Menu
This Privacy Policy sets forth the principles governing the processing and protection of personal data by Instrat Foundation, enabling: the use of Instrat’s websites (www.instrat.pl, energy.instrat.pl, esg.instrat.pl); contacting the organisation via email and telephone; collaborating and maintaining relations with media representatives; participating in the events; and engaging within the Foundation’s social media accounts.
The privacy policy enumerates the purposes for which Instrat Foundation processes data, the legal basis upon which such processing relies, and the duration for which data is retained. Furthermore, the document provides information regarding the rights of data subjects.
The Controller in respect of the personal data is Instrat Foundation with its registered office in Warsaw (Hoża 51 Street, 00-681 Warsaw), registered in the National Court Register under the number: 0000618811, hereinafter referred to as the Controller
In any matter related to the processing and protection of personal data, you may contact the Controller:
Instrat Foundation processes Users’ personal data as the Controller in accordance with the requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “GDPR”).
Instrat Foundation uses the technical measures required by personal data protection regulations to prevent personal data from being accessed and/or modified by unauthorised persons.
Whenever the Foundation processes your data:
To rectify or request the erasure of data, please provide precise details regarding the particular data which are subject to the request and the preferred method of data alteration (e.g., modification of personal data, complete erasure of personal data from the database).
The erasure of personal data may occur as a result of the withdrawal of consent or the submission of a legally admissible objection to the processing of personal data.
Should you wish to exercise your rights or seek further information pertaining to them, the Foundation may be reached through the communication channels delineated in section 1 of the Policy.
However Instrat obtains your personal data and whatever the purpose of our processing of your data, we will not make decisions about you that would be based solely on automated processing of your data and would have legal effects on you or otherwise significantly affect you.
If you believe that Instrat is processing your personal data unlawfully, you can lodge a complaint with the supervisory authority in your country of residence. In Poland, the authority is the President of the Personal Data Protection Office [pol. Prezes UODO], whose website is available at https://uodo.gov.pl, other authorities in Europe are listed at: https://edpb.europa.eu/about-edpb/about-edpb/members_en
The Foundation’s Services are hosted on the cyberfolks.pl server, which generates and analyses aggregated statistics on visits to the Services. Information is collected on:
The purpose is to ensure the operation of the Websites, to correct errors and to review analytics for visits to the Websites and the popularity of their content (excluding analytics for the behaviour of individual users).
The rights are described in section 4 of this Policy.
The processing of personal data is based on Article 6(1)(f) of the GDPR, which is the Foundation’s legitimate interest
The legitimate interests are to ensure the operation of the Websites, to correct errors and to review analytics for visits to the Websites
Instrat will share Users data only with:
The e-mail address or phone number, as well as any other information the User inserts, such as your forename and surname, or information about User’s situation.
The purpose is to answer the messages or to deal with a matter the User has told us about, and to analyse the Foundation communication and the enquiries it receives.
The rights are described in section 4 of this Policy.
The processing of personal data is based on Article 6(1)(f) of the GDPR, which is the Controller’s legitimate interest.
The legitimate interest is: to achieve the statutory objectives by managing incoming correspondence, resolving matters presented by the User and replying to the messages; improving the Foundation’s operations by analysing the queries received and the responses provided – which serves to achieve the statutory objectives.
Access to the User’s personal data is enabled only to authorised employees and subcontractors and the provider of IT services to the Foundation, the entity that stores personal data for the Foundation.
Forename and surname, contact details (e-mail address and/or phone number), affiliation (current and previous) and, where appropriate, information about User’s interactions with the Foundation in the past.
The data is processed in order to:
The rights are described in section 4 of this Policy.
Data is obtained from publicly available sources (e.g. from the editorial page) or obtained from other organisations or media persons. Often also provided directly by media representatives.
The processing of personal data is based on Article 6(1)(f) of the GDPR, which is the Controller’s legitimate interest.
The legitimate interest is:
Access to the User’s personal data is enabled only for
Forename and surname, pseudonym, position, affiliation, contact details (e-mail address and/or phone number) and other information if required by the nature of the event (e.g. training, conference) or by the grant agreement.
The purpose of data processing is:
The rights are described in section 4 of this Policy.
Data is provided directly by the User if he/she has expressed a wish to participate in an event.
