data processing by the Controller depends on the type of provided service and the purpose of processing.
  2. In principle, the data are processed for the time of service provision or completion of an order, until the time of withdrawal of consent, or submission of an effective objection to the processing of data in the cases where the legal grounds for processing of the data is the Controller’s legitimate interest.
  3. The period of data processing may be extended in the case where processing is necessary to establish, pursue or defend against possible claims, however, not longer than for 10 years. After this time – only in the case and to the extent required by law. After the expiry of the period of processing, the data are irreversibly deleted or anonymised.

X. Legal grounds for the processing of data provided in the form

The personal data from the form are processed pursuant to Article 6(1)(a) of the General Data Protection Regulation, i.e. the data subject's consent.

XI. Legal grounds for the processing of data in cookies and logs

The personal data stored in cookies are processed pursuant to Article 6(1)(a) of the General Data Protection Regulation, i.e. the data subject's consent. The processing is necessary for purposes resulting from legitimate interests of the Controller (internet analytics / statistics on the use of the Portal by the Users).

XII. User's Rights

  1. The User has the right to access his/her personal data, the right to request their rectification, erasure or restriction of their processing, the right to data portability, the right to object, the right to withdraw consent at any time, which does not affect the lawfulness of processing based on the consent before its withdrawal.
  2. The User has the right to lodge a complaint with the PDPA, if he or she finds that the processing the User's personal data violates the provisions of the General Data Protection Regulations of 27 April 2016 and the provisions of the act of 10 May 2018 on personal data protection (Journal of Laws of 2018, item 1000).
  3. POLIN Museum appointed a Data Protection Officer, who can be contacted by e-mail at: iod@polin.pl, by telephone at: 22 471 03 41, or by post to the address: Data Protection Officer, POLIN Museum of the History of Polish Jews, 6 Anielewicza St., 00-157 Warsaw.

XIII. Changes to the Privacy Policy

  1. The Policy is reviewed on an ongoing basis and updated as necessary. The current version of the Policy is published on the Portal and enters into force on the date of its publication.