Home / Privacy policy
IB World School 006265of Prywatne Akademickie Centrum Kształcenia in Kraków
1.1. Controller – Prywatne Akademickie Centrum Kształcenia – Jerzy Waligóra, Kazimiera Waligóra, Miłosz Waligóra, Agnieszka Kucz Spółka Cywilna, with its principal place of business at ul. Karmelicka 45, 31-128 Kraków, Poland, tax ID (NIP): 676-22-09-977, e-mail sekretariat@pack.edu.pl, phone: 12 633 96 57.
1.2. Personal data – all information about an identified or identifiable natural person, identifiable through one or more specific factors determining their physical, physiological, genetic, mental, economic, cultural or social identity, including the device IP address, location data, an online identifier and information collected through cookies and other similar technology.
1.3. Policy – this Privacy Policy.
1.4. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
1.5. Portal/Website – the website operated by the Controller at www.academos.krakow.pl.
1.6. User – any natural person visiting the Portal or using the services or functionalities described in the Policy.
2.1. In connection with the User’s use of the Portal, the Controller collects data to the extent necessary to provide services by electronic means, as well as information about the User’s activity on the Portal. The detailed rules and purposes of processing personal data collected while the User uses the Portal are described below.
3.1. The personal data of all persons using the Portal (including the IP address or other identifiers and information collected through cookies or other similar technologies) are processed by the Controller:
3.1.1. in order to provide services by electronic means, consisting in making the content gathered on the Portal available to Users and providing contact forms – the legal basis for processing is then that processing is necessary for the performance of a contract, where the enquiry concerns the possibility of concluding a contract (Article 6(1)(b) GDPR), or consent, where it concerns other matters (Article 6(1)(a) GDPR);
3.1.2. for analytical and statistical purposes – the legal basis for processing is then the legitimate interest of the Controller (Article 6(1)(f) GDPR) consisting in analysing User activity and preferences in order to improve the functionalities and services provided;
3.1.3. in order to establish and pursue possible claims or to defend against them – the legal basis for processing is the legitimate interest of the Controller (Article 6(1)(f) GDPR) consisting in the protection of its rights;
3.1.4. for the Controller’s marketing purposes – the rules for processing personal data for marketing purposes are described in the “MARKETING” section.
User activity on the Portal, including personal data, is recorded in system logs (a dedicated computer program used to keep a chronological record of events and actions concerning the IT system used by the Controller to provide services). The information collected in the logs is processed in connection with the operation of the Portal. The Controller also processes it for technical purposes; in particular, data may be temporarily stored and processed in order to ensure the security and correct operation of IT systems, for example in connection with making backups, testing changes in IT systems, detecting irregularities or protecting against abuse and attacks.
3.2. The Controller makes it possible to get in touch using electronic contact forms or the e-mail address provided. Using the form requires providing the personal data necessary to contact the User. The User may also provide other data to make contact or handling the enquiry easier. Providing the data marked as mandatory is required in order to accept and handle the enquiry; failure to provide it means the enquiry cannot be handled. Providing the remaining data is voluntary.
3.3. Personal data are processed:
3.3.1. in order to identify the sender and handle the enquiry sent through the form provided – the legal basis for processing is that processing is necessary for the performance of a service contract (Article 6(1)(b) GDPR);
3.3.2. in order to identify the sender and handle the enquiry sent through the form provided – the legal basis is consent, where the enquiry concerns a matter other than the intention to conclude a contract (Article 6(1)(a) GDPR);
3.3.3. for analytical and statistical purposes – the legal basis for processing is the legitimate interest of the Controller (Article 6(1)(f) GDPR) consisting in keeping statistics of enquiries submitted by Users through the Portal in order to improve its functionality.
4.1. The Controller processes Users’ personal data in order to carry out marketing activities, which may consist in:
4.1.1. displaying marketing content to the User that is not tailored to their preferences (contextual advertising);
4.1.2. displaying marketing content to the User that matches their interests (behavioural advertising).
5.1. The Controller processes the personal data of Users who visit the Controller’s social media profiles (Facebook). These data are processed solely in connection with running the profile, including in order to inform Users about the Controller’s activity and to promote various events, services and products, as well as to communicate with users through the functionalities available in social media. The legal basis for processing personal data by the Controller for this purpose is its legitimate interest (Article 6(1)(f) GDPR) consisting in promoting its own brand and building and maintaining a community around it.
6.1. Cookies are small text files installed on the device of a User browsing the Portal. Cookies collect information that makes the website easier to use – for example by remembering the User’s visits to the Portal and the actions they take.
6.2. The Controller uses so-called service cookies primarily in order to deliver services provided by electronic means to the User and to improve the quality of those services. Accordingly, the Controller and other entities providing analytical and statistical services to it use cookies, storing information or accessing information already stored on the User’s telecommunications terminal device (computer, phone, tablet, etc.). Cookies used for this purpose include:
6.2.1. cookies containing data entered by the User (session identifier) for the duration of the session (user input cookies);
6.2.2. authentication cookies used for services requiring authentication for the duration of the session (authentication cookies);
6.2.3. cookies used to ensure security, e.g. used to detect authentication abuse (user centric security cookies);
6.2.4. multimedia player session cookies (e.g. flash player cookies) for the duration of the session (multimedia player session cookies);
6.2.5. persistent cookies used to personalise the User interface for the duration of the session or slightly longer (user interface customization cookies);
6.2.6. cookies used to remember the contents of a basket for the duration of the session (shopping cart cookies);
6.2.7. cookies used to monitor website traffic, i.e. data analytics, including Google Analytics cookies (files used by Google to analyse how the User uses the Portal, and to create statistics and reports on how the Portal works). Google does not use the data collected to identify the User, nor does it combine this information in a way that would make identification possible. Detailed information about the scope and rules of data collection in connection with this service can be found at: https://policies.google.com/technologies/partner-sites.
