Admissions 2026/2027 have started!
Apply

Personal data

Privacy notice on the processing of personal data of candidates, students, course participants and graduates

This information clause has been prepared in order to fulfil the information obligations arising from Article 13(1) and (2) and — where personal data have been obtained otherwise than directly from the data subject — Article 14(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, hereinafter referred to as the “GDPR”.

  1. The controller of your personal data is Collegium Da Vinci with its registered office at ul. gen. Tadeusza Kutrzeby 10, 61-719 Poznań, hereinafter referred to as the “Controller” or the “University”. The Controller may be contacted in writing at the registered office address, by telephone at +48 61 271 10 00, by e-mail at info@cdv.pl, or via the electronic delivery address: AE:PL-23358-14770-VGGGC-25.

  2. The Controller has appointed the Data Protection Officer — Mr Tomasz Surdyk. The Data Protection Officer may be contacted in all matters concerning the processing of personal data and the exercise of rights related to such processing by e-mail at iod@cdv.pl or by telephone at 503 494 145.

  3. Your personal data will be processed for purposes related to the University’s teaching, organisational, administrative and reporting activities, in particular for the purposes of conducting recruitment, confirming fulfilment of admission requirements for degree programmes or other forms of education, concluding and performing an agreement for the provision of educational services, organising and documenting the course of studies, administering the educational process, verifying the achievement of learning outcomes, issuing documents related to the course and completion of education, communicating with candidates, students, course participants and graduates, operating the University’s IT systems, fulfilling reporting and archiving obligations, ensuring the safety of persons and property, organising work placements, internships, academic exchange, events and academic activities, awarding student benefits, pursuing or defending claims, and — to the extent resulting from a separate consent — for marketing purposes or purposes related to tracking graduates’ professional careers.

  4. Providing personal data to the extent required by law is mandatory and follows in particular from the Higher Education and Science Act of 20 July 2018 and implementing acts issued on its basis. The provision of data necessary to conclude and perform the agreement for the provision of educational services is a condition for concluding and performing that agreement. In all other respects, the provisions of data is voluntary; however, it may be necessary in order to use specific services, benefits, events, communication tools or forms of support offered by the University. Failure to provide the data required by law or necessary for the performance of the agreement may result in the inability to participate in recruitment, commence or continue education, obtain documents related to the course or completion of education, or exercise specific rights.

  5. The legal bases for the processing of your personal data include, in particular:

    1. Article 6(1)(a) GDPR — to the extent that processing is carried out on the basis of voluntarily given consent, in particular for marketing purposes, participation in selected events or surveys, and other purposes indicated when consent is obtained;
    2. Article 6(1)(b) GDPR — where processing is necessary in order to take steps prior to entering into a contract or for the performance of the agreement for the provision of educational services or another agreement concluded with the Controller;
    3. Article 6(1)(c) GDPR — where processing is necessary for compliance with legal obligations incumbent on the Controller, arising in particular from the Higher Education and Science Act of 20 July 2018, including Article 69 concerning forms of admission to degree programmes and admission requirements, Article 74 concerning documentation of the course of studies and student ID cards, Articles 75–78 concerning documents issued in connection with the course and completion of studies, Article 81 providing the basis for issuing implementing provisions on studies, Articles 86–95 concerning student benefits, and Article 343 concerning data processed in the Integrated System of Information on Higher Education and Science POL-on, as well as from the Regulation of the Minister of Science and Higher Education of 27 September 2018 on studies, in particular with regard to maintaining the documentation of the course of studies, preparing duplicates and copies of documents, making corrections and changes to personal data in documents, issuing and confirming the validity of student ID cards, and issuing graduation diplomas and diploma supplements;
    4. Article 6(1)(f) GDPR — where processing is necessary for the purposes of the legitimate interests pursued by the Controller, such as ensuring the safety of persons and property, handling communication, organising events, pursuing or defending claims, conducting internal analyses and ensuring the proper functioning of IT systems;
    5. Article 9(2)(a), (b) or (g) GDPR — where, in a specific process, special categories of personal data are processed, in particular data concerning health or disability, respectively on the basis of consent, for the purpose of exercising rights and fulfilling obligations arising from legal provisions, or for reasons of substantial public interest provided for by law.
    6. Article 14 GDPR — to the extent that personal data have been obtained otherwise than directly from you; in such a case, the Controller provides information on the categories of data, their source and — where applicable — whether the data originate from publicly available sources.

