WSF Student™

 

Privacy Policy of the Warsaw Film School Mobile Application

This Privacy Policy sets out the rules for processing the personal data of users of the WSF Student™ mobile application (the “Application”), intended for students of the Warsaw Film School (the “User”). In particular, the Application enables access to the class schedule, information about grades and payments, and contact with the WSF Dean’s Office via messages.

This Policy has been prepared in particular on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (the “GDPR”), the Act of 10 May 2018 on the Protection of Personal Data, and the provisions concerning higher education and science, to the extent applicable to the activities of the University.

The Policy is informational in nature and serves to fulfil the obligation to provide the User with transparent information about what data are processed in connection with the use of the Application, for what purposes and on what legal bases, to whom they may be disclosed, and what rights the User has.

1. The controller of the User’s personal data processed through the Application is the Warsaw Film School, ul. Gen. Zajączka 7, 01-518 Warsaw (the “Controller”).

2. The Controller has appointed a Data Protection Officer. Contact details of the DPO: iod@szkolafilmowa.pl or tel. 887 555 104. Address: ul. Gen. Zajączka 7, 01-518 Warsaw.

3. In connection with the use of the Application, the Controller may process, in particular, the following categories of the User’s personal data:

1. identification and contact data, such as first name, surname, student ID number, e-mail address in the university domain, telephone number, or other data assigned to the student account;

2. data concerning the course of studies and the organisation of education, including information about the field of study, year and group, class schedule, attendance, credits, examinations, grades, and organisational announcements;

3. data concerning settlements and payments related to studies, including information about amounts due, balance, payment deadlines, payment status, and transaction identifiers, insofar as they are displayed in the Application;

4. data contained in correspondence with the Dean’s Office, including the content of messages, attachments, the date and time a message was sent, and the details of the person handling the matter;

5. technical data related to the use of the Application, such as account identifier, IP address, device identifier, type and version of the operating system, date and time of login, information about errors, security events, and the history of basic activities in the Application.

4. The User’s personal data are processed for the purpose of:

1. carrying out and supporting the education process, including providing the class schedule, information about grades, credits, examinations, and organisational announcements – on the basis of Article 6(1)(c) GDPR, in connection with the relevant provisions of law governing the activities of the University, or Article 6(1)(e) GDPR, where processing is necessary for the performance of a task carried out in the public interest;

2. handling information about payments and settlements related to studies – on the basis of Article 6(1)(c) GDPR, where the settlement obligation arises from legal provisions, or Article 6(1)(b) GDPR, where processing is necessary for the performance of a contract or for taking steps related to its performance;

3. enabling contact with the Dean’s Office and handling enquiries, reports, applications, and correspondence – on the basis of Article 6(1)(c) or (e) GDPR, depending on the nature of the matter, and, in the case of matters not arising from statutory obligations, also on the basis of Article 6(1)(f) GDPR, where the legitimate interest of the Controller is the ongoing handling of communication with the User;

4. handling the User’s account, authentication, access authorisation, and ensuring the proper operation of the Application’s functionalities – on the basis of Article 6(1)(c) or (e) GDPR, and, to the extent necessary for the security of information systems, also Article 6(1)(f) GDPR;

5. ensuring the security of the Application, preventing abuse, diagnosing technical errors, and protecting the University’s information systems – on the basis of Article 6(1)(f) GDPR, where the legitimate interest of the Controller is the protection of IT infrastructure, data, and continuity of services;

6. establishing, pursuing, or defending against claims – on the basis of Article 6(1)(f) GDPR, where the legitimate interest of the Controller is the protection of its rights and legal interests.

5. Providing personal data is mandatory where the obligation to provide them arises from legal provisions, the study regulations, a concluded contract, or where they are necessary to carry out a specific process related to studies or the use of the Application. In the case of data whose provision is voluntary, the User will be informed of this before providing them. Failure to provide data required for a specific functionality may make it impossible to use that functionality or handle the relevant matter.

6. The User’s personal data will be stored for the period necessary to fulfil the purpose for which they were collected and thereafter for the period required by legal provisions concerning documentation of the course of studies, financial and accounting documentation, archiving, and the activities of the University. Data contained in correspondence with the Dean’s Office will be stored for the period necessary to handle the matter and thereafter for the period resulting from legal provisions or internal office and archival rules. Technical data and security logs will be stored for the period necessary to ensure security, detect abuse, and diagnose errors. Data processed for the purpose of establishing, pursuing, or defending against claims may be stored for a period corresponding to the limitation period for those claims.

7. The Application may use authentication mechanisms provided by the University’s IT systems, including a university account, individual login and password, session mechanisms, and other solutions used by the University. Authentication data are used solely to the extent necessary to ensure secure access to the Application.

8. The Application may also use the device’s system notifications if the User consents to this in the device or Application settings. Notifications may concern, in particular, changes to the class schedule, new messages, payment deadlines, or other organisational information. The User may manage notification settings on their device at any time.

9. The User’s personal data may be transferred to entities authorised to receive them under legal provisions and to entities providing services to the University that are necessary for the operation of the Application, in particular providers of IT, hosting, or cloud services; providers of Application maintenance and development services; providers supporting IT systems, sending notifications, handling payments, and providing technical support.

10. Entities processing data on behalf of the University process them on the basis of appropriate data processing agreements and solely in accordance with the documented instructions of the Controller. Access to data may also be granted to authorised employees and associates of the University solely to the extent necessary for the performance of their duties.

11. As a rule, the User’s personal data are not transferred to third countries or international organisations. If, in the future, the use of technology providers’ services were to involve such a transfer, the Controller will ensure the use of appropriate mechanisms required by the GDPR, including informing the User of the basis for such transfer, the safeguards applied, and the possibility of obtaining a copy thereof.

12. In connection with the processing of personal data, the User has, to the extent provided for by the GDPR, the right to access their personal data, receive a copy thereof, rectify personal data, erase personal data, restrict the processing of personal data, data portability, object to the processing of personal data, and withdraw consent to the processing of data where processing is based on consent.

13. The exercise of certain rights may be subject to restrictions arising from legal provisions, in particular where further processing of data is necessary to fulfil the University’s legal obligations, maintain documentation of the course of studies, conduct settlements, archive records, or establish, pursue, or defend against claims.

14. To exercise their rights, the User may contact the Controller or the Data Protection Officer.

15. The User has the right to lodge a complaint with a supervisory authority – the President of the Personal Data Protection Office – if they consider that the processing of their personal data infringes data protection regulations.

16. The User’s personal data will not be used to make decisions based solely on automated processing, including profiling, which produces legal effects concerning the User or similarly significantly affects them.

17. The Controller applies appropriate technical and organisational measures aimed at protecting personal data processed in the Application, in particular restricting access to data to authorised persons, using authentication mechanisms, recording security events, and implementing information system safeguards adequate to the risks associated with processing students’ data.

18. The Controller may update this Privacy Policy, in particular in the event of changes to the Application’s functionalities, legal provisions, technical solutions used, or data recipients. The current version of the Privacy Policy will be made available in the Application or on the University’s website.