Personal Data Protection

Information on personal data processing in connection with the implementation of the process of reviewing and publishing articles in scientific journals published by the Łukasiewicz Research Network - Poznan Institute of Technology

Pursuant to the provisions of Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”, we inform you that:

JOINT CONTROLLERS OF PERSONAL DATA AND DATA PROTECTION OFFICERS
In connection with the process of reviewing and publishing articles in scientific journals published by the Lukasiewicz Research Network – Poznan Institute of Technology, a joint-control agreement has been concluded for the processing of personal data in this process.
Joint Controllers processing your personal data are:
(1) Łukasiewicz Research Network - Poznan Institute of Technology (Łukasiewicz – PIT), which you can contact by:
a) mail sent to the address: ul. Ewarysta Estkowskiego 6, 61-755 Poznan, Poland,
b) phone: 0048 61 850 48 90,
c) e-mail: office@pit.lukasiewicz.gov.pl.
A data protection officer has been appointed, who can be contacted on matters related to the processing of your personal data and the exercise of your rights in this regard. The inspector can be contacted by e-mail: iod@pit.lukasiewicz.gov.pl;
(2) Bartosz Stefaniak conducting business activity under the name of Bartosz Stefaniak „BENTUS” who you can contact by:
a) mail sent to the address: os. Pod Lipami 14/19, 61-638 Poznan, Poland,
b) e-mail: kontakt@editorialsystem.com.

PURPOSE OF PERSONAL DATA PROCESSING
The purpose of processing your personal data is to fulfil the contract for the process of submitting, reviewing, and publishing scientific articles using the following IT tools:
(a) Editorial System – a system of processing scientific articles online,
(b) Journals System – a system of electronic publishing of scientific journals (the Internet sites of the journals).

LEGAL BASIS FOR PERSONAL DATA PROCESSING
The legal basis for processing of your personal data is:
a) Article 6(1)(a) of GDPR – your consent;
b) Article 6(1)(b) of GDPR – in connection with the conclusion and performance of a contract, with regard to the personal data of a contractor who is a natural person;
c) Article 6(1)(c) of GDPR – in connection with the need to comply with legal obligations incumbent on the Joint Controller (including archiving obligations);
d) Article 6(1)(f) of GDPR – in connection with the need to process personal data for the purposes arising from the legitimate interests pursued by the Joint Controller, which are the conduct of its own business, direct marketing and the investigation and enforcement of claims.

INFORMATION ON RECIPIENTS OF PERSONAL DATA
It happens that in certain situations your personal data is transferred to other recipients. This may happen when it is required by the service used by the Joint Controller (e.g. IT, financial, insurance, auditing, courier and postal services, destruction and archiving of documentation, legal services). Each time your personal data is made available to the recipient in accordance with the provisions of the GDPR.

TRANSFER OF PERSONAL DATA TO A THIRD COUNTRY OR INTERNATIONAL ORGANIZATION
Normally, your personal data is not transferred to a third country or an international organization. However, if such a transfer occurs, it is always in accordance with the provisions of the GDPR.
Łukasiewicz – PIT uses Microsoft Office 365, which may result in the transfer of your personal data to a third country. The terms of use of MS Office 365 online services and obligations regarding the processing and security of user data and personal data by online services are set out in Microsoft's documentation, including in particular:
1) privacy statement – https://privacy.microsoft.com/pl-pl/privacystatement;
2) Microsoft Services Agreement (MSA) – https://www.microsoft.com/pl-pl/servicesagreement/.
Microsoft 365 complies with international norms for protection standards, as evidenced by ISO/IEC 27001:2005 certification. The service is also subject to regular audits. The service has a certificate of conformity of its services with ISO 27018 standard concerning personal data protection in the cloud, which means that customer data stored in the cloud will not be used for marketing purposes without their knowledge.

THE PERIOD FOR WHICH PERSONAL DATA WILL BE KEPT
Your personal data is stored until the purpose for which this processing is conducted is achieved. The processing period also results from the provisions of law, including in particular the provisions on archiving, i.e. the act on the national archival resources and archives, and internal acts in force at the Joint Controller in the scope of documentation creating and storing.

YOUR RIGHTS
Persons whose data is processed have the right to request from the Joint Controllers access to their personal data, its rectification, erasure or restriction of its processing, or the right to object to its processing, as well as the right to data portability (if the processing is based on Article 6(1)(a) or (b) of the GDPR). In order to exercise your rights, you are requested to contact the relevant Joint Controller, who in such a case will always analyse whether the prerequisites for exercising particular rights apply, in accordance with the specific regulations of the GDPR in this regard.

COMPLAINT TO THE PRESIDENT OF THE PERSONAL DATA PROTECTION OFFICE
A person whose data is processed has the right to lodge a complaint related to the processing of their personal data to the President of the Personal Data Protection Office (address: ul. Stawki 2, 00-193 Warsaw, Poland).

OBLIGATION TO PROVIDE PERSONAL DATA
Provision of personal data is required to conclude and perform the contract. Failure to provide data will result in the inability to conclude and perform the contract.

AUTOMATED DECISION-MAKING, INCLUDING PROFILING
The Joint Controllers do not process personal data in a manner consisting in automated decision-making, including profiling.




Information on the substance of the Joint Controllers' common arrangements

In accordance with the joint arrangements of the Joint Controllers, we would like to inform you that:

(1) Each of the Joint Controllers is responsible for the performance of information obligations towards data subjects;
(2) Each of the Joint Controllers is responsible for responding to data subjects within the scope of their request addressed directly to him, i.e. he is responsible for meeting deadlines and compliance of the content of the response with the request to exercise the rights of the data subject and for the appropriate form of replying, including informing the data subject about the actions carried out to fulfil the request;
(3) Each of the Joint Controllers is responsible for the exercise of the rights of data subjects insofar as such rights apply to the grounds for processing specified by the respective Joint Controller, i.e. the exercise of the right of access to personal data, its rectification, erasure or restriction of its processing, the right to object to the processing of their personal data, the right to data portability, and the withdrawal of consent;
(4) Each of the Joint Controllers is responsible for notifying the personal data protection breach occurring with it to the supervisory authority (President of the Personal Data Protection Office);
(5) Each of the Joint Controllers is obliged to cooperate with the President of the Personal Data Protection Office;
(6) Each of the Joint Controllers is responsible for notifying the data subject of a personal data protection breach occurring with it, unless the breach is unlikely to result in a risk of infringement of the rights or freedoms of natural persons;
(7) Each of the Joint Controllers is responsible for monitoring the compliance of the personal data processing with the GDPR.