INFORMATION CLAUSE

in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation; OJ EU L 2016.119.1; hereinafter “GDPR”)

1. Personal Data Controller

The controller of personal data is the Buddhist Association of the Diamond Way of Karma Kagyu Lineage (mailing address: ul. Ożarowska 65/67, 01-408 Warsaw), Tax Number (NIP): 7761461936, National Business Registry Number (REGON): 610200801 (hereinafter “Controller”).

For matters related to data protection, you may contact the Controller at the above address or via email: rodo@buddyzm.pl.

2. Purpose and legal basis for the processing of personal data

Personal data is processed to pursue the Controller’s legitimate interest (Article 6(1)(f) GDPR  and Article 9(2)(d) GDPR), which consists of organizing an event as part of the Controller’s activities and managing the proceeds from participants’ fees, as well as, where applicable, establishing, pursuing, and defending against claims.

Providing the data is necessary to register for the event, and failure to do so will result in the inability to participate in the event.

If a person filling out the form provides the other participant’s data, the Controller processes the participant’s data provided by that person for the aforementioned purpose —i.e., first and last name.

Photographs or videos may be taken during the event, which will be done based on the Controller’s legitimate interest (Article 6(1)(f) GDPR) in documenting the event. These materials will not be publicly distributed.

3. Retention Period for Personal Data

Personal data collected during the registration process is retained for the period necessary to organize the event. Photos and videos will be retained for as long as the Controller has an interest in documenting the event. These periods may be extended by the statute of limitations for civil claims.

4. Recipients of Personal Data

Categories of recipients:

  1. entities providing IT services to the Controller,
  2. other controllers, when necessary to achieve the purposes specified in this clause and to the extent necessary for that purpose (banks, payment processors—in the case of online payments),
  3. public authorities or other entities authorized by law.

5. Rights Regarding the Processing of Personal Data

The data subject has the right to:

  1. access the data, including obtaining a copy of the data;
  2. rectify and erase the data;
  3. restrict processing;
  4. object to the processing of personal data;
  5. lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (www.uodo.gov.pl).

6. Automated decision-making and profiling

Personal data will not be used for automated decision-making, including profiling.