Information on the processing of personal data

Pursuant to articles 13 sec. 1 and 2 and article 14 sec. 1 and 2 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 / EC (general regulation on data protection – "GDPR"), we provide information on the rules for the processing of your personal data:.

Data Controller:
The data controller of your personal data is Warsaw Management University, ("Controller"), e-mail:

DPO: The Controller has appointed a Personal Data Protection Officer. You can contact him/her via email at the following email address:

Data source: Your personal data have been provided to the Controller by you or by a person with whom the Controller cooperates in the recruitment process for studies conducted by the Controller. Some of them may also have been taken from publicly available government records and/or government documents, including those provided or submitted by you.

Categories of personal data processed: The following types of your personal data will be processed by the Controller: name (s) and surname, permanent address, address of residence, identification numbers, date of birth, citizenship, gender information, information about your education, e-mail address and telephone number, photos, medical data, bank account details, other data contained in identity documents and other documents submitted, data entered by you to the Website, names and surnames and other data of your parents or guardians (phone numbers, e-mail addresses, addresses of residence).

Purposes and basis of the personal data processing. Personal data are processed for the following purposes:

(1)      current and future recruitment processes for studies (Article 6 (1) (b) of GDPR);
(2)     conclusion and implementation of an education contract, implementation of the education process, documentation of the course of studies, the Controller’s performance of its information and statistical obligations provided for by the provisions related to the university education (Article 6 (1) (b), (c) and (e) of the GDPR and Article 9 (2) (a) of the GDPR);
(3)     statistical and reporting data by the Controller (Article 6 (1) (f) of the GDPR, while the legitimate interest pursued by the Controller is to ensure its proper organization and performance of contractual obligations);
(4)     marketing of services and products offered by the Controller (Article 6 (1) (f) of the GDPR), with regard to the legitimate interest pursued by the Controller is its right to inform and advertise its services and products;
(5)     archiving (Article 6 (1) (c) of GDPR);
(6)     in order to establish, investigate and/or defend against claims - the processing of data is necessary for purposes based on legitimate interests pursued by the Controller (Article 6 section 1 letter f of the GDPR - i.e. in order protect its rights).

Data recipients. Your personal data may be made available (a) to entities providing the Controller with the services of operating and maintaining the systems used by the Controller (including Q24 Sp. z o.o. having its registered office in Warsaw, Poland), (b) to entities entrusted with the processing of personal data by the Controller, (c) to intermediaries in recruitment process and (d) to other authorities, bodies or entities authorized to obtain your personal data on the basis of separate Terms and Conditions. We cannot exclude that some of the entities whose services we use and with which we will share your personal data will process them outside the European Economic Area (EEA). The transfer of your personal data will take place only if it is lawful.

Processing period. The Controller will store your personal data for the period necessary to achieve the objectives of their processing, but not less than throughout the period specified by laws and limitation of claims, and in the case of processing your personal data on the basis of your consent, your personal data will be stored as long as you withdraw your consent.

Your rights. Under the conditions set forth in the GDPR, you have the right to request from the Controller access to personal data, rectification, deletion or limitation of processing, the right to object to processing, the right to transfer data and the right to lodge a complaint to the supervisory body - in Poland it is the President of the Personal Data Protection Office [Urząd Ochrony Danych Osobowych – (UODO)]. You have the right to withdraw the consent at any time without questioning the lawfulness of the processing, which was made on the basis of your consent before its withdrawal. You can withdraw your consent and exercise other rights by submitting a request to the above-mentioned e-mail address.

Voluntary data provision.. Providing your personal data is not mandatory, but it is necessary to achieve the objectives for which such data was collected. Your failure to provide your personal data will result in our refusal to qualify you for the recruitment process for studies.

Automatic data processing . Your personal data is not subject to automated decision making, this applying, inter alia, to profiling process(es).