Data is processed to enter into and comply with the agreement (e.g. for a training, conference) (Article 6(1)(b) of the GDPR) and is based on Article 6(1)(f) of the GDPR, which is the legitimate interest of the Controller.
The legitimate interest is:
Access to the User’s personal data is enabled only for
Username, forename and surname (if such information is displayed on your profile page), the date when you started to follow us, your comments and reactions to our content, and all other information you may give us via such channels, as well as any data that the social medium concerned processes for statistical purposes. If advertising content is targeted at you, we will process your age category, sex, location (town/city) and your interests/hobbies. Username, forename and surname (if such information is displayed on the profile page); information on how long the User has been following the Foundation’s accounts; comments and reactions to content and any other information that is provided by the User through these channels; as well as any data that the social medium concerned processes for statistical purposes. If advertising content is targeted at the User, the Foundation will process data on age range, gender, locality, selected interests.
The purpose of data processing is to:
The rights are described in section 4 of this Policy.
The Foundation receives data from the User when the User starts following Instrat on Social Media or otherwise first interacts with the Foundation. In the case of targeted advertising, Instrat may receive User’s data from the Social Media where such advertising content is displayed for the Foundation, namely Facebook Ireland Ltd. or Google Ireland Ltd. Instrat will provide data to the Social Media where the Foundation has accounts, i.e. Facebook Ireland Ltd., Google Ireland Ltd., X Corp., and LinkedIn Corp.
Instrat processes personal data based on Article 6(1)(f) of the GDPR, which is the Foundation’s legitimate interest.
The legitimate interest is:
8.1. Providing personal data is voluntary. However, failure to provide the data required by the Foundation or the withdrawal of consent to its processing may make it impossible to ensure the interactions with the Foundation (e.g. continuity of communication; ensuring participation in an event).
9.1. The duration of data processing by the Foundation depends on the type of service and the purpose of the processing. Additionally, the duration of data processing may also be determined by legislation when it serves as the legal grounds for processing. If the data are processed based on the legitimate interests of the Controller, the data shall be processed for a period enabling the fulfilment of these interests or until an effective objection to the processing is raised. When processing is based on consent, data is processed until consent is withdrawn. In cases where the basis for processing is the necessity to conclude and perform a contract, the data are processed until the termination of the contract.
9.2. The processing period may be extended if necessary for the establishment or assertion of claims, or for defence against claims. Thereafter, extension is permissible only if mandated by law. 10. Transfer of personal data outside the European Economic Area (EEA) 10.1 Personal data is not transferred to a third country or international organisation by the Foundation.
10.1. Personal data is not transferred to a third country or international organisation by the Foundation.
10.2. However, the social media on which the Foundation’s accounts appear (Facebook, X, Linkedin, Instagram, Youtube) and the Google tools used by the Controller may transfer data outside the European Economic Area, to the United States. In such a situation, the transfer of personal data is based on the adequacy decision for the EU-U.S. Data Privacy Framework.
11.1. In order to monitor information about users of www.instrat.pl, energy.instrat.pl, and esg.instrat.pl, Instrat utilises cookies provided by Google Analytics. These cookies are used to analyse and adjust the users’ usage of the website, and to generate statistics and reports on its functioning. Detailed information regarding the extent and principles of data collection associated with this service can be found at: https://www.google.com/intl/pl/policies/privacy/partners.
11.2. The use of cookies for data collection, including accessing data stored on the User’s device, necessitates the user’s consent. This consent can be withdrawn at any time. Consent is not necessary only in cases where cookies are essential for providing a telecommunications service (such as data transmission to display content).
11.3. It is possible to withdraw the consent to the use of cookies through your browser settings. Detailed information on how to do this can be found at the following links: Internet Explorer: https://support.microsoft.com/pl-pl/help/17442/windows-internet-explorer-delete-manage-cookies Mozilla Firefox: http://support.mozilla.org/pl/kb/ciasteczka Google Chrome: http://support.google.com/chrome/bin/answer.py?hl=pl&answer=95647 Opera: http://help.opera.com/Windows/12.10/pl/cookies.html Safari: https://support.apple.com/kb/PH5042?locale=en-GB
12.1. The Policy will be periodically reviewed and updated as needed.
12.2. The current version of the Policy was adopted on January 9, 2023.
Head of Communications & External Relations