The Active Citizens Fund – National Programme, which is financed using funds from the European Economic Area and the Kingdom of Norway (the “Programme”), is a joint programme run by a consortium made up of the Stefan Batory Foundation, the “Shipyard” Foundation, and the Academy of Civic Organizations Foundation. Information on personal data processing under the Programme is provided below. This information affects your rights and obligations.

1. Who is responsible for personal data processing

The Stefan Batory Foundation with its registered office in Warsaw (ul. Sapieżyńska 10a), the “Shipyard” Foundation with its registered office in Warsaw (Plac Zamkowy 10) and the Academy of Civic Organizations Foundation with its registered office in Warsaw (Królowej Marysieńki 48) are jointly responsible for processing the personal data processed under the Programme.

The organisations named above are joint controllers as defined in article 26 of the General Data Protection Regulation (GDPR) with regard to any personal data processed under the Programme. This means that they jointly define the purposes and methods of processing of your personal data. These organisations are jointly referred to as the “Joint Controllers”

2. Contact

The Joint Controllers have established one common point of contact for data subjects, which is: [email protected].

The contact details for each of the Joint Controllers are:

Stefan Batory Foundation, contact details: [email protected]

The “Shipyard” Foundation, contact details: [email protected]

The Academy of Civic Organizations Foundation, contact details: [email protected]

3. The purposes and legal basis for personal data processing

3.1. Persons representing organisations applying for grants under the Programme

If you register with the Programme as representatives of organisations applying for grants (Applicants), and in particular apply for funding via the Programme website or are conducting projects being funded under the Programme (Project Promoters) under a grant agreement, the Joint Controllers will obtain personal data from you directly. The personal data that the Joint Controllers obtain from you comprise the following, being the broadest scope of personal data that the Joint Controllers can obtain:

1. first name and surname,
2. telephone number,
3. name of the organisation you represent.

4. address of the organisation/residential address, e-mail of the contact person for the Applicant/Project Promoter,
5. first name and surname, position of persons representing the Applicant/Project Promoter,
6. telephone number, e-mail of the contact person for the Applicant/Project Promoter partner
7. Your image (photograph taken at workshops, meetings), special needs or requirements, date and whereabouts in connection with the event (applicable to persons who attend face-to-face events organised under the Programme),

Personal data are processed for the following purposes:

1. to enable you to participate in the Programme,
2. to evaluate your application,
3. to conduct the Programme, including fund payment matters,
4. to promote the Programme and the effects of the Programme,
5. to contact you regarding conducting the Programme,
6. to monitor, evaluate and deal with matters relating to payment under the Programme, and for compliance with other legal obligations of the Organisers

In order to review whether Programme payment matters are handled correctly and confirm your participation in the Programme, the Joint Controllers may request further information, being personal data such as attendance lists relating to workshops or events organised in the projects funded under the Programme, the fact that an agreement is concluded with a person conducting a workshop, and information that your employees are delegated to participate in the Programme, and similar.

The legal basis for personal data processing is art. 6(1)(b) (c) and (f) of the GDPR.

3.2. Persons acting as experts in the Programme

If you apply to be an expert or are an expert under the Programme, the Joint Controllers will process your personal data for the purposes and within the scope necessary to evaluate your competences and conclude an agreement with you concerning your role as an expert.

The personal data processed comprise:

1. first name and surname,
2. contact details,
3. residential address,
4. details for payment of tax on the agreement concluded with the Joint Controllers, or one of the Joint Controllers,
5. your experience and competences.

Details with regard to your first names, surname, and competences will also be published on the Programme website.

The legal basis for personal data processing is art. 6(1)(b) and (c) of the GDPR, which is performance of an agreement and compliance with legal obligations to which the Joint Controllers are subject.

We also process data in order to contact you as a Foundation expert, including once an agreement has terminated. The legal basis for processing is art. 6(1)(f) of the GDPR, which is our legitimate interest.

3.3. Persons who register for events organised under the Programme

If you register as Applicants or Project Promoters for events organised under the Programme, we will process the following personal data:

1. First name and surname,
2. The institution you represent,
3. Town or city,
4. Contact details: telephone number, e-mail,
5. Your image, which may be saved when recording the event.

The purpose of personal data processing is to enable you to participate in an event, while the legal basis for processing is art. 6(1)(f) of the GDPR, which is our legitimate interest.

4. Personal data recipients

Personal data are also jointly processed by the Joint Controllers. At the same time, to conduct the Programme, the Joint Controllers will use external vendors and tools which may store your personal data, such as server providers or IT solutions. In addition, your personal data may be disclosed to the Financial Mechanism Office in Brussels, which manages programmes conducted using EEA and Norwegian funds, and other organisations such as law firms or auditing firms.

5. The period of personal data processing

We process your personal data solely for the period necessary to achieve the processing goals, which is for the entire duration of the Programme, the relevant period under the statute of limitations, and until the Financial Mechanism Office in Brussels accepts the Stefan Batory Foundation final report on use of the funds provided for the Programme.

6. Rights of data subjects

Data subjects have the following rights under the GDPR:

1. Every person has a right to receive information about personal data processing (concerning in particular the purpose of processing, the kind of data, who processes the data, and to whom the data are disclosed, etc.).
2. Every data subject may lodge a complaint about data processing and may lodge a complaint with the Personal Data Protection Office, ul. Stawki 2, Warsaw, (https://uodo.gov.pl/).
3. Every data subject has a right to receive a copy of the data we process.
4. Every data subject has a right to request that their personal data be erased (if you believe that we are not entitled to process the data) or object to processing of that data.
5. Every data subject may also request restriction of processing of personal data.
6. You have a right to request rectification or correction of personal data.
7. You have a right to personal data portability.

For specific rules on exercising rights under the GDPR:

How rights are exercised

Any request for access to data must be submitted in writing or by e-mail. If any doubts arise as to identity of a person submitting a request, the Joint Controllers will request further information regarding the request, in particular the necessary identification details.

The Joint Controllers will attempt to reply to every request within one month, but in more complex cases or when a large number of queries are submitted at one time, the Joint Controllers may extend the time limit for replying, and notification will be given accordingly.