Privacy Policy - Malta Festival Poznań 2019

I.
PRELIMINARY PROVISIONS

1. The website under the address: "http://malta-festival.pl" (hereinafter called: "Website") is managed by Malta Foundation with its registered office in Poznań (61-728) at ul. Ratajczaka 44, entered to the register of businesses and the register of associations, other community and professional organisations, foundations, and public health care facilities maintained by the District Court in Poznań - Nowe Miasto and Wilda in Poznań VIII Division of the National Court Register as KRS number: 0000150077, REGON: 634446340, which is the organiser of a cultural event called: "Malta Festiwal" (hereinafter called: "Festival").
2. Contact data of the Organiser: telephone number: +48 61 6231866, e-mail address: office@malta-festival.pl.
3. The Website presents information about the Festival.
4. The Website offers the following services to the Users:
a. registration/setting up an account,
b. submission of an industry accreditation application,
c. submission of an application for voluntary work,
d. subscription to a “Newsletter" service.

II.
GENERAL PRINCIPLES OF PERSONAL DATA PROTECTION

1. The Organiser is the administrator of the personal data provided by the Users via the Website.
2. Until 25 May 2018, personal data of the Users has been processed by the Administrator in accordance with the act of 29 August 1997 on personal data protection (hereinafter called: “APDP"), and as of 25 May 2018, i.e. upon the entry into force of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter called: GDPR) - in accordance with GDPR.
3. The Administrator employs appropriate technical and organisational means ensuring the protection of the processed personal data.
4. The Users voluntarily submit their personal data and consent to its processing. Submitting personal data is not a statutory or contractual duty, but it is a necessary condition for using all functionalities of the Website set out in this Privacy Policy.
5. The consent for the processing of personal data granted by the User may be retracted at any given moment. The retraction does not affect the legality of the processing performed before the consent was retracted.
6. In case of an individual who us under 16 years of age, the consent to the processing of personal data must be given by a person exercising parental authority or legal guardianship.
7. Personal data of the Users will not be made available to any data recipients within the meaning of Article 7 item 6 of APDP and Article 4 item 9 of GDPR.
8. The data subject has the following rights:
a. the right of access to their data in accordance with Article 24 section 1 item 3 of APDP and Article 15 of GDPR;
b. the right to rectify their data, in accordance with Article 24 section 1 item 3 of APDP and Article 16 of GDPR;
c. the right to remove their data (“the right to be forgotten”), in accordance with Article 17 of GDPR;
d. the right to limit their data, in accordance with Article 18 of GDPR;
e. the right to transfer data, in accordance with Article 20 of GDPR;
f. the right to object to the processing of data relating to them, in accordance with Article 21 of GDPR.
In order to exercise the above-mentioned rights, one should contact the Administrator, whose data has been provided in the General Principles of this Privacy Policy.
9. The User is also entitled to submit a complaint to the supervisory authority - if they believe that the processing of their data breaches GDPR.

III.
REGISTRATION ON THE WEBSITE

1. Setting up an account on the Website requires sharing the following personal data of the User:
a. forename and surname,
b. e-mail address,
c. place of residence (optional).
2. Setting up an account on the Website allows the Users to use all the functionalities of the Service, including the personalisation of the schedule of the Festival through marking individual events, in which the User wishes to participate.
3. The Organiser processes the personal data submitted by the User solely for the purpose given in section 2 above, upon receiving prior consent of the User.
4. Personal data in the form of a place of residence is processed by the Organiser for the purpose of sending the User a written brochure announcing subsequent editions of the Festival.
5. Personal data of the Users is processed under Article 23 section 1 item 1 APDP / Article 6 section 1 letter a of GDPR, i.e. in relation to the User’s consent to such processing.
6. Personal data of the Users is also processed in accordance with Article 23 section 1 item 5 APDP / Article 6 section 1 letter f of GDPR, i.e. in relation to the fact the the processing is necessary for the implementation of objectives resulting form legitimate interests of the Administrator, i.e. the promotion of the Festival among the participants through allowing them an opportunity to personalise the schedule of the Festival.
7. The Users’ personal data will be processed until the purpose for its processing ceases to exist or until the User retracts their Consent.

IV.
ACCREDITATION APPLICATIONS

1. A submission of an industry accreditation application requires sharing the following personal data of the User:
a. forename and surname,
b. e-mail address,
c. telephone number,
d. company,
e. registered office of the company,
f. Tax Identification Number (NIP) of the company.
2. The submission of an industry accreditation application makes it possible for the User to obtain the consent of the Organiser to participate in chosen events of the Festival under the conditions set out in Accreditation regulations (but does not guarantee it).
3. The Organiser processes the personal data submitted by the Users solely for the purposes set out in section 2 above, upon receiving a prior consent of the User.
4. Personal data of the Users is processed in accordance with Article 23 section 1 item 1 of APDP / Article 6 section 1 letter a of GDPR, i.e. as a consequence of User’s consent to such processing.
5. Personal data of the Users is processed in accordance with Article 23 section 1 item 5 of APDP / Article 6 section 1 letter f of GDPR, i.e. as a consequence of the the fact that the processing is necessary for the implementation of objectives resulting from legitimate interests of the Administrator, i.e. the promotion of the Festival among journalists and persons professionally involved in the media, culture and theatre.
6. Personal data of the Users will be processed until the purpose for its processing ceases to exist or until the User retracts their Consent.
7. Personal data of the Users submitting accreditation applications may be transferred to the United States of America (USA) to the following entity: Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 under the conditions set out in the Privacy Policy available at: https://mailchimp.com/legal/privacy/. Rocket Science Group LLC is a holder of a Privacy Shield certificate certificate, which in accordance with the decision of the European Commission is an indicator of appropriate level of protection and security for transferred personal data.

