Privacy policy

Audience: applicants, participants and alumni of BioLAB Program administered by the Polish-U.S. Fulbright Commission

Last update: October 2021

The Polish-U.S. Fulbright Commission (“Fulbright Poland”), based in Warsaw, Poland, ul. Emilii Plater 28, 00-688, KRS: 0000166179, acting as personal data controller in the meaning of EU’s General Data Protection Regulation (EU Regulation 2016/679) (“GDPR”), is committed to protecting and respecting your privacy, which includes stewarding your personal information in a secure and transparent manner.

Please read the following statement carefully as it details the ways in which we may process your personal data. Please note that the types of data that we process and how they are handled, as outlined below, may vary by your role as an applicant, participant or alumnus of the program.

With any questions regarding your data you can contact us at [email protected] or via post.

The purposes of processing the data

Fulbright Poland may carry out the following processes as part of the management of a program:

1. Application/Selection (Collecting and reviewing applications for the purpose of selecting potential program participants and/or notifying them of their selection for a program).
2. Record Creation/Management (Creating and maintaining a record in Fulbright Poland systems, electronic or otherwise, in order to carry out the management of the program).
3. Event Management (Planning and/or executing events including registration, scheduling of participants, or any other event-related activities for purposes including program enrichment or external engagements by Fulbright Poland).
4. Program Reporting (Producing and sharing reports, usually with the stakeholders about progress, activities and other program related information).
5. Program Promotion and Outreach (Promoting Fulbright Poland and the BioLAB Program, including soliciting applications to programs or email marketing).
6. Participant Progress Management (Collecting and analyzing any academic, employment or other information to ensure a participant is meeting the requirements of a program or on track for successful completion of an award).
7. Emergency Management (Assisting, corresponding and handling emergencies during a program participation).
8. Program Evaluation (Reporting, exporting, or compiling of data for the purposes of understanding and/or evaluating the state of the program/participants, impacts, or any other legitimate interest).
9. Alumni Management (Managing data of participants whose programs have ended, including the production of statistical reports, alumni correspondence and organizing alumni events).
10. Technical and Administrative Management (Ensuring the security of the IT system and to manage this system, as well as for analytical and statistical purposes).

The types of personal data we process

Throughout the lifecycle of the program and depending on your status as an applicant, participant or alumnus, we may process the following types of information:

1. Identifying information such as name and surname, gender, age, citizenship information, marital status, national identification number, government-issued identification (passport/ID) and picture.
2. Contact information such as email address, phone number, postal address.
3. Academic and professional information such as your academic history, work history, current employment, professional references, interviews and certifications.
4. Photographs or recordings of you during your participation in a program or from one of our events.
5. Information about your preferences such as your opinions, intentions and interests.

The types of special categories of personal data we process

We do not collect or process special categories of data at any stage of the program.

Basis for processing

We will only process your data if we have at least one valid lawful basis listed below:

1. In order to potentially enter or carry out a contract with you and/or the program sponsor to administer the program (Article 6 (1) (b) of the GDPR).
2. Necessity for compliance with a legal obligation to which the controller is subject, e.g. accounting and tax obligations (Article 6 (1) (c) of the GDPR).
3. Your consent, when applicable (Article 6 (1) (a) of the GDPR and Article 9 (2) (a) of the GDPR).As required by us to pursue our legitimate interests or the legitimate interests of others, in particular, provided that the legitimate interests below are not overridden by the interests or fundamental rights or freedoms of the individuals whose personal data (Article 6 (1) (f) of the GDPR), we are processing:
   1. when carrying out the processes listed above;
   2. when investigating any complaints received from you or from others, about us, or our service providers; or
   3. in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation).

Data retention

Fulbright Poland will retain your personal data for as long as required to perform the purposes for which the data was collected, depending on the legal basis for which that data was obtained and/or whether additional legal/regulatory obligations mandate that we retain your personal data.
We may also retain personal data for the period during which a claim may be made in relation to our professional relationship with you.

Fulbright Poland retains a permanent record of participation for its own internal record keeping. This may include basic information such as your name, academic title, field of study, level of study, home and host institution, grant start date, grant end date and aim of the grant, as well as your current affiliation and contact information if you give us your consent.

If your application is unsuccessful, your application data including your personal data will be anonymized, and the anonymous data, such as field of study, home institution, gender, location will be stored for statistical purposes only. Other personal data will be deleted.

Unsuccesful applications are stored up to one year from the application deadline. Succesful applications are stored up to 2 years from the internship end date.

Your rights

You have the right to submit inquiries to Fulbright Poland regarding the handling of your personal data. We will review your request in a timely manner and will carry out the request if it meets the proper legal requirements.

You have the right to:

1. access your personal data;
2. have your personal data rectified if it is inaccurate or incomplete;
3. have your personal data deleted or removed if there is no reason for its continued storage and processing;
4. object to your personal data being processed and to restrict the processing of your personal data in certain circumstances;
5. request the transfer of your personal data to another party;
6. the right to lodge a complaint with a supervisory authority in your country (in Poland: President of the Personal Data Protection Office); and
7. where you have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent. Please note that the withdrawal of your consent will not affect the lawfulness of any processing of personal data based on your consent before its withdrawal.

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.

You may submit your requests by email or by post. You can, in principle, exercise your rights free of charge, subject to statutory exceptions.

Automated decision making

We do not envisage that any decisions will be taken about you using automated means.

Who we may share your data with

Your application form will be shared with representatives of the host institutions:

1. Oklahoma Medical Research Foundation based in Oklahoma City, Oklahoma, USA;
2. University of Chicago based in Chicago, Illinois, USA;
3. University of Virginia based in Charlottesville, Virginia, USA;
4. University of Texas, Southwestern Medical Center based in Dallas, Texas, USA.

We need your explicit consent to share your personal data with host institutions, as they are located outside of the European Economic Area. Although consent is freely given, please be advised that without it we won’t be able to share your application, and thus your application will not be considered in the application process.

Basic information about your grant (such as your name, home and host institutions, year and field of study) will be published on Fulbright Poland website.

Access to some or all of the data may be granted to entities providing and supporting IT systems used by the Administrator and entities providing services related to the Administrator’s day-to-day operations (e.g. e-mail, postal services, platform for collecting applications) – under relevant agreements and while ensuring the application of by the above-mentioned entities of adequate technical and organizational measures ensuring data protection.

International transfers of data

Your personal data will be shared with host institutions located in the USA, which is outside of the European Economic Area. In relation to the USA, no decision has been issued by the European Commission recognizing that this country provides an adequate level of protection within the meaning of European data protection regulations. The transfer of your data to the US may involve the risk of access to data by US authorities, including law enforcement. If you are eligible to participate in the Program, the transfer of your personal data to the host institutions is necessary for the performance of the contract (Article 49 (1) (b) of the GDPR).

Some of the service providers used by Fulbright Poland may have some of the infrastructure outside the European Economic Area. Appropriate safeguards for data processing are ensured by signing data processing agreements, decisions of the EU Commission stating the appropriate level of data protection in the country to which they are transferred and, if required, signing the so-called “Standard contractual clauses”.

Note on changes to this statement

We may revise this privacy policy periodically and modify it as appropriate. We reserve the right to change this privacy policy by publishing the amended privacy policy on the Fulbright Poland website. We recommend revisiting and reviewing this policy regularly to ensure that you understand how we may be processing your personal data.