Privacy and Cookie Policy
Nicolaus Copernicus University in Toruń attaches particular importance to respecting the privacy of users of the website of the Institute of Advanced Studies at Nicolaus Copernicus University in Toruń, hereinafter referred to as IAS@NCU or the Service.
This Privacy and Cookie Policy explains how personal data are processed in connection with the use of the IAS@NCU website, including the contact form, server logs, cookies, Google Analytics 4, Google Tag Manager and external links.
- Data Controller
The controller of personal data processed in connection with the use of the Service is:
Nicolaus Copernicus University in Toruń
ul. Gagarina 11
87-100 Toruń
Poland
hereinafter referred to as NCU or the University.
The Institute of Advanced Studies at Nicolaus Copernicus University in Toruń is an organisational unit operating within NCU and is not a separate data controller. - Data Protection Officer
NCU has appointed a Data Protection Officer. You may contact the Data Protection Officer in all matters concerning the processing of personal data and the exercise of rights related to data protection:
Data Protection Officer
Nicolaus Copernicus University in Toruń
e-mail: iod@umk.pl
tel. +48 56 611 27 42 - Scope of processed data
Depending on how the user uses the Service, the following categories of personal data may be processed:- a) name and surname;
- b) e-mail address;
- c) telephone number, if provided;
- d) affiliation, institution or organisation, if provided;
- e) content of the message submitted through the contact form or by e-mail;
- f) technical data related to the use of the Service, including IP address, date and time of access, browser type, operating system, device parameters, language settings, visited pages, traffic source and similar data;
- g) data related to cookie consent choices and website settings.
- Methods of data collection
Personal data may be collected in the following ways:- a) when the user voluntarily provides data through the contact form or by e-mail;
- b) automatically when the user uses the Service, in particular through server logs;
- c) through necessary cookies and similar technologies required for the proper functioning and security of the Service;
- d) through analytical cookies, including Google Analytics 4, only after the user gives consent.
- Purposes of data processing
Personal data may be processed for the following purposes:- a) responding to inquiries submitted through the contact form or by e-mail;
- b) conducting correspondence related to the activities of IAS@NCU;
- c) providing information concerning the scientific, organisational, administrative, educational or promotional activities of IAS@NCU;
- d) handling matters related to events, calls, programmes, projects, research teams or other initiatives organised or supported by IAS@NCU, where applicable;
- e) ensuring the proper functioning, security and administration of the Service;
- f) maintaining server logs and protecting the Service against technical errors, abuse, security incidents or unauthorised access;
- g) creating statistical analyses of website use, including the number of visits, traffic sources and popularity of individual pages;
- h) improving the content, structure, usability and accessibility of the Service;
- i) managing cookie preferences and user consent choices;
- j) fulfilling legal, archiving, accountability, reporting or documentation obligations imposed on NCU.
- Legal bases for processing
Personal data are processed in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation, hereinafter referred to as GDPR.
Depending on the purpose of processing, the legal basis may be:- a) Article 6(1)(e) GDPR — processing is necessary for the performance of a task carried out in the public interest, in particular in connection with the scientific, educational, organisational, informational and administrative activities of NCU and IAS@NCU
- b) Article 6(1)(c) GDPR — processing is necessary for compliance with legal obligations incumbent on NCU, including documentation, archiving, accountability and reporting obligations;
- c) Article 6(1)(a) GDPR — consent, where processing is based on consent, in particular in the case of analytical cookies, including Google Analytics 4.
Where processing is based on consent, the user has the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
- Contact form
The contact form available on the Service may be used to contact IAS@NCU.
Providing personal data in the contact form is voluntary, but failure to provide the data required in the form may prevent IAS@NCU from responding to the inquiry.
Data submitted through the contact form are processed in order to handle the inquiry, conduct correspondence and document the course of the matter.
The data submitted through the contact form are not used for marketing, advertising or profiling purposes. - Server logs
When using the Service, certain technical information may be automatically recorded in server logs. This may include, in particular:- a) IP address;
- b) date and time of connection;
- c) URL address of the requested page;
- d) information about the browser and operating system;
- e) information about errors or security events.
Server logs are used for the purposes of administering the Service, ensuring its security, diagnosing technical problems and protecting the Service against abuse or unauthorised access.
- Cookies and similar technologies
The Service may use cookies and similar technologies.
Cookies are small text files stored on the user’s device. Similar technologies may include, in particular, local storage, session storage, tags or scripts.
The Service may use the following categories of cookies and similar technologies:- a) necessary cookies — required for the proper functioning, security and administration of the Service, including remembering cookie consent choices;
- b) functional cookies — used to remember user preferences, if such functionalities are implemented;
- c) analytical cookies — used to collect statistical information about the use of the Service, including Google Analytics 4.
Necessary cookies may be used without the user’s consent where they are required to provide the Service or ensure its security.
Analytical cookies are used only after the user gives consent.
The user may accept analytical cookies, reject non-essential cookies or manage cookie preferences through the cookie banner or cookie settings available on the Service.
The user may withdraw or change cookie consent at any time through the cookie settings available on the Service or by changing browser settings.
The Service does not use cookies for advertising, remarketing or behavioural advertising.
- Google Analytics 4
The Service may use Google Analytics 4 for statistical and analytical purposes.
