1. The personal data administrator The administrator of your personal data is the Sybir Memorial Museum in Białystok with its registered office at ul. Węglowa 1, 15-121 Białystok, TIN: 5423264915, REGON: 366215932. Contact with data administrator is possible via email: sekretariat@sybir.bialystok.pl or by phone: 85 672 36 01. The data administrator has designated the Data Protection Officer who can be contacted via email: iod@sybir.bialystok.pl or in writing to the address of the administrator’s office with the note of the DPO. You can contact the data protection officer on all matters relating to the processing and protection of personal data and the use of rights related to data processing at the Sybir Memorial Museum.

2. Purpose and legal basis of the personal data processing Personal data collected via the event registration form are processed for the following purposes:

A. Registration of participants and organization of the EMYA 2025 event as well as contact with participants:

• We process such data as name, surname, academic degree, information regarding institution, position, e-mail address, telephone number and other information entered in the “Notes” field of the event registration form in order to process the registration and provide the efficient organisation of the event.
• We use the provided data to send organizational information and possible notifications related to the event.
• Legal basis: Art. 6 sec. 1 lit. a i b GDPR (the participant’s consent and processing necessary for the performance of the contract).

B. The event promotion and documentation:

• During the EMYA 2025 event, the images of participants will be recorded in the form of photos and videos. These materials may be used to promote the event on social media, on the website and in promotional materials.
• Legal basis: Art. 6 sec. 1 lit. f GDPR (the legitimate interest of the administrator).
• In case where the individual’s image is the main subject of the photo or recording, the processing is carried out based on consent, in accordance with the Article 6 sec. 1 lit. a GDPR (the participant’s consent).

3. The scope of processed personal data We process the following personal data: • name and surname; • academic degree; • institution information (the name of the institution, address – street, postal code, city, country; TIN); • position; • e-mail address; • telephone number; • other information entered in the “Notes” field of the event registration form; • the individual’s image in the form of the photo or video recording during the event.

4. Recipients of personal data Personal data may be shared: • To entities cooperating with the Administrator in organizing the event (e.g. software and IT system providers, technical service providers, financial service providers, personal and property protection service providers, legal service providers, and entities authorized by law). • To the public for the purpose of the event promotion (in the case of photos and recordings published on social media, the website, and in promotional materials). Personal data processed by the Administrator will not be transferred to third countries or international organizations.

5. The time of personal data storage

• Personal data from the registration form will be stored for the time necessary to organize the event, and then for the time required by legal regulations (e.g. for financial settlements and the statute of limitations on claims), or until an effective objection to processing is made.
• Photos and video recordings will be processed until the promotional activities related to the event are completed and will be stored for the time required by law or until an effective objection to their use is made.

6. The rights of data subjects Participants have the following rights: • The right to access the personal data and receive a copy of it. • The right to correct inaccurate data or supplement incomplete data. • The right to delete data (“the right to be forgotten”) in the cases specified in the GDPR. • The right to limit the processing of data. • The right to object to the processing of data based on the legitimate interest of the Administrator, including the processing of the individual’s images. • The right to data portability. • Prawo do wycofania zgody w dowolnym momencie, jeżeli przetwarzanie odbywa się na podstawie zgody. The right to withdraw consent at any time, if the processing is based on consent. In order to implement the above rights, please contact the Administrator at the following e-mail address: sekretariat@sybir.bialystok.pl.

7. The right to lodge a complaint to the supervisory authority. When stated that the processing of your data violates the provisions of the GDPR, you have the right to lodge a complaint with the supervisory authority. In Poland, such person is the President of the Personal Data Protection Office (PPDPO).

8. Information about the requirement to provide data Providing personal data is voluntary, but it is necessary for registration and participation in the event. Failure to provide the data will result in the inability to register for the EMYA 2025 event.

9. Information about the image monitoring

The image of participants will be recorded during the event. Be informed that by participating in the event, you may be in areas of taking photos and recordings. If you do not consent to the use of your image, please inform the organizer before or during the event.

10. Automated decision-making Your personal data will not be subject to automated decision-making, including profiling.

11. Changes in the Privacy Policy The Administrator reserves right to update this Privacy Policy regarding the development of technology, changes in the legal regulations, or improvements to the provided services. The current version of the Privacy Policy will be published on the website.

Date of the last update: January 16, 2025