privacy policy

This document, issued pursuant to the provisions of Regulation (EU) 2016/679 of the European

Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance), hereinafter referred to as the GDPR or the General Regulation, as well as the Act of 10 May 2018 on the protection of personal data (Journal of Laws, item 1000, as amended), hereinafter referred to as the Act, is commonly referred to as the Privacy Policy.

For the purpose of carrying out tasks performed in the public interest, in particular ideological and financial support of the statutory objectives of the Centaurus Foundation – Animality, and in order to protect the fundamental rights and freedoms of all natural and legal persons using the Animality service, especially their right to the protection of personal data, the rules governing the processing and use of personal data have been established.
The types of personal data collected, stored, and processed result from the manner in which the Service is used and Animality is supported and thus from the provision of certain information (personal data) to the Personal Data Administrator. At every stage, personal data are subject to the protection required by law, and the data subject is entitled to a range of rights related to the processing of their data, which are described in this document.

The controller of personal data is the Service Administrator, i.e. the Centaurus Foundation – Animality, with its registered office in Wrocław, ul. Skarbowców 23a, Building B3, 53-025 Wrocław, entered in the register of associations, other social and professional organizations, foundations, and independent public healthcare institutions maintained in the National Court Register by the District Court in Wrocław, 6th Commercial Division of the National Court Register, under KRS number 0000257551, REGON 020319750, NIP 8982093147.

Contact details of the Personal Data Controller:

• e-mail: kontakt@centaurus.org.pl
• correspondence address:

  Centaurus Foundation – Animality, with its registered office in Wrocław, ul. Skarbowców 23a, Building B3, 53-025 Wrocław

  Contact details of the Data Protection Officer:

• e-mail: kancelaria@u-ska.pl
• correspondence address – Law Firm Uszyński S.K.A., ul. Broniewskiego 48/127, 01-771

  Warsaw.

All information and data are provided voluntarily when using the Service, e.g. in order to conclude a subscription agreement, the relevant form fields are completed and the form is accepted. The Service Administrator sends a message to the provided e-mail address containing a link, the acceptance of which is equivalent to giving consent to the processing of personal data in accordance with the principles set out in the Privacy Policy and the Personal Data Protection Policy.

I. If you contact the Administrator, the following data are processed:

• • First and last name.
  • E-mail address.
  • Telephone number (optional).
  • Mailing address (optional), depending on the method of contact.

II. If a Donor decides to provide support through a Special Donation (donation), etc., the

data provided in connection with the support are processed, in particular:

• First and last name.
• Address.
• Telephone number (in the case of SMS and MMS support).
• Bank account number.

  III. If a Donor decides to conclude a subscription agreement or another service offered by Animality, the data provided for the purpose of concluding and performing the agreement are processed, in particular, depending on the selected Payment Method:

  5. First and last name.
  6. Address.
  7. Telephone number (in the case of SMS and MMS support). 8. Bank account number.
  9. Payment card number.
  10. PIN codes.

  IV. If you subscribe to the newsletter, the following data are processed:

• E-mail address.
• Mailing address (optional), depending on the method of contact.

  V. We process data from cookies stored on your device in accordance with the principles set out in the Cookies Policy.
  VI. If you are present at events or gatherings

  The Centaurus Foundation – Animality kindly informs you that during events and meetings held at the Foundation’s facilities, photographs, photo reports, and videos may be taken and subsequently published, in which the image of persons present, as well as their other personal data, may be captured.

  By participating in meetings, open days, or in the recording of audiovisual materials for the purposes of the Foundation’s website and social media, persons taking part in meetings or events organized or supported by the Foundation consent to the taking and publication of their images in photographs, photo reports, or videos made during such meetings and events.
  Legal basis for the processing and use of personal data

  • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance);

  • The Act of 10 May 2018 on the protection of personal data (Journal of Laws, item 1000, as amended).

Article 6 GDPR
• Processing shall be lawful only if, and to the extent that, at least one of the following

conditions is met:
a) the data subject has given consent to the processing of his or her personal data for one

or more specific purposes;
b) processing is necessary for the performance of a contract to which the data subject is

party, or in order to take steps at the request of the data subject prior to entering into a contract;

c) processing is necessary for compliance with a legal obligation to which the controller is subject;

d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;

e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

f) processing is necessary for the purposes of the legitimate interests pursued by the

controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Point (f) of the first paragraph shall not apply to processing carried out by public authorities in the performance of their tasks.

Article 7 GDPR

• Where processing is based on consent, the controller shall be able to demonstrate that the

  data subject has consented to the processing of his or her personal data.

• If the data subject gives consent in a written declaration which also concerns other

  matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.

