Audience: applicants, participants and alumni of Fulbright programs managed by the Polish-U.S. Fulbright Commission
Last update: August 2021
Table of Contents
The Polish-U.S. Fulbright Commission (“Fulbright Poland”), based in Warsaw, Poland, ul. Emilii Plater 28, 00-688, REGON: 012580212 acting as personal data controller in the meaning of EU’s General Data Protection Regulation (EU Regulation 2016/679) (“GDPR”), is committed to protecting and respecting your privacy, which includes stewarding your personal information in a secure and transparent manner.
Please read the following statement carefully as it details the ways in which we may process your personal data. Please note that the types of data that we process and how they are handled, as outlined below, may vary both from program to program and by your role as an applicant, participant or alumnus of a particular program.
With any questions regarding your data you can contact us at [email protected] or via post.
The types of personal data we process
Throughout the lifecycle of a particular program, and depending on your status as an applicant, participant or alumnus, we may process the following types of information:
- Identifying and contact information such as your contact details, age, gender, citizenship information, marital status, username, national identification number, government-issued identification (passport/ID) and picture;
- Academic and professional information such as your academic history, job titles, salary, work history, school attended, employee files, employment history, evaluations, professional references, interviews and certifications;
- Family information such as your family structure, emergency contact information, details of dependents, marriages and relationships;
- Financial information about your bank account, and personal income;
- Photographs or recordings of you during your participation in a program or from one of our events;
- Information related to dependents accompanying you on your program, including minors;
- Information about your personal history such as your travel history and other events in your life; and
- Information about your preferences such as your opinions, intentions and interests.
Additionally, we may process data that is generally considered to be sensitive in nature. Please see the section below for more details.
Special categories of data
In addition to the types of data listed above, we may also collect, hold and use the following categories of personal data about you that are of a sensitive nature (“Special Categories of Personal Data”):
Special categories of personal data may include:
- Information concerning your health;
- Information relating to criminal convictions and offences or related security measures;
- Information about your political views;
- Information about your sexual orientation (only if you decide to provide us with such data);
- Data revealing racial or ethnic origin (only if you decide to provide us with such data);
- Political, religious or philosophical beliefs;
- Trade union membership (only if you decide to provide us with such data).
We will only collect this information when it is necessary and required for the purposes listed in the “The purposes of processing your data” section below or if you choose to provide it to us voluntarily.
The most common scenarios of processing special categories of personal data are when we collect medical information in order to review your medical history to determine eligibility or additional accomodations to participate in a program; your criminal history when we are required to run a background check ; and information concerning minors, if you are bringing dependents with you and we are required to process their information for visa sponsorship or other purposes. In most cases we only process other types of special categories of personal data if you voluntarily provide it to us, such as referring to religious or political views in an application essay.
The purposes of processing the data
Fulbright Poland may carry out the following processes as part of the management of a program:
- Application/Selection (Collecting and reviewing applications for the purpose of selecting potential program participants and/or notifying them of their selection for a program).
- Record Creation/Management (Creating and maintaining a record in Fulbright Poland systems, electronic or otherwise, in order to carry out the management of the program).
- Financial Verification (Verifying availability of funds or income to cover program-related costs/expenses, financial need, or other financial requirements of a program).
- Medical Review (Reviewing medical information for the purpose of determining visa eligibility, identifying any issues that would prohibit an individual from participating in a program or activity, or would require additional accommodations to be arranged).
- Participant Agreements (Drafting, sending, or receiving an agreement document such as Grant Authorization Forms, Terms of Agreement, Terms of Appointment, Program Contracts, or any other type of agreement document with program participants).
- Insurance/Health Benefit Enrolment and/or Management (Enrolling a participant in a health benefit plan to ensure coverage in the case of medical issues or emergencies).
- Event Management (Planning and/or executing events including registration, scheduling of participants, or any other event-related activities for purposes including program enrichment or external engagements by Fulbright Poland).
- Program Reporting (Producing and sharing reports, usually with the stakeholders about progress, activities and other program related information).
- Program Promotion and Outreach (Promoting Fulbright Poland and the Fulbright Program, including soliciting applications to programs or email marketing).
- Participant Progress Management (Collecting and analyzing any academic, employment or other information to ensure a participant is meeting the requirements of a program or on track for successful completion of an award).
- Financial Management (Processing payment transactions to or from participants, vendors, or other payees using a bank transfer or other methods).
- Emergency Management (Assisting, corresponding and handling emergencies during a program participation).
- Program Evaluation (Reporting, exporting, or compiling of data for the purposes of understanding and/or evaluating the state of the program/participants, impacts, or any other legitimate interest).
- Alumni Management (Managing data of participants whose programs have ended, including the production of statistical reports, alumni correspondence and organizing alumni events).
- Technical and Administrative Management (Ensuring the security of the IT system and to manage this system, as well as for analytical and statistical purposes).
