Audience: Applicants, participants and alumni of the „Cybersecurity in universities – study visits to the U.S.” program
Last updated: May 2021
The Polish-U.S. Fulbright Commission (“Fulbright Poland”), based in Warsaw, Poland, ul. Emilii Plater 28, 00-688, NIP: 526-17-19-106, REGON: 012580212 acting as personal data controller in the meaning of EU’s General Data Protection Regulation (EU Regulation 2016/679) (“GDPR”), is committed to protecting and respecting your privacy, which includes stewarding your personal information in a secure and transparent manner.
Please read the following statement carefully as it details the ways in which we may process your personal data. Please note that the types of data that we process and how they are handled, as outlined below, may vary by your role as an applicant, participant or alumnus.
With any questions regarding your data you can contact us at [email protected] or via post.
Please read the following statement carefully as it details the way in which your personal data is processed.
Information we collect from you
We will use your personal data provided in the application form to consider and review your application, in case you get selected to ensure your participation in the visit, and afterwards to evaluate the visit.
The scope of data we collect may include:
In the application form:
- Identifying contact information such as your name, surname, phone number, email address, gender, citizenship, passport’s validity date.
- Academic and professional information such as your academic and/or employment history, professional references.
- Information about your preferences such as your opinions, intentions and interests.
- This program is open to all eligible candidates, however to ensure proper conditions and logistics, we need to be duly informed in advance about any disabilities or existing pre-conditions of the participants.
Selected candidates will be also asked to provide additional data:
- Personal information required for flight ticket booking: gender, date of birth, passport’s number.
- Medical information required for visa procedures and travel planning during the pandemic: information about vaccination status and the type of vaccine against COVID-19.
The provision of personal data is voluntary yet necessary for the application purposes and your participation in the visit.
Purposes of processing the data
- Application/Selection (Collecting and reviewing applications for the purpose of selecting potential program participants and/or notifying them of their selection for a program).
- Record Creation/Management (Creating and maintaining a record in Fulbright Poland systems, electronic or otherwise, in order to carry out the management of the program).
- Medical Review (Reviewing medical information for the purpose of determining visa eligibility, identifying any issues that would prohibit an individual from participating in a program or activity, or would require additional accommodations to be arranged).
- Participant Agreements (Drafting, sending, or receiving an agreement document such as Grant Authorization Forms, Terms of Agreement, Terms of Appointment, Program Contracts, or any other type of agreement document with program participants).
- Event Management (Planning and/or executing events including registration, scheduling of participants, or any other event-related activities for purposes including program enrichment or external engagements by Fulbright Poland).
- Program Reporting (Producing and sharing reports, usually with the stakeholders about progress, activities and other program related information).
- Program Promotion and Outreach (Promoting Fulbright Poland and the program, including soliciting applications to programs or email marketing).
- Participant Progress Management (Collecting and analyzing any academic, employment or other information to ensure a participant is meeting the requirements of a program or on track for successful completion of an award).
- Financial Management (Processing payment transactions to or from participants, vendors, or other payees using a bank transfer or other methods).
- Emergency Management (Assisting, corresponding and handling emergencies during a program participation).
- Program Evaluation (Reporting, exporting, or compiling of data for the purposes of understanding and/or evaluating the state of the program/participants, impacts, or any other legitimate interest).
- Alumni Management (Managing data of participants whose programs have ended, including the production of statistical reports, alumni correspondence and organizing alumni events).
- Technical and Administrative Management (Ensuring the security of the IT system and to manage this system, as well as for analytical and statistical purposes).
Who we may share your data with
We might share your data with third parties during the application and selection processes as well as during the visit and its evaluation. Such third parties may include:
- Fulbright Commission in your country: will receive your full application form. The Commission will also be the contact point for the purposes of J-1 visa issuance procedures (documents required for the visa procedure will arrive from the U.S. to the Commission’s office).
- Members of Fulbright Selection/Review Committees as appointed by the respective Commission – will receive your full application form.
- Our service providers, such as an accounting company, travel agency, insurance company, IT and shipping services providers.