• The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. The data subject shall be informed thereof before giving consent. It shall be as easy to withdraw consent as to give it.
• When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

Article 8 GDPR

• Where Article 6(1)(a) applies, in relation to the offer of information society services

  directly to a child, the processing of the personal data of a child who has reached the age of 16 shall be lawful. Where the child is below the age of 16, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.

  Member States may provide by law for a lower age for those purposes, provided that such lower age is not below 13 years.

• In such cases, the controller shall make reasonable efforts, taking into consideration available technology, to verify that consent is given or authorised by the holder of parental responsibility over the child.
• Paragraph 1 shall not affect the general contract law of Member States, such as the rules on the validity, formation, or effect of a contract in relation to a child.

Article 9 GDPR

1. The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, or data concerning health, a person’s sex life, or sexual orientation shall be prohibited.
2. Paragraph 1 shall not apply if one of the following conditions is met:
   a. the data subject has given explicit consent to the processing of those personal data for
3. one or more specified purposes, except where Union law or the law of a Member State provides that the prohibition referred to in paragraph 1 may not be lifted by the data subject;
4. processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law, insofar as it is authorised by Union law or the law of a Member State or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;

• processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;
• processing is carried out in the course of legitimate activities with appropriate safeguards by a foundation, association, or any other non-profit body with a political, philosophical, religious, or trade union aim, provided that the processing relates solely to the members or former members of that body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects;
• processing relates to personal data which are manifestly made public by the data subject;
• processing is necessary for the establishment, exercise, or defence of legal claims or whenever courts are acting in their judicial capacity;
• processing is necessary for reasons of substantial public interest, on the basis of Union law or the law of a Member State, which shall be proportionate to the aim pursued, respect the essence of the right to data protection, and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;
• processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services on the basis of Union law or Member State law or pursuant to contract with a health professional, and subject to the conditions and safeguards referred to in paragraph 3;
• processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union law or Member State law which provides for appropriate and specific measures to safeguard the rights and freedoms of data subjects, in particular professional secrecy;
• processing is necessary for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1), on the basis of Union law or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection, and provide for appropriate and specific measures to safeguard the fundamental rights and the interests of the data subject.

Where the personal data of a data subject are collected from that data subject, the controller shall, at the time when the personal data are obtained, provide the data subject with all of the following information:

• its identity and contact details and, where applicable, the identity and contact details of its representative:

  Centaurus Foundation – Animality, with its registered office in Wrocław, ul. Skarbowców 23a, Building B3, 53-025 Wrocław, entered in the register of associations, other social and professional organizations, foundations, and independent public healthcare institutions maintained in the National Court Register by the District Court in Wrocław, 6th Commercial Division of the National Court Register, under KRS number 0000257551, REGON 020319750, NIP 8982093147

• where applicable – the contact details of the Data Protection Officer: first and last name – Daniel Uszyński

• e-mail – kancelaria@u-ska.pl

• correspondence address – Law Firm Uszyński S.K.A., ul. Wł. Broniewskiego 48/127, 01-771 Warsaw,
  the purposes of the processing of personal data and the legal basis for the processing: pursuant to Article 6(1)(a) GDPR, i.e. on the basis of consent to the processing of personal data (e.g. acceptance of the Regulations),
• pursuant to Article 6(1)(b) GDPR, i.e. where processing is necessary for the performance of a contract to which the data subject is a party (e.g. contracts concluded with the Controller),
  pursuant to Article 6(1)(c) GDPR, i.e. where processing is necessary for compliance with a legal obligation (e.g. obligations towards public authorities),
• pursuant to Article 6(1)(e) GDPR, i.e. where processing is necessary for the performance of a task carried out in the public interest (e.g. informing about the Controller’s statutory objectives, informing about fundraising campaigns, appeals for support, publication of photographs on websites, social media, and the Animality Service),
• pursuant to Article 6(1)(f) GDPR, i.e. where processing is necessary for the purposes of the legitimate interests pursued by the Controller,
  information about the recipients of the personal data or the categories of recipients, if
• any:
  the recipients of personal data, apart from the Controller, shall be exclusively entities authorised to obtain personal data pursuant to applicable legal provisions,
  the period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period:
  processing pursuant to Article 6(1)(a) GDPR – until consent is withdrawn,
  processing pursuant to Article 6(1)(b) GDPR – for a period of 6 years and/or, based on the legitimate interest pursued by the Controller, for a longer period,
  processing pursuant to Article 6(1)(c) GDPR – for a period of 50 years,
  processing pursuant to Article 6(1)(e) GDPR – for a period of 5 years or until consent is withdrawn,
  processing pursuant to Article 6(1)(f) GDPR – for a period of 5 years or until consent is withdrawn.
  information about automated decision-making, including profiling:
  the data will be processed in an automated manner, including in the form of profiling.

• The User has the right to request from the Controller access to the personal data concerning the data subject.
• The User has the right to request from the Controller the rectification of his or her personal data processed by the Controller.

  The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

• The User has the right to request from the Controller the erasure of his or her personal data processed by the Service Controller.

  The data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

  a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

b) the data subject withdraws consent on which the processing is based pursuant to

Article 6(1)(a) or Article 9(2)(a), and where there is no other legal ground for the processing;

c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

d) the personal data have been unlawfully processed;

e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

• The User has the right to request from the Controller the restriction of processing of his or her personal data processed by the Controller.

  The data subject has the right to obtain from the controller restriction of processing where one of the following applies:

  a) the data subject contests the accuracy of the personal data – for a period enabling the controller to verify the accuracy of the personal data;

  b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

  c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise, or defence of legal claims;

  d) the data subject has objected to processing pursuant to Article 21(1) – pending the verification whether the legitimate grounds of the controller override those of the data subject.

• The User has the right to object to the processing of his or her personal data.
  The data subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on Article 6(1)(e)

  or (f), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defence of legal claims.

Pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR), I hereby inform you that:
– the controller of your personal data is the Centaurus Foundation – Animality, with its registered office in Wrocław, ul. Skarbowców 23a, Building B3, 53-025 Wrocław, entered in the register of associations, other social and professional organizations, foundations, and independent public healthcare institutions maintained in the National Court Register by the District Court in Wrocław, 6th Commercial Division of the National Court Register, under KRS number 0000257551, REGON 020319750, NIP 8982093147

– contact with the Data Protection Officer – kancelaria@u-ska.pl

– your personal data will be processed for the purpose of performance of a contract – pursuant to Article 6(1)(b) GDPR, and for purposes necessary for the performance of a task carried out in the public interest – pursuant to Article 6(1)(e) and (f) and Article 9(2)(d) GDPR, as well as on the basis of consent – Article 6(1)(a) GDPR,

– the recipients of your personal data will be exclusively entities authorised to obtain personal data pursuant to applicable legal provisions,

– your personal data will be stored for a period of 6 years / or on the basis of the legitimate interest pursued by the controller,

– you have the right to request from the controller access to personal data, rectification, erasure, or restriction of processing,

– you have the right to lodge a complaint with a supervisory authority,

– the provision of personal data is voluntary; however, refusal to provide data may result in refusal to conclude or perform a contract,

– your data will be processed in an automated manner, including profiling.
During events and meetings held at the Foundation’s facilities, photographs, photo reports, and videos may be taken and subsequently published, in which the image of participants, as well as their other personal data, may be captured. By participating in meetings, open days, or in the recording of audiovisual materials for the purposes of the Foundation’s website and social media, persons taking part in meetings or events organised or supported by the Foundation consent to the recording and publication of their images in photographs, photo reports, or videos taken during such meetings and events.
Pursuant to Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) – hereinafter: GDPR – we inform you that:

• the controller of your personal data is the Centaurus Foundation – Animality, with its registered office in Wrocław, ul. Skarbowców 23a, Building B3, 53-025 Wrocław, entered in the register of associations, other social and professional organizations, foundations, and independent public healthcare institutions maintained in the National Court Register by the District Court in Wrocław, 6th Commercial Division of the National Court Register, under KRS number 0000257551, REGON 020319750, NIP 8982093147,
• contact with the Data Protection Officer – kancelaria@u-ska.pl or Law Firm Uszyński S.K.A., ul. Wł. Broniewskiego 48/127, 01-771 Warsaw,
• your personal data will be processed for purposes necessary for the performance of a task carried out in the public interest – pursuant to Article 6(1)(e) and (f) and Article 9(2)(d) GDPR, as well as on the basis of consent – Article 6(1)(a) GDPR,
• participation in events and, consequently, the provision of personal data in the form of an image is voluntary; however, it is necessary in order to participate in events,
• recipients of personal data may include anyone who views photographs, photo reports, or videos published on the website and on social media,
• your data will be processed in an automated manner, including profiling,
• if a person’s image does not constitute merely a detail of a whole, such as participation in

  an event, open day, gathering, or landscape, each person has the right to withdraw consent to the processing of their image. Withdrawal of consent does not have retroactive effect – processing shall remain lawful until the moment consent is withdrawn by the data subject,

• your personal data will be stored for a period of 6 years / or on the basis of the legitimate interest pursued by the controller,
• everyone also has the right to access their data, to rectify, erase, or restrict processing, and to data portability,
• everyone has the right to object to processing,
• you have the right to lodge a complaint with the President of the Personal Data Protection

  Office regarding unlawful processing of your personal data.