In accordance with Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as GDPR) (full text on the website: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=PL), Medical University of Gdańsk informs that:

1. The Controller of your personal data is Medical University of Gdańsk with its registered address at: ul. M. Skłodowskiej-Curie 3a, 80-210 Gdańsk.
   
   
2. The Controller has appointed the Data Protection Officer (hereinafter: IOD) who can be contacted in any matters related to the processing of personal data. You can contact the Data Protection Officer by e-mail at: iod@gumed.edu.pl”:mailto:iod@gumed.edu.pl
   
   
3. Your personal data shall be processed for the purposes of recruitment to the University, and if you are admitted, for the purposes of conducting the educational process, documenting the course of studies, and also for the purposes of the Data Controller’s compliance with the statistical, statutory, and archive obligations prescribed in the Higher Education Law and Science Act of 30 August 2018 along with implementing regulations issued on its basis – based on Article 6(1)(b)(c)(e) GDPR, i.e. since the processing is necessary for the performance of the contract the data subject is a party to, and for compliance with the legal obligation the Data Controller is subject to, and for the performance of the tasks carried out in the public interest.
   
   
4. Your personal data may also be processed for the purpose of:
   
   a. your using the library resources, and for the performance by the Main Library of the Medical University of Gdańsk of the tasks entrusted to it with respect to the provision of services to the users of the common, partnership library and information system of the Tri-City Library Complex (Academy of Music in Gdańsk, Maritime University in Gdynia, Academy of Fine Arts in Gdańsk, Academy of Physical Education and Sport in Gdