DOCUMENTS

PERSONAL DATA PROCESSING POLICY
Introduction

§1

The FILMFORUM Association (hereinafter referred to as the “Association” or “Controller”), located at ul. Gen. Władysława Andersa 35, 00-159 Warsaw, Poland, processes information to organize artistic, cultural, media, educational, or academic events. This information may include personal data as defined by Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “General Data Protection Regulation” or “GDPR”).  

§2

Current data protection regulations, particularly the GDPR, require that data subjects be informed about the processing of their personal data according to Articles 13 or 14 of the GDPR. This Policy explains how the Association handles personal data.

§3

The Controller is the FILMFORUM Association, registered in the National Court Register by the District Court of Warsaw, XVII Commercial Division as KRS 0000178435. The Association’s address is ul. Gen. Władysława Andersa 35, 00-159 Warsaw, Poland. The Association’s VAT ID is 778-141-37-39 and its REGON number is 634536362.

§4

You can contact the Association by mail at ul. Gen. Władysława Andersa 35, 00-159 Warsaw, Poland, or by email at rodo@filmforum.pl.

§5

The Association has appointed a Data Protection Officer who can be contacted by mail at ul. Gen. Władysława Andersa 35, 00-159 Warsaw, Poland, or by email at rodo@filmforum.pl.

Legal Basis for Processing Personal Data

§6

The Association processes personal data based on the following legal grounds as outlined in Article 6(1) of the GDPR:

• Consent: You have consented to the processing of your personal data for one or more specific purposes.
• Contractual Necessity: Processing is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into a contract.  
• Legal Obligation: Processing is necessary for compliance with a legal obligation to which the Association is subject.  
• Vital Interests: Processing is necessary to protect the vital interests of you or another person.
• Public Interest: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Association.  
• Legitimate Interests: Processing is necessary for the legitimate interests pursued by the Association or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms that require protection of personal data, in particular where you are a child.  

§7

The Association has a legitimate interest in processing information to organize artistic, cultural, media, educational, social, or academic events. This processing is necessary for the Association to fulfill its non-commercial statutory activities or commercial business activities as described in its National Court Register entry and statutes. Data processing is essential for the Association to deliver these events to its beneficiaries.

§8

The Association processes personal data only for the purpose of organizing the events mentioned in § 7 within the scope of its non-commercial statutory activities or commercial business activities.

Data Security

§9

The Association implements all necessary physical, technical, and organizational measures to protect personal data from accidental or unlawful destruction, loss, disclosure, unauthorized access, alteration, or use. These measures comply with applicable data protection laws.

Sharing Personal Data

§10

The Association may disclose personal data to third parties for the following purposes and under the following conditions:

1. To support the Association’s activities: This includes using specialized service providers such as IT support or payment processors.
2. To ensure event delivery: This may involve sharing data with entities involved in organizing the events.

§11

In extraordinary cases, the Association may disclose personal data if it has reason to believe that such disclosure is necessary to identify or contact a person whose actions may violate the rights of a third party or harm others by breaking the law or data protection regulations. The Association will also disclose personal data upon request from authorized law enforcement agencies.

§12

In cases of transferring personal data to countries outside the European Economic Area and other regions adhering to comprehensive personal data protection laws, the Association guarantees that they will share the data according to this Privacy Policy and in ways that comply with existing data protection laws. The Association will implement appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission or certifications confirming an adequate level of data protection in the recipient country.

§13

The Association does not process special categories of personal data, such as data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic, biometric, health, sex life or sexual orientation, and data concerning criminal convictions and offenses.  

§14

The Association processes personal data for a period necessary to fulfill the purposes outlined in § 6, § 7, and § 8 above. The data retention period may vary depending on the type of data and the purpose of processing. After this period, the data will be deleted or anonymized in a manner that prevents the identification of the data subject.

Rights of Data Subjects

§15

In relation to data processing, you have the right to:

• Request access to your personal data stored by the Association;
• Request the rectification of your personal data;
• Request the erasure of your personal data;
• Request restriction of the processing of your personal data;  
• Object to the processing of your personal data;
• Data portability;
• Lodge a complaint with the supervisory authority.  

§16

These rights can be exercised by:

• Email: rodo@filmforum.pl
• Mail: ul. Gen. Władysława Andersa 35, 00-159 Warsaw, Poland

§17

The Association processes personal data both manually and electronically, using methods and procedures appropriate for the purposes outlined in § 8.