Processing of personal data

1. GENERAL PROVISIONS

1.1. “INSTITUTE OF PSYCHOTHERAPY AND CONSULTING” places special emphasis on the protection of personal data during its processing and respects the rights of personal data subjects.
The adoption of this Personal Data Processing Policy (hereinafter referred to as the “Policy”) is one of the measures taken by “INSTITUTE OF PSYCHOTHERAPY AND CONSULTING” to ensure data protection.

1.2. The Policy explains to personal data subjects how and for what purposes their personal data is collected, used, or otherwise processed, as well as their rights and the mechanisms for exercising them.
This Policy does not apply to:

  • Personal data processing in employment relations and administrative procedures (regarding current and former employees);
  • Video surveillance;
  • Cookie processing on the “INSTITUTE OF PSYCHOTHERAPY AND CONSULTING” website.

1.3. Mailing address of “INSTITUTE OF PSYCHOTHERAPY AND CONSULTING”:
Sp. z o.o. ul. Grunwaldzka 10/1, 31-526 Kraków, Poland
NIP: 6751791005, REGON: 527001454
Website: https://psycons.org

1.4. Terms used in this Policy shall have the meanings defined in applicable law.
1.5. “INSTITUTE OF PSYCHOTHERAPY AND CONSULTING” processes only the personal data necessary for the stated purposes and avoids excessive processing.

2. PURPOSES, CATEGORIES OF DATA SUBJECTS, PROCESSED DATA, LEGAL BASIS, AND RETENTION PERIODS

“INSTITUTE OF PSYCHOTHERAPY AND CONSULTING” processes personal data for the purposes, scope, legal bases, and retention periods applicable to each category of data subjects, as outlined in Appendix 1 to this Policy.

3. AUTHORIZED PERSONS. CROSS-BORDER DATA TRANSFER

3.1. “INSTITUTE OF PSYCHOTHERAPY AND CONSULTING” entrusts personal data processing to authorized persons.
The list of authorized processors is provided in Appendix 2 to this Policy.

3.2. Cross-border data transfers are carried out to ensure seamless communication via social media and messaging platforms (Instagram, TikTok, Telegram, YouTube).
Such transfers may occur if:
3.2.1. The foreign jurisdiction ensures an adequate level of personal data protection (unrestricted, if legally permitted);
3.2.2. The foreign jurisdiction lacks adequate protection, but the transfer is permitted under Article 9 of the Law, including cases where:

  • The data subject has consented after being informed of the risks;
  • The data is publicly shared online;
  • Processing is necessary to fulfill legal obligations.

4. RIGHTS OF PERSONAL DATA SUBJECTS

4.1. Data subjects have the right to:
4.1.1. Withdraw consent (if processing was based on consent). This right does not apply if processing is based on other legal grounds (e.g., legal requirements or contractual obligations).
4.1.2. Request information about the processing of their data, including:

  • The Institute’s address;
  • Confirmation of processing;
  • Processed data and its source;
  • Legal basis and purposes;
  • Retention period (if based on consent);
  • Details of authorized processors;
  • Other legally required information.
    4.1.3. Request corrections to incomplete, outdated, or inaccurate data, providing supporting documents.
    4.1.4. Obtain a free annual report on third-party disclosures (unless otherwise required by law).
    4.1.5. Request deletion of data if no legal basis for processing exists.
    4.1.6. Challenge unlawful actions/decisions via legal procedures.

4.2. To exercise these rights, data subjects must submit a written request to the Institute’s mailing address (see Section 1.3). The request must include:

  • Full name, address, and date of birth;
  • Details of the request;
  • ID/passport number (if previously provided);
  • Handwritten or digital signature.
    Requests submitted via email/phone will not be considered.

