1. Data Controller 

The data controller is the Fundacja Edukacji Wizualnej (Visual Education Foundation), with its registered office in Łódź (90-365), ul. Tymienieckiego 3, entered into the National Court Register under KRS number 0000155981, NIP 982-03-06-234, REGON 473145380. For matters regarding the processing of personal data, you may contact the Controller at the following email address: info@fotofestiwal.com.

________

2. Purposes and legal bases for processing

Personal data may be processed for the following purposes:

a) performance of agreements and participation in events, workshops or projects organised by Fotofestiwal
legal basis: Article 6(1)(b) GDPR

b) registration for events, competitions and open calls
legal basis: Article 6(1)(b) GDPR

c) sending newsletters and information about the activities of the Foundation
legal basis: Article 6(1)(a) GDPR (consent)

d) responding to enquiries sent via contact forms or email
legal basis: Article 6(1)(f) GDPR (legitimate interest consisting in communication with users)

e) compliance with legal obligations, in particular accounting and tax regulations
legal basis: Article 6(1)(c) GDPRf) website statistics and ensuring the security of the website
legal basis: Article 6(1)(f) GDPR

________

3. Data recipients

Personal data may be shared with entities cooperating with the controller, including:

• IT and hosting service providers
  
• accounting and legal service providers
  
• providers of tools used to manage event registrations or open calls
  
• newsletter service providers
  
• public authorities authorised to receive such data under applicable law

________

4. Transfer of data outside the European Economic Area

If IT tools provided by entities located outside the European Economic Area are used, personal data may be transferred to third countries. In such cases the controller ensures an appropriate level of protection by applying standard contractual clauses approved by the European Commission or other appropriate safeguards.

________

5. Data retention period

Personal data will be stored for the period necessary to:

• perform the agreement or organise the event
  
• until consent is withdrawn – in the case of newsletters
  
• comply with legal obligations regarding accounting and tax documentation
  
• protect legitimate interests of the controller, including defence against potential claims

________

6. Rights of data subjects

You have the right to:

• access your personal data
  
• rectify inaccurate data
  
• request erasure of data
  
• request restriction of processing
  
• data portability
  
• object to processing
  
• withdraw consent at any time (if processing is based on consent)

________

7. Right to lodge a complaint

You have the right to lodge a complaint with the supervisory authority responsible for data protection in Poland: President of the Personal Data Protection Office (UODO).

________

8. Voluntary provision of data

Providing personal data is voluntary, however it may be necessary in order to participate in events or use services organised by the Foundation.

________

9. Cookies

The Fotofestiwal website uses cookies in order to ensure the proper functioning of the website, collect statistics on website traffic and improve the quality of services.

Cookies may include in particular:

• necessary cookies – required for the proper functioning of the website,
  
• analytical cookies – used to collect information about how users interact with the website and to create website statistics,
  
• functional cookies – allowing the website to remember user preferences.
  

Users may change their cookie settings at any time in their web browser or block cookies entirely. However, restricting cookies may affect certain functionalities of the website.

________

10. Automated decision-making

Personal data are not used for automated decision-making or profiling.

________

11. Data Security

The controller applies appropriate technical and organisational measures to ensure the security of personal data and to protect them against unauthorised access, disclosure, loss or destruction. Access to personal data is granted only to authorised persons or entities processing data on behalf of the controller under data processing agreements.

________

12. Changes to the Privacy Policy

The controller reserves the right to amend this Privacy Policy. The current version of the Privacy Policy is always available on the Fotofestiwal website.