Successful applicants’ data will be shared also with the following entities:
- World Learning Inc., based in 1015 15th Street, NW, Suite 950, Washington, DC 20005 USA, (https://www.worldlearning.org): will receive your full application form for the purposes of program design and logistics of the visit. World Learning will collect from you additional personal information required to issue the J-1 visa.
- Marymount University, based in 2807 N Glebe Rd, Arlington, VA 22207, USA, (https://www.marymount.edu/Home): will receive your full application form for the purposes of program design.
- Host institutions: institutions visited during the program will receive participants’ personal data prior to the visit. In most cases only basic identifying data (name & surname) as well as academic and professional information will be disclosed in order to tailor the program to the group’s profile. However, due to the nature and program of the visit, please mind that some institutions might require more detailed identifying information (such as your date of birth or passport number) for purposes of access control. Please mind that special means of security may apply due to pandemic-related restrictions. Information about your vaccination status might be required.
- The list of successful applicants will be published online (on the Polish-U.S. Fulbright Commission’s website) for transparency reasons – we will publish your name, surname and affiliation.
Our legal basis for processing information about you
We will only process your data if we have at least one valid lawful basis listed below:
- In order to potentially enter or carry out a contract with you (Article 6 (1) (b) of the GDPR).
- Necessity for compliance with a legal obligation to which the controller is subject, e.g. accounting and tax obligations (Article 6 (1) (c) of the GDPR).
- Your consent, when applicable (Article 6 (1) (b) of the GDPR and Article 9 (2) (a) of the GDPR).
- As required by us to pursue our legitimate interests or the legitimate interests of others, in particular, provided that the legitimate interests below are not overridden by the interests or fundamental rights or freedoms of the individuals whose personal data (Article 6 (1) (f) of the GDPR), we are processing:
- when carrying out the processes listed above;
- when investigating any complaints received from you or from others, about us, or our service providers; or
- in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation).
Retention of personal data
- Fulbright Poland will retain your personal data for as long as required to perform the purposes for which the data was collected, depending on the legal basis for which that data was obtained and/or whether additional legal/regulatory obligations mandate that we retain your personal data. We may also retain personal data for the period during which a claim may be made in relation to our professional relationship with you.
- If your application is successful, your personal data, including your application, will be stored in our systems for the purposes of facilitating your visit and managing the alumni relationship. Your application form and all sensitive personal data will be deleted within 12 months after completing the visit. We will keep your contact information and basic information about your participation in the program.
- If your application is unsuccessful, your application data including your personal data will be anonymized, and the anonymous data will be stored for statistical purposes only. Other sensitive personal data will be deleted within 6 months after the recruitment deadline.
International transfers of personal data
As required by data protection legislation, we have strict security procedures regarding the storage and disclosure of personal data. The personal data that we collect about you may be transferred to, and stored at, or processed in one or more countries outside the European Economic Area (“EEA”) which have not yet been deemed by the Commission to offer adequate data protection such as the United States of America.
Transfer of your data outside the EEA is always based on an appropriate legal basis set forth in Chapter V of the GDPR, in particular your explicit consent or standard contractual clauses approved by the European Commission.
Your rights
You have the right to submit inquiries to Fulbright Poland regarding the handling of your personal data. We will review your request in a timely manner and will carry out the request if it meets the proper legal requirements.
You have the right to:
- access your personal data;
- have your personal data rectified if it is inaccurate or incomplete;
- have your personal data deleted or removed if there is no reason for its continued storage and processing;
- object to your personal data being processed and to restrict the processing of your personal data in certain circumstances;
- request the transfer of your personal data to another party;
- the right to lodge a complaint with a supervisory authority in your country (in Poland: President of the Personal Data Protection Office); and
- where you have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent. Please note that the withdrawal of your consent will not affect the lawfulness of any processing of personal data based on your consent before its withdrawal.
These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.
You may submit your requests by email or by post. You can, in principle, exercise your rights free of charge, subject to statutory exceptions.
Automated decision-making
Your data will not be processed in an automated manner and will not be profiled.
Note on changes to this statement
We may revise this privacy policy periodically and modify it as appropriate. We reserve the right to change this privacy policy by publishing the amended privacy policy on the Fulbright Poland website. We recommend revisiting and reviewing this policy regularly to ensure that you understand how we may be processing your personal data.