  6. If personal data have not been obtained directly from you, their sources may include in particular: schools, universities, regional examination boards, ICT systems relevant to higher education and science, public institutions, entities maintaining public registers, entities organising internships, traineeships, academic exchange or other forms of cooperation, persons authorised to represent a candidate, student or course participant, as well as documents submitted during recruitment or education. The categories of such data may include in particular identification, contact and address data, data concerning education, qualifications, examination results, the course of studies, student status, student rights, documents confirming qualifications, participation in work placements, internships, academic exchange, benefits or other forms of support, and data necessary to comply with obligations arising from legal provisions.

  7. In connection with the fulfilment of the indicated purposes, the Controller may contact you through various communication channels, in particular by post, e-mail, telephone, the University’s IT systems and online services intended for candidates, students, course participants and graduates, provided that you have supplied contact details or the obligation to provide them arises from applicable legal provisions.

  8. Your personal data may be made available to entities authorised to receive them under legal provisions, in particular competent public administration authorities, the minister competent for higher education and science, inspection institutions, entities operating reporting systems, law enforcement authorities and courts — where this results from applicable provisions.

  9. Recipients of your personal data may also include entities processing personal data on behalf of the Controller pursuant to Article 28 of the GDPR, in particular providers of IT systems, hosting services, e-mail services, communication tools, document archiving and destruction services, payment operators, postal operators and couriers, and entities providing legal, advisory, audit, accounting, marketing, recruitment, training or services related to the organisation of internships, traineeships, academic exchange and events, solely to the extent necessary to perform the tasks entrusted to them.

  10. You have the right to:

    1. access your personal data and obtain a copy thereof;
    2. rectify inaccurate personal data or complete incomplete personal data;
    3. request erasure of data in the cases provided for in Article 17 of the GDPR;
    4. request restriction of data processing in the cases indicated in Article 18 of the GDPR;
    5. object to data processing in the cases indicated in Article 21 of the GDPR, in particular where the processing is based on the Controller’s legitimate interest;
    6. data portability, where the processing is based on consent or a contract and is carried out by automated means;
    7. withdraw your consent at any time, without affecting the lawfulness of the processing carried out before its withdrawal — where the processing is based on consent.

  11. As a rule, your personal data will not be transferred to third countries or international organisations. If, in connection with the Controller’s use of specific IT tools or services provided by technology suppliers, such a transfer were to take place, it would occur only on the terms provided for in the GDPR, in particular on the basis of an adequacy decision, standard contractual clauses or other safeguards required by law.

  12. Your personal data will not be used for decisions based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you.

  13. Your personal data will be stored for the period necessary to achieve the purposes for which they were collected, and subsequently for the period resulting from legal provisions, archiving regulations, reporting obligations or until the limitation period for any potential claims expires. Data processed in connection with recruitment will be stored for the duration of the recruitment process, and where consent has been given to participate in the future recruitment processes — for the period indicated when the consent is obtained or until it is withdrawn. Data related to the course of studies, educational documentation, the issuing of documents and confirmation of qualifications will be stored for the period required by legal provisions applicable to documentation of the course of studies and documents issued in connection with the completion of education.

  14. Data processed on the basis of consent, including for marketing purposes, will be stored until the consent is withdrawn, an objection is lodged or the purpose of processing ceases, whichever occurs first, unless legal provisions justify a longer storage period.

  15. Data processed in connection with tracking graduates’ professional careers will be stored for the period necessary to achieve that purpose, no longer than until consent is withdrawn, an effective objection is lodged or the purpose of processing ceases, unless legal provisions provide for a longer storage period.

  16. If you believe that your personal data are being processed unlawfully, you may lodge a complaint with the supervisory authority, i.e. the President of the Personal Data Protection Office. Contact details of the supervisory authority: Personal Data Protection Office, ul. Stanisława Moniuszki 1A, 00-014 Warsaw; tel. 22 531 03 00; helpline 606 950 000, e-mail address: kancelaria@uodo.gov.pl; electronic delivery address: AE:PL-67085-31860-RWFHC-35.