7.1. The period for which the Controller processes data depends on the type of service provided and the purpose of processing. As a rule, data are processed for the duration of the service, or until consent is withdrawn or an effective objection to processing is raised in cases where the legal basis for processing is the legitimate interest of the Controller.
7.2. The processing period may be extended where processing is necessary to establish and pursue possible claims or to defend against them, and after that time only in the cases and to the extent required by law. Once the processing period has ended, the data are irreversibly deleted or anonymised.
8.1. Data subjects have the following rights:
8.1.1. The right to information about the processing of personal data – on this basis the Controller provides the person making such a request with information about the processing of personal data, in particular about the purposes and legal bases of processing, the scope of the data held, the entities to which the personal data are disclosed and the planned date of their erasure;
8.1.2. The right to obtain a copy of the data – on this basis the Controller provides a copy of the processed data concerning the person making the request;
8.1.3. The right to rectification – on this basis the Controller removes any inconsistencies or errors concerning the personal data processed and completes or updates them if they are incomplete or have changed;
8.1.4. The right to erasure – on this basis a person may request the deletion of data whose processing is no longer necessary for any of the purposes for which they were collected;
8.1.5. The right to restriction of processing – on this basis the Controller stops carrying out operations on personal data, except for operations to which the data subject has consented and for their storage in line with the adopted retention rules, or until the reasons for restricting the processing cease to exist (e.g. a decision of the supervisory authority is issued allowing further processing);
8.1.6. The right to data portability – on this basis, to the extent that data are processed in connection with a concluded contract or given consent, the Controller provides the data supplied by the data subject in a machine-readable format. It is also possible to request that these data be sent to another entity – provided that this is technically possible both for the Controller and for that other entity;
8.1.7. The right to object to processing for marketing purposes (if applicable) – the data subject may at any time object to the processing of personal data for marketing purposes, without having to justify the objection;
8.1.8. The right to object to other purposes of processing – the data subject may at any time object to the processing of personal data based on the legitimate interest of the Controller (e.g. for analytical or statistical purposes or for reasons related to the protection of property). Such an objection should contain justification and is subject to assessment by the Controller;
8.1.9. The right to withdraw consent – if data are processed on the basis of consent, the data subject has the right to withdraw it at any time, which however does not affect the lawfulness of processing carried out before the withdrawal;
8.1.10. The right to lodge a complaint – if the data subject considers that the processing of personal data infringes the GDPR or other data protection provisions, they may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).
8.2. A request concerning the exercise of data subject rights may be submitted:
8.2.1. in writing to the address: Academos, ul. Sobieskiego 3/3, 31-136 Kraków, Poland;
8.2.2. by e-mail to: szkola@academos.krakow.pl
8.3. The request should indicate as precisely as possible what it concerns, in particular:
8.3.1. which right the person submitting the request wishes to exercise (e.g. the right to receive a copy of the data, the right to erasure, etc.);
8.3.2. which processing operation the request concerns (e.g. the use of a particular service, activity on a particular website, receiving a newsletter containing commercial information at a given e-mail address, etc.);
8.3.3. which purposes of processing the request concerns (e.g. marketing purposes, analytical purposes, etc.).
8.4. If the Controller is unable to determine the content of the request or to identify the person submitting it on the basis of the notification received, it will ask the applicant for additional information.
8.5. A reply to a request will be given within one month of its receipt. Should it be necessary to extend this deadline, the Controller will inform the applicant of the reasons for the extension.
8.6. The reply will be sent to the e-mail address from which the request was sent and, in the case of requests submitted by post, by ordinary letter to the address indicated by the applicant, unless the letter indicates a wish to receive a reply by e-mail (in which case an e-mail address should be provided).
9.1. In connection with the provision of services, personal data will be disclosed to external entities, in particular to suppliers responsible for the operation of IT systems.
9.2. The Controller reserves the right to disclose selected information concerning the User to the competent authorities or to third parties who request such information on an appropriate legal basis and in accordance with applicable law.
10.1. The Controller does not transfer data outside the European Economic Area.
11.1. The Controller carries out ongoing risk analysis in order to ensure that personal data are processed securely – above all so that only authorised persons have access to the data, and only to the extent necessary for the tasks they perform. The Controller ensures that all operations on personal data are recorded and carried out only by authorised employees and associates.
11.2. The Controller takes all necessary steps to ensure that its subcontractors and other cooperating entities also guarantee the application of appropriate security measures whenever they process personal data on the Controller’s instructions.
12.1. The Controller can be contacted on all matters relating to data processing through the appointed data protection officer at the e-mail address: iodo@pack.edu.pl or the postal address: PACK, ul. Karmelicka 45, 31-128 Kraków, Poland.
13.1. The Policy is reviewed on an ongoing basis and updated where necessary.
13.2. Changes to the Policy come into force 7 days after they are published on the website.
This English version is provided for convenience only. In case of any discrepancy, the Polish version of the Policy prevails.
IB World School 006265
VIII Private Academic Secondary School in Kraków
IB Diploma Programme
PL
EN