CORRESPONDENCE HANDLING USING AN ELECTRONIC INBOX (E-PUAP and E-DELIVERY)

Pursuant to Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the GDPR), we hereby inform you that:

The controller of your personal data is the Lubuskie Military Museum in Zielona Góra, with its registered office in Drzonów, Drzonów 54, 66-008 Świdnica.

The controller of your personal data has appointed a Data Protection Supervisor, Mr. Rafał Wielgus, telephone number: 68 411 40 00, email address: iod@bhpex.pl.

The specific purpose and legal basis for processing depends on the reason for contacting the controller, as follows:

a) Data sent via correspondence using the registered electronic delivery service and the public hybrid service will be processed pursuant to Article 6(1)(c) of the GDPR in conjunction with the Act of November 18, 2020 on electronic delivery, in order to fulfill the legal obligation of the controller in connection with the correspondence sent to the controller;

b) Data sent via the e-PUAP trusted profile will be processed pursuant to Article 6(1)(c) of the GDPR in conjunction with the Act of February 17, 2005 on the computerization of the activities of entities performing public tasks, in order to fulfill the legal obligation of the controller in connection with the correspondence sent to the controller;

c) If the content of the message contains information that necessitates the controller to undertake processing under separate legal provisions, it will be processed, among other things. in connection with

• Article 6(1)(c) in conjunction with Article 38(4) of the GDPR, for the purpose of contacting the Data Protection Officer regarding matters related to the processing of personal data and responding to submitted inquiries.
• Article 6(1)(c) of the GDPR, for the purpose of fulfilling the legal obligations incumbent on the controller resulting from the tasks specified in specific provisions.
• Article 6(1)(e) of the GDPR, when the data are necessary for the performance of tasks carried out by the controller in the public interest or in the exercise of official authority vested in the controller.
• Article 6(1)(a) of the GDPR, based on consent. Consent is required when the authorization to process personal data does not arise directly from legal provisions, and you voluntarily provide the controller with more data than is necessary to handle your request (so-called explicit affirmative action).

1. We may transfer and share personal data only with entities authorized under applicable law, including: Poczta Polska S.A., ul. Rodzin Hiszpańskich 8, 00-940 Warsaw, as a public service provider for e-delivery, and commercial non-public service providers entered in the register maintained by the Minister of Digital Affairs. In other respects, we may transfer personal data to other entities providing postal, telecommunications, and banking services, organizational units of the controller for the performance of its statutory duties, and other public entities upon request, based on an appropriate legal basis. Personal data will also be disclosed to the controller’s employees and associates to the extent necessary to perform their duties. We may also transfer your personal data to entities that process it on behalf of the controller, so-called processors, such as entities providing IT support services to the controller. 5. Personal data will be processed for as long as the basis for their processing exists, including for the period specified in the regulations on the storage and archiving of documentation, as follows:

a) in the case of data where you have consented to their processing, until you withdraw your consent, but no longer than 3 years from the last electronic contact with the controller,

b) 5 years if the processing of personal data concerns matters related to providing answers to questions submitted by the Data Protection Officer,

c) in other cases where the content of your message was the basis for the processing of personal data under specific regulations, you will be informed separately about the scope, method, and principles of processing such data.

6. Under the terms of the GDPR and subject to the limitations indicated therein, you have:

a) the right to access your data and receive a copy thereof,

b) the right to rectify (amend) your data,

c) the right to erasure (this does not apply to situations where data processing is necessary to fulfill an obligation arising from a legal provision),

d) the right to restrict data processing, although separate provisions may exclude the possibility of exercising this right,

e) the right to object, pursuant to Article 21 of the GDPR, to the processing of personal data based on Article 6(1)(e) of the GDPR.

f) the right to withdraw consent at any time. Withdrawal of consent does not affect the processing of data carried out by the controller before its withdrawal.

7. Providing data:

a) is required by the law under which the controller operates. If you refuse to provide your data or provide incorrect data, the controller will not be able to fulfill the purpose for which it is legally obliged.

b) is voluntary when it is based on your consent, which may be withdrawn at any time.

8. If you believe that the processing of your data may violate personal data protection regulations, you also have the right to lodge a complaint with the President of the Personal Data Protection Office at ul. Stawki 2, 00-193 Warsaw.
9. Your data is not subject to automated decision-making, including profiling.
10. The controller does not transfer personal data to a third country or international organization.

---