We may send your data to or receive it from third parties to carry out the processes listed above. These third parties may include:
- Program and award sponsors, including U.S. State Department, Bureau of Educational and Cultural Affairs (“ECA”) and the Polish Ministry of Science and Higher Education,
- The Institute of International Education (“IIE”) – the agency contracted by ECA to administer the Fulbright Program,
- World Learning – the agency contracted by ECA to administer the Fulbright Specialist Program,
- Fulbright Foreign Scholarship Board (FFSB),
- Service providers such as cloud storage, email, CRM, survey platform, email marketing and newsletter platform, external accounting services, postal services, document archiving services,
- Members of the Consulting Team, independent reviewers and the Selection Committee appointed by Fulbright Poland,
- The U.S. Embassy and Consulate in Poland,
- The Polish Embassy and Consulates in the U.S.,
- Your host institution,
- Alumni associations,
- American Spaces in Poland,
- Additional third parties which may include legal counsel representing Fulbright Poland, courts, tribunals, regulators, government authorities and law enforcement officials if required by law or for Fulbright Poland’s legitimate interest in compliance with applicable laws/regulations,
- Basic information about your grant (such as your name, home and host institutions, project title, award name) will be published on Fulbright Poland website.
Moreover, your data may be transferred to entities processing them at our request but only for the purpose and scope necessary for the implementation of the above-mentioned purposes, including entities providing IT services for us. Such entities process data on the basis of contracts concluded with us and only in accordance with our instructions.
International data transfers
As required by data protection legislation, we have strict security procedures regarding the storage and disclosure of personal data.
The personal data that we collect about you may be transferred to, stored at or processed in one or more countries, including those outside the European Economic Area (“EEA”), which have not yet been deemed by regulators to offer adequate data protection. These include but are not limited to, the United States of America, which is where ECA, FFSB, IIE and other third parties identified in the “Who we may share your data with” section above are located.
Transfer of your data outside the EEA is always based on an appropriate legal basis set forth in Chapter V of the GDPR, in particular your explicit consent or standard contractual clauses approved by the European Commission.
Basis for processing
We will only process your data if we have at least one valid lawful basis listed below:
- In order to potentially enter or carry out a contract with you and/or the program sponsor to administer the program (Article 6 (1) (b) of the GDPR).
- Necessity for compliance with a legal obligation to which the controller is subject, e.g. accounting and tax obligations (Article 6 (1) (c) of the GDPR).
- Your consent, when applicable (Article 6 (1) (a) of the GDPR and Article 9 (2) (a) of the GDPR).
- As required by us to pursue our legitimate interests or the legitimate interests of others, in particular, provided that the legitimate interests below are not overridden by the interests or fundamental rights or freedoms of the individuals whose personal data (Article 6 (1) (f) of the GDPR), we are processing:
- when carrying out the processes listed above;
- when investigating any complaints received from you or from others, about us, or our service providers; or
- in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation).
Fulbright Poland will retain your personal data for as long as required to perform the purposes for which the data was collected, depending on the legal basis for which that data was obtained and/or whether additional legal/regulatory obligations mandate that we retain your personal data.
We may also retain personal data for the period during which a claim may be made in relation to our professional relationship with you.
Fulbright Poland retains a permanent record of participation for its own internal record keeping. This may include basic information such as your name, academic title, field of study, home and host institution, grant start date, grant end date and aim of the grant.
If your application is unsuccessful, your application data including your personal data will be anonymized, and the anonymous data, such as field of study, home institution, gender, location will be stored for statistical purposes only. Other personal data will be deleted.
Automated decision making
We do not envisage that any decisions will be taken about you using automated means.
Security of personal data
We as your data controller conduct a risk analysis on an ongoing basis to ensure that personal data is processed by us in a safe manner – ensuring, inter alia, that only authorized persons have access to data and only to the extent that it is necessary due to the tasks they perform. We make sure that all operations on personal data are recorded and performed only by authorized employees and associates.
We as your data controller take all necessary steps to ensure that our subcontractors and other cooperating entities guarantee the application of appropriate security measures in each case when they process personal data on our behalf.
You have the right to submit inquiries to Fulbright Poland regarding the handling of your personal data. We will review your request in a timely manner and will carry out the request if it meets the proper legal requirements.
You have the right to:
- access your personal data;
- have your personal data rectified if it is inaccurate or incomplete;
- have your personal data deleted or removed if there is no reason for its continued storage and processing;
- object to your personal data being processed and to restrict the processing of your personal data in certain circumstances;
- request the transfer of your personal data to another party;
- the right to lodge a complaint with a supervisory authority in your country (in Poland: President of the Personal Data Protection Office); and
- where you have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent. Please note that the withdrawal of your consent will not affect the lawfulness of any processing of personal data based on your consent before its withdrawal.
These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.
You may submit your requests by email or by post. You can, in principle, exercise your rights free of charge, subject to statutory exceptions.
Note on changes to this statement