Study visits privacy notice

Please be aware that your personal information and data is collected and processed during the process of application for study visits for cybersecurity specialists from the EU to the U.S. The program of visits is run by the Polish-U.S. Fulbright Commission, in partnership with Fulbright Commissions based in: Bulgaria, Czech Republic, Hungary, Romania and Slovak Republic. The program is supported by U.S.-based entities: World Learning Inc. and Marymount University and funded by the U.S. Department of State.

Please read the following statement carefully as it details the way in which your personal data is processed.

Who controls and processes your data

Your data will be processed by the Polish-U.S. Fulbright Commission (the Controller) based in Warsaw, Poland (, full address: ul. K.I. Gałczyńskiego 4, 00-362 Warszawa, Poland, NIP: 526-17-19-106, REGON: 012580212. With any questions regarding your data you can contact our office at [email protected].

Whenever “we” or “our”  is used in the statement, it refers to the Controller. 

Information we collect from you

We will use your personal data provided in the application form to consider and review your application, in case you get selected to ensure your participation in the visit, and afterwards to evaluate the visit. The scope of data we collect may include:

In the application form:

  • Identifying contact information such as your name, surname, phone number, email address, gender, citizenship, passport’s validity date.
  • Academic and professional information such as your academic and/or employment history, professional references.
  • Information about your preferences such as your opinions, intentions and interests.
  • This program is open to all eligible candidates, however to ensure proper conditions and logistics, we need to be duly informed in advance about any disabilities or existing pre-conditions of the participants.

Selected candidates will be also asked to provide additional data:

  • Personal information required for flight ticket booking: gender, date of birth, passport’s number.

The provision of personal data is voluntary yet necessary for the application purposes and your participation in the visit.

Sharing information about you and the purposes of processing of your data

We will share your data with third parties during the application and selection processes as well as during the visit and its evaluation. Such third parties include:

  1. Fulbright Commission in your country: will receive your full application form. The Commission will also be the contact point for the purposes of J-1 visa issuance procedures (documents required for the visa procedure will arrive from the U.S. to the Commission’s office).
  2. Members of Fulbright Selection/Review Committees as appointed by the respective Commission – will receive your full application form.
  3. Our service providers, such as an accounting company, travel agency, insurance company, IT and shipping services providers. With each service provider we have signed a Data Protection Agreement to entrust your data will be stored and processed in accordance with Polish and E.U. data protection laws.

Successful applicants’ data will be shared also with the following entities:

  1. World Learning Inc., based in 1015 15th Street, NW, Suite 950, Washington, DC 20005 USA, ( will receive your identifying contact information, academic and professional information (a short bio composed by us based on your application form) for the purposes of program design and logistics of the visit. World Learning will collect from you additional personal information required to issue the J-1 visa. 
  2. Marymount University, based in 2807 N Glebe Rd, Arlington, VA 22207, USA, ( will receive your identifying contact information, academic and professional information (a short bio composed by us based on your application form) for the purposes of program design.
  3. Host institutions: institutions visited during the program will receive participants’ personal data prior to the visit. In most cases only basic identifying data (name & surname) as well as academic and professional information will be disclosed in order to tailor the program to the group’s profile. However, due to the nature and program of the visit, please mind that some institutions might require more detailed identifying information (such as your date of birth or passport number) for purposes of access control.
  4. The list of successful applicants will be published online (on the Polish-U.S. Fulbright Commission’s website) for transparency reasons – we will publish your name, surname and affiliation.

Our legal basis for processing information about you

We must have a recognised lawful basis for processing your personal data. We process your personal data mainly as part of our legitimate business interests. However, depending on the personal data we are collecting, we may process your data under one or more of these other legal reasons:

  • When we have to comply with the law or have a legal duty or obligation.
  • When we have your consent to use your information, including sensitive categories of personal data.
  • To fulfil a contractual obligation.

Retention of personal data

  • If your application is successful, your personal data, including your application, will be stored in our systems for the purposes of facilitating your visit and managing the alumni relationship. Your application form and all sensitive personal data will be deleted within 12 months after completing the visit. We will keep your contact information and basic information about your participation in the program. 
  • If your application is unsuccessful, your application data including your personal data will be anonymized, and the anonymous data will be stored for statistical purposes only. Other sensitive personal data will be deleted within 6 months after the recruitment deadline.

International transfers of personal data

As required by data protection legislation, we have strict security procedures regarding the storage and disclosure of personal data. The personal data that we collect about you may be transferred to, and stored at, or processed in one or more countries outside the European Economic Area (“EEA”) which have not yet been deemed by the Commission to offer adequate data protection such as the United States of America.

Your rights

You have rights under the GDPR including:

  • the right to access your personal data;
  • the right to have your personal data rectified if it is inaccurate or incomplete;
  • the right to have your personal data deleted or removed if there is no reason for its continued storage and processing;
  • the right to object to your personal data being processed and to restrict the processing of your personal data in certain circumstances;
  • the right to request the transfer of your personal data to another party;
  • the right to lodge a complaint with a supervisory authority in your country (in Poland: Inspector General for the Protection of Personal Data).

Automated decision-making

Your data will not be processed in an automated manner and will not be profiled.