GDPR

INFORMATION ON THE PROCESSING OF PERSONAL DATA

Pursuant to the Regulation of the European Parliament and the EU Council 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and the repeal of Directive 95/45/EC, hereafter “GDPR”, we wish to inform that:

Data Administrator:
The data Administrator is the Auschwitz-Birkenau State Museum in Oświęcim, ul. Więźniów Oświęcimia 20. Tax ID: 5490005549, REGON (National Official Business Register): 000276015 (hereafter the Museum).
Data Protection Officer:
The Museum has appointed a Data Protection Inspector, address: ul. Więźniów Oświęcimia 20, 32-600 Oświęcim, e-mail address:
Categories of personal data:
The Museum processes personal data obtained from the data subjects.
These data include identification (video, audio-visual, audio and thermo-visual surveillance) data of visitors to the Museum, necessary for the conclusion and performance of contracts, agreements, issuing of certificates; data of applicants, users of the IT systems, libraries; data of persons participating in ceremonies, commemorations and educational programs; data of TV crews, drone operators and journalist accreditations.
Legal bases and purpose of data processing:
Personal data may be processed by the Museum for the purpose of carrying out its statutory activities, among others:
1. for the conclusion and performance of contracts, agreements, including the reservation of entry passes to the Museum, implementation of projects in accordance with the EU funding agreement, pursuant to Article 6(1)(b), (c), (e) and (f) of the GDPR,
2. for the implementation of application procedures, information
and archival activities, lending of library resources and tasks related to scientific research, pursuant to Article 6(1)(d) and (e) of the GDPR,
3. related to the dissemination of the history of KL Auschwitz, implementation of exhibitions
and conservation activities, tasks related to the image of the Museum, pursuant to Article 6(1)(c), (e), and (f) of the GDPR,
4. relating to recruitment for vacant positions, pursuant to Article 6(1)(c) of the
GDPR, and for conducting future recruitment processes, provided consent has been granted for data processing pursuant to Article 6(1)(a) of the GDPR,
5. related to ensuring the safety of facilities and persons
on the premises of the Museum (including video, audio-visual and thermo-visual surveillance), measuring the body temperature of people entering the Museum premises, pursuant to Article 6(1)(d) and/or (e) and Article 9(2)(i) of the GDPR,
6. for the improvement of safety and service quality by
monitoring (audio surveillance) certain incoming calls, pursuant to Article 6(1)(d) and/or (e) of the GDPR,
7. for the implementation of educational activities, tasks related to
the organisation of celebrations, commemorations pursuant to Article 6(1)(e) of the GDPR,
8. for the implementation of the findings or the assertion of possible claims, or
defence against such claims, pursuant to Article 6(1)(f) of the GDPR.
Sharing of personal data:
Your data may be transferred to entities processing them at the request of the Museum, e.g. subcontractors, service providers, cooperating entities, entities acting as intermediary institutions or entrusted with the implementation of an EU programme (concerning EU grants), postal operators, couriers, banks, carriers adequately to the purpose of their processing. Furthermore, it may also be transferred to entities authorised to obtain data under the applicable law if requested under the relevant legal basis.
Transfer of personal data to a third country:
Personal data collected by the Museum will not be transferred to a third country unless the target country provides an adequate level of personal data protection on its territory, and the necessity to transfer data shall be based on appropriate legal bases.
Data retention period:
Your personal data will be stored for the following duration:
1. for the performance and validity of contracts, agreements, including the reservation of entry passes
to the Museum, implementation of projects in accordance with the EU funding agreement - until the intended purpose is accomplished and the right to claims expires, and upon its expiry for the period resulting from legal provisions, including accounting, office and archival regulations.
2. for the implementation of application procedures; information,
archival and educational activities, tasks related to scientific research and organisation of ceremonies, commemorations until the intended purpose is achieved and the right to claims expires, and after that for a period arising from legal provisions, including accounting, office and archival regulations.
3. for the performance of tasks in the scope of lending library resources, in
the IT systems and databases, among others, databases of contracting parties, accreditation of journalists and databases of TV crews, drone operators; in the entry pass reservation system, guide services, in the Internet shop, until the expiry of the right to claims or validity of the account (depending on which term is longer), and upon its expiry, for the period resulting from legal provisions, including accounting, office and archival regulations.
4. in the database system for sending e-mail messages with information
related to the activities of the Museum (newsletter) - until the data subject revokes the consent,
5. for the implementation of tasks related to the dissemination of the history of KL Auschwitz,
exhibition activities, conservation activities, with the image of the Museum - until the intended purpose is achieved, and afterwards for the period resulting from legal provisions, including accounting, office and archival regulations.
6. for the duration of the recruitment process for vacancies and up to 6 months after
its completion, and afterwards for a period defined by law, including accounting provisions, or until the withdrawal of consent, if granted
7. for the performance of tasks related to ensuring the safety of facilities and persons on the premises of the Museum - until the intended purpose is achieved and the right to claims expires, and after that for the period resulting from legal regulations, including accounting, office and archival regulations.
8. for up to 30 days in the video and audio-visual monitoring system, but
up to 3 months in the audio monitoring system, and in the case of thermo-visual monitoring up to 24 hours. In the case of investigation proceedings or investigations, for the time necessary to carry out the activities mentioned above, or until the judicial proceedings are finally concluded.
9. for the implementation of findings or investigation of possible claims, or
defence against such claims; the processing period may be extended each time by the period of limitation of claims, and upon its expiration, for a period arising from legal provisions, including accounting regulations,
10. until such consent is revoked if granted.
Vested rights:
In connection with the processing of your personal data by the Museum, you have the right to:
1. access the content of your data, as well as to rectify, delete, restrict processing; the right to transfer data, object to data processing including profiling,
2. withdraw consent at any moment and by any means, if your data is processed by the Museum based on consent, without affecting the legitimacy of processing, which was done before the withdrawal of consent.
3. lodge a complaint to the Inspector General for Personal Data Protection, if you have reasons to believe that the processing of personal data violates the provisions of the GDPR.
Requirement to provide data:
Provision of personal data is a prerequisite for achieving the objectives set out in pt. 4. You are obliged to provide them; failure to do so will result in the inability to undertake actions aimed at implementing the objectives.
Automated decision-making, including profiling
The Museum does not profile personal data transferred to it.