4.3. For assistance, data subjects may contact the Data Protection Officer at: [email protected].

Purposes of personal data processingCategories of personal data subjects whose data are processedList of personal data processedLegal grounds for processing personal dataStorage period of personal data
Consideration of applications.1. Persons who submitted the appeal.2. Other persons whose personal data is indicated in the application.Last name, first name, patronymic, address of place of residence (place of stay), content of the request, other personal data specified in the request.The processing of personal data is necessary to fulfill the duties (powers) provided for by legislative acts5 years.
Implementation of educational programs for additional education of adults.1. Employees of the operator (authorized person)2. Employees of owners (holders) of information systems and owners of critical information technology facilities, as well as organizations carrying out licensed activities in the technical and (or) cryptographic protection of information3. Other persons in respect of whom a decision has been made to conclude an agreement for the provision of relevant services.4. Persons authorized to sign the agreement.In accordance with the form of the agreement approved by the decree of the Ministry of EducationThe processing of personal data is necessary to fulfill the duties (powers) provided for by legislative acts5 years (documents on the results of monitoring the quality of education (tests, assignments, questionnaires, analyses, etc.); 3 years after the end of the contract, the tax authorities have conducted an audit of compliance with tax legislation. If the tax authorities have not conducted an audit of compliance with tax legislation – 10 years after the end of the contract.
Provision of information and consulting services.1. Persons authorized to sign the agreement.2. Participants of webinars and/or seminars.3. Subjects who are recipients of information and consulting services.Surname, first name, patronymic of the person, personal signature, other personal data (if necessary).1. In the case of concluding an agreement with an individual – processing on the basis of an agreement with the subject of personal data3 years after the expiration of the contract, the tax authorities have conducted an audit of compliance with tax legislation. If the tax authorities have not conducted an audit of compliance with tax legislation – 10 years after the expiration of the contract.
Ensuring safe conditions when organizing the educational process.Listeners.Surname, first name, patronymic or initials of the person, personal signature.The processing of personal data is necessary to fulfill the duties (powers) provided for by legislative acts5 days from the date of completion of training.
Review of resumes (questionnaires, CVs, personnel records, applications, letters of recommendation, etc.) of applicants for vacant positions.Persons who submitted their resumes.Personal data in accordance with the content of the resume (questionnaires, autobiographies, personnel records, applications, letters of recommendation, etc.).1. When sending a resume to the e-mail of the National Center for Personal Data Protection – consent of the personal data subject2. When sending (providing) a resume in written form or in the form of an electronic document)3. With regard to previously disseminated personal dataNo more than 1 year (if not hired);1 month (if hired).
Registration (hiring) for work.Job seekers and their family members.In accordance with the Labor CodeProcessing of personal data when formalizing employment relationshipsAfter dismissal – 55 years.
Conclusion of a civil law contract (contract, license agreement, agreement for the assignment of exclusive rights, provision of services for a fee, etc.) with an individual.Individuals with whom a civil law contract has been concluded.Last name, first name, patronymic, bank account details, telephone number, other details in accordance with the terms of the agreement (if necessary).Processing on the basis of an agreement with the subject of personal data3 years after the expiration of the contract, the tax authorities have conducted an audit of compliance with tax legislation. If the tax authorities have not conducted an audit of compliance with tax legislation – 10 years after the expiration of the contract.
Conclusion and execution of civil law contracts (for example: contracts, provision of services for a fee, supply, purchase and sale, etc.).Persons authorized to sign the agreement.Surname, first name, patronymic or initials of the person,position of the person who signed the agreement, other information in accordance with the terms of the agreement (if necessary).1. In the case of concluding an agreement with an individual – processing on the basis of an agreement with the subject of personal data2. In the case of concluding an agreement with a legal entity, the processing of personal data is necessary to fulfill the duties (powers) provided for by legislative acts.3 years after the expiration of the contract, the tax authorities have conducted an audit of compliance with tax legislation. If the tax authorities have not conducted an audit of compliance with tax legislation – 10 years after the expiration of the contract.
Posting information about the activities of the “INSTITUTE OF PSYCHOTHERAPY AND CONSULTING” on the official website. In social networks and messengers.Persons participating in the events of the National Center for Personal Data Protection.Image of the subject of personal data; last name, first name, patronymic; position; other information.The processing of personal data is necessary to fulfill the duties (powers) stipulated by legislative acts; If the subject of personal data is the main object of the posted information (filming) – the processing of personal data is based on the consent of the subject of personal data.before the transfer of the archive copy of the website to the archive of the National Center for Personal Data Protection; before publication on social networks and instant messengers.
Accounting and reporting, including maintaining records, cash books, registers of incoming and outgoing cash orders, etc.Other persons whose personal data is contained in the documents.Surname, first name, patronymic or initials of the person, position of the person, other information.The processing of personal data is necessary to fulfill the duties (powers) provided for by legislative actsConstantly
Identifying and maintaining an up-to-date list of affiliatesAffiliatesLast name, first name, patronymic, passport details, other information.The processing of personal data is necessary to fulfill the duties (powers) provided for by legislative acts10 years after the liquidation of the organization.
Preparation and holding of general meetings of company participantsParticipants, representatives of participants.Last name, first name, patronymic, information specified in the power of attorney (if the representative acts on the basis of a power of attorney), other information.The processing of personal data is necessary to fulfill the duties (powers) provided for by legislative acts.10 years after the liquidation of the organization.