V.
VOLUNTARY WORK

1. A submission of an application for voluntary work requires sharing the following personal data of the User:
a. forename and surname,
b. date of birth,
c. e-mail address,
d. telephone number,
e. place of residence,
f. current job/occupation.
2. The submission of an application for voluntary work makes it possible for the User to conclude a contract for voluntary work with the Organiser (but does not guarantee it).
3. The Organiser processes the personal data submitted by the Users solely for he purposes set out in section 2 above, upon receiving a prior consent of the User.
4. Personal data of the Users is processed under Article 23 section 1 item 1 of APDP / Article 6 section 1 letter a of GDPR, i.e. as a consequence of the User’s consent to such processing.
5. Personal data of the Users is processed also in accordance with Article 23 section 1 item 5 of APDP / Article 6 section 1 letter f of GDPR, i.e. as a consequence of the the fact that the processing is necessary for the implementation of objectives resulting from legitimate interests of the Administrator, i.e. the promotion of the Festival among voluntary workers and makes it possible for the voluntary workers to work for the Festival.
6. Personal data of the Users will be processed until the purpose for its processing ceases to exist or until the User retracts their Consent.
7. Personal data of the Users submitting applications for voluntary work may be transferred to the United States of America (USA) to the following entity: Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 under the conditions set out in the Privacy Policy available at: https://mailchimp.com/legal/privacy/. Rocket Science Group LLC is a holder of a Privacy Shield certificate, which in accordance with the decision of the European Commission, is an indicator of appropriate level of protection and security for the transferred personal data.

VI.
NEWSLETTER

1. Subscription to the "Newsletter" service requires sharing an e-mail address of the user as well as a confirmation of the subscription by clicking an activation link received in an e-mail.
2. Subscription to the "Newsletter" service allows the Users to receive information from the Organiser about the most important events of the festival.
3. The Organiser processes the personal data submitted by the Users solely for purposes set out in section 2 above, upon receiving a prior consent of the User.
4. Personal data of the Users is processed under Article 23 section 1 item 1 of APDP / Article 6 section 1 letter a of GDPR, i.e. as a consequence of the User’s consent to such processing.
5. Personal data of the Users is also processed in accordance with Article 23 section 1 item 5 of APDP / Article 6 section 1 letter f of GDPR, i.e. as a consequence of the fact that the processing is necessary for the implementation of objectives resulting from legitimate interests of the Administrator, i.e. the promotion of the Festival among the participants and providing them with information about the most important events of the Festival.
6. Personal data of the Users will be processed until the purpose for its processing ceases to exist or until the User retracts their Consent.
7. Personal data of the Users using the “Newsletter” service may be transferred to the United States of America (USA) to the following entity: Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 under the conditions set out in the Privacy Policy available at: https://mailchimp.com/legal/privacy/. Rocket Science Group LLC is a holder of a Privacy Shield certificate, which in accordance with the decision of the European Commission is an indicator of appropriate level of protection and security for the transferred personal data.

VII.
COOKIES

1. The Website makes use of cookies.
2. Cookies are text files which are kept in the terminal equipment of the Website User.
3. Cookies include the name of the Internet site of their origin, their unique number as well as the time they are to be stored on the terminal equipment.
4. Cookies used by the Administrator are safe for the terminal equipment of the User. The files allow to identify the software used by the User and adjust the website to the their individual requirements. No viruses or other undesirable software can penetrate the User’s equipment this way.
5. The Administrator may use two types of cookies:
a. session cookies, which are temporary files kept on the User’s terminal equipment, and which remain there until the session of a given browser is terminated i.e. until the moment of logging out, leaving the internet site or turning off the software (the Internet browser). Information saved in this way is permanently removed from the memory of the equipment. The session cookies mechanism does not allow the download of any personal data or any confidential information from the equipment of the User;
b. persistent cookies, which are stored in the terminal equipment of the User for a period determined in the file parameters or until their removal by the User. The termination of the session itself or turning the equipment off does not cause their removal from the equipment of the User.
6. The session and persistent cookies mechanism does not allow the Administrator or other subjects to download any of the User’s personal data or any confidential information from the User’s equipment.
7. The Administrator has the right to use cookies for the following purposes:
a. appropriate configuration of the Website, which in particular allows the recognition of the equipment of the Website User as well as their location and ensures proper display of the website adjusted to individual needs by saving the settings selected by the User and saving the history of individual pages visited by the Website User.
b. authorisation of the User on the Website and ensuring a User session on the Website with appropriate configuration of the selected functions of the Website, enabling the verification of the authenticity of the browser session and maintaining a Website User session (after logging in), thanks to which the User will not have to enter their login and password again;
c. analysing and tracking the viewing figures of the Website through generating anonymous statistics.
8. The user has the option of limiting or turning off the access to cookies on their terminal equipment. The change in settings mentioned above may be done via Internet browser settings.
9. Limiting the use of cookies may influence some functionalities available on the Website.
10. The User may remove cookies at any given moment by employing the functions available on the Internet browser they use.