Google Analytics 4 is used only to understand how users interact with the Service, in particular to analyse:- a) the number of visits;
- b) traffic sources;
- c) popular pages;
- d) general user interactions with the Service;
- e) approximate technical parameters of devices and browsers;
- f) general trends in the use of the Service.
The data collected through Google Analytics 4 are used to improve the content, structure, usability and accessibility of the Service.
Google Analytics 4 is not used for advertising, remarketing, marketing profiling or behavioural advertising.
Google Signals, advertising features and remarketing functions are not enabled.
Google Analytics 4 is activated only after the user gives consent to analytical cookies.
Data collected through Google Analytics 4 are retained for 14 months and are then automatically deleted, unless a shorter period is required by law or internal University rules.
- Google Tag Manager
The Service may use Google Tag Manager to manage technical and analytical tags used on the Service.
Google Tag Manager is used to manage scripts and consent-dependent tags. It should not activate Google Analytics 4 before the user gives consent to analytical cookies. - Tools not used by the Service
The Service does not use:- a) advertising cookies;
- b) remarketing tools;
- c) Google Signals;
- d) Google Ads personalisation;
- e) Meta/Facebook Pixel;
- f) session replay tools;
- g) heatmaps;
- h) tools recording user sessions;
- i) tools recording entries in forms;
- j) embedded YouTube videos, players or iframes.
- External links
The Service may contain links to external websites and social media services, including YouTube, Facebook, LinkedIn or other platforms.
These are standard external links. The Service does not embed YouTube videos, players or iframes.
When the user follows an external link, the user leaves the IAS@NCU Service. The processing of personal data on external websites is governed by the privacy policies and terms of use of the respective external service providers.
NCU is not responsible for the privacy practices of external websites or external service providers. Users are encouraged to read the privacy policies of those providers before using their services. - Recipients of personal data
Personal data may be accessed by authorised employees and organisational units of Nicolaus Copernicus University in Toruń, including persons responsible for:- a) handling correspondence;
- b) administering the Service;
- c) ensuring IT security;
- d) analysing website statistics;
- e) documenting and archiving matters handled through the Service.
In connection with the use of Google Analytics 4 and Google Tag Manager, certain data may be processed by Google as the provider of these tools, subject to the user’s consent to analytical cookies and the applicable data processing terms.
Personal data may also be disclosed to public authorities or other authorised entities, where required by law.
The current list of cookies and analytical tools used on the Service should be available in the cookie settings panel.
- Technical maintenance of the Service
The ongoing technical maintenance, administration, security and statistical analysis of the Service are carried out within the structures of Nicolaus Copernicus University in Toruń by authorised persons and organisational units.
In this respect, NCU does not entrust the ongoing technical maintenance or statistical analysis of the Service to an external service provider.
If, in the future, an external provider is granted access to the Service, server, CMS, contact form, logs or analytical data, the relevant data processing arrangements will be verified and implemented in accordance with GDPR. - Transfer of data outside the European Economic Area
Some external providers used in connection with the Service, in particular Google, may process data outside the European Economic Area.
Where personal data are transferred outside the European Economic Area, NCU applies or verifies appropriate safeguards required by GDPR, in particular adequacy decisions of the European Commission, standard contractual clauses or other mechanisms provided for by law.
The scope and rules of such transfers may also be described in the privacy policies and data processing terms of the relevant external providers. - Data retention
Personal data are stored for the period necessary to fulfil the purposes for which they were collected.
In particular:- a) data submitted through the contact form are stored for the period necessary to handle the inquiry and conduct correspondence, and thereafter for the period required by law, internal archiving rules or the need to document the course of the matter;
- b) data processed in connection with events, calls, programmes, projects or other initiatives are stored for the period resulting from applicable rules, project documentation, archiving obligations, internal regulations or legal provisions;
- c) server logs are stored for the period necessary to ensure the security, administration and proper operation of the Service;
- d) data processed on the basis of consent are processed until consent is withdrawn, unless another legal basis for processing applies;
- e) data collected through Google Analytics 4 are retained for 14 months.
- Rights of data subjects
In accordance with GDPR, the user may have the right to:- a) access personal data;
- b) obtain a copy of personal data;
- c) request rectification of inaccurate personal data;
- d) request erasure of personal data, where applicable;
- e) request restriction of processing;
- f) object to processing, where applicable;
- g) withdraw consent at any time, where processing is based on consent;
- h) data portability, where applicable;
- i) lodge a complaint with the supervisory authority.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
- Right to lodge a complaint
The user has the right to lodge a complaint with the supervisory authority if the user considers that the processing of personal data violates GDPR.
In Poland, the supervisory authority is:
President of the Personal Data Protection Office
Prezes Urzędu Ochrony Danych Osobowych - Automated decision-making and profiling
Personal data processed in connection with the use of the Service are not used for automated decision-making producing legal effects concerning the user or similarly significantly affecting the user.
The Service does not use personal data for advertising, remarketing, behavioural advertising or marketing profiling. - Data security
NCU applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration or disclosure.
Access to personal data is granted only to authorised persons and organisational units to the extent necessary to perform their tasks. - Changes to the Privacy and Cookie Policy
This Privacy and Cookie Policy may be amended in particular if the functionality of the Service changes, new tools are implemented, the scope of personal data processing changes or legal requirements are amended.
The current version of the Privacy and Cookie Policy is published on the Service.