Privacy policy at MUL

  1. The purpose of this Privacy Policy is to define the principles of data processing as part of the activities of the data Controller, particularly with the use of the Internet Service, hereinafter referred to as the Service.
  2. This Privacy Policy is applicable in any cases of processing of natural persons’ personal data by the Controller.
  3. Based mainly on Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter referred to as GDPR (General Data Protection Regulation), the Controller shall take all the necessary measures to protect personal data processing.
  4. Personal data means any information relating to an identified or identifiable natural person as data subjects. The identified person means a natural person who can be identified directly or indirectly, particularly on the basis of the identifiers such as name and surname, identification number, location data, internet identifier or one or more specific factors which determine physical, pysiological, genetic, mental, economic, cultural or social identity of a natural person.
  5. Medical University of Lodz, 90-419 Lodz, Al. Kościuszki 4. is the personal data Controller, hereinafter referred to as the Controller. The Controller has designated the Data Protection Officer (DPO), who supervises the correctness of data processing. DPO can be conntacted by sending an e-mail on: iod@umed.lodz.pl
  6. The Controller shall process personal data taking all the safety measures compliant with Polish Law, GDPR in particular.
  7. The Controller shall obtain the information on data subjects and their behaviour in the following ways:
    1. through the information entered voluntarily in the forms,
    2. through cookies files saved in end-devices (so called “cookies”).
  8. The Service collects the information provided voluntarily by the user.
  9. The Controller shall process the data lawfully, fairly and in a transparent manner in relation to the data subject. The processing of personal data by the Controller in a lawful manner means that the Controller processes personal data only if there is a clear legal basis for it resulting directly from GDPR or other EU or national generally applicable provisions of law.
  10. The Controller shall collect data for specified, explicit and legitimate purposes and shall not further process the data in a manner that is incompatible with those purposes. In the event of having no purpose for data processing, the Controller shall delete the data without delay unless the right to further processing results from generally applicable provisions of law. The Controller makes periodical assessment of the legitimacy of processing specific personal data, taking into account the current purposes for their processing.
  11. The Controller shall process the data which shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. The Controller shall constantly strive for personal data processing minimisation. For this purpose, the Controller shall periodically assess the scope and types of personal data processed in order to specify the necessity of their processing or the option of their permanent deletion.
  12. The Controller shall make sure that the personal data he/she processes are accurate and, where necessary and possible, kept up to date.
  13. The Controller shall keep the data in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; taking into account relevant provisions of law which enable the Controller to process personal data for a specified period of time, which particularly referres to the period of storing medical records, personal files, asserting rights and the period of limitation of claims. When the personal data storage period expires, the Controller, as a rule, shall permanently delete the personal data forthwith, unless separate provisions of law impose on the Controller the obligation to archive documentation that contains personal data.
  14. The Controller shall process personal data for the porpose of responding to the messages received via the Service on the basis of a voluntary consent of the Service user (Art. 6 item 1 a GDPR) and for the purpose of analytical analyses consisting in particular in the study and analysis of traffic on the specified website and collection of statistical data.
  15. Personal data of the users shall be stored by the Controller until he/she receives a reply to a message, or the consent is withdrawn, whichever happens first.
  16. The Controller shall not process the data in an automated manner and shall not use the data for profiling.
  17. The Controller shall not transfer personal data outside European Economic Area (including European Union, Norway, Lichtenstein and Iceland).
  18. Each data subject has the following rights:
    1. to access to the data: to obtain from the Controller the confirmation whether or not their data are being processed. If a person’s data are processed, they have the right to access their personal data and to obtain the following information: the purpose of processing, the categories of personal data concerned, the recipients or categories of recipient to whom the personal data have been or will be disclosed, the period for which the personal data will be stored and the criteria used to determine that period, to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject and to express an objection against their data processing (Art.15 GDPR);
    2. to obtain a copy of the personal data, where the first copy is free of charge and for any further copies requested by the data subject, the Controller may charge a reasonable fee based on administrative costs (Art. 15 (3) GDPR);
    3. to rectify the data: the data subject shall have the right to request the rectification of inaccurate personal data concerning him or her or to have incomplete personal data completed (Art.16 GDPR);
    4. to erasure of personal data when the Controller has no more legal grounds for their processing, or the personal data are no longer necessary in relation to the purposes for processing (Art.17 GDPR);
    5. to restriction of processing: the data subject can request the restriction of their personal data processing (Art.18 GDPR) when:
      1. the accuracy of the personal data is contested by the data subject, for a period enabling the Controller to verify the accuracy of the personal data,
      2. the processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead,
      3. the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims,
      4. the data subject has objected to processing pending the verification whether the legitimate grounds of the Controller override those of the data subject;
    6. to data portability: to receive the personal data concerning him or her, which he or she has provided to a Controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another Controller if the data are processed pursusnt to the data subject consent or a contract the data subject entered, and the processing is carried out by automated means (Art. 20 GDPR);
    7. to object: the data subject shall have the right to object to their personal data processing on legitimate grounds for the processing, on grounds relating to his or her particular situation, including profiling. The Controller shall demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. If the interests of the Controller are shown to be overridden by the interests of the data subject, the Controller shall no longer process the personal data for these purposes (Art.21 GDPR);
    8. to withdraw the consent at any time without giving reasons for the withdrawal, without affecting the lawfulness of processing based on consent before its withdrawal. The withdrawal of the consent means that the Contoller shall stop the data processing for the purpose for which the consent was given, this concerns only the cases when the consent provided legal grounds for processing.
  19. Providing personal data is entirely voluntary.
  20. The data subject has the right to lodge a complaint with a supervisory authority i.e., the President of the Personal Data Protection Office, with a registered seat in Warsaw. Complaints can be submitted in the following manners:
    1. written complaint sent to: Stawki 2, 00-193 Warszawa,
    2. electronically: via ePUAP platform.
  21. The service uses cookies which shall be construed as short text information sent by a web server and saved on the user’s side (usually on the hard drive) and usually contain the name of the website they come from, their storage time on the end device and a unique number. The default parameters of cookies allow the information contained in them to be read only by the server that created them. These files allow to recognise the user’s device and properly display the website tailored to the user’s individual preferences.
  22. By continuing to use our website, without changing your browser’s privacy settings, you consent to the processing of your personal data such as your IP address or cookie identifiers for marketing purposes, including the display of advertisements tailored to your interests and preferences, as well as for analytical and statistical purposes, and to the storing and saving of cookies on your device. Please note that you can always change the cookie settings on your browser.

Types of cookies files

Two types of cookies files are used:

Analytics cookies – These cookies collect information about how you use the website, which pages you have visited and which links you have clicked on. All data is anonymous and cannot be used to identify you. More on the site Google Analytics Privacy Policy.

Advertisement and targeting cookies – These cookies collect information about how you use the website, which pages you visited and which links you clicked on. All of the data is anonymized and cannot be used to identify you

Cookies files and personal data

Personal data collected using cookies can be collected exclusively for the purpose of performing specific functions for the user. Such data are encrypted in the way which prevents access by unauthorised persons.

Deleting Cookies

The software used for browsing websites typically allows cookies to be placed on the end device by default. The settings can be changed in such a way as to block automatic handling of cookies in the web browser settings or to inform about each transfer to the user’s device. Detailed information on the possibilities and ways of cookies handling is available in the software (web browser) settings.

Restricting the use of cookies may affect some of the functionalities available on the websites.

Chrome

  • At the top of Chrome browser window, click ‘Chrome menu’ i.e., the icon with three lines on the browser toolbar.
  • Select ‘Settings’.
  • Click ‘Show advanced settings’.
  • In ‘Privacy’ section click ‘Content Settings’ button.
  • In ‘Cookies’ section click ‘All cookies and Site Data’ to open ‘Cookies and Other Data’ dialog.
  • Depending on your decision, select ‘Allow local data storage’, ‘Block attempts to put data from websites on my computer’, ‘Ignore exceptions and block the creation of third-party cookies’ or ‘Delete’.

Firefox

  • At the top of Firefox window press ‘Firefox’ button (in XP click the ‘Tools’ menu) and select ‘Options’.
  • In ‘Privacy’ tab select ‘use the user’s history settings’.
  • Depending on your decision click ‘Accept cookies’.

Internet Explorer

  • At the top of the browser window select ‘Tools’ then click ‘Internet options’.
  • On ‘Privacy’ tab in ‘Advanced’ tab select your mode of cookies handling.

Opera

  • At the top of the browser window go to ‘Settings’, then ‘Preferences’ and select ‘Advanced’ option.
  • Select ‘Cookies’ section.
  • Depending on your decision click ‘Accept cookies’, ‘Accept cookies only from sites I visit’, ‘Delete new cookies when closing Opera’, ‘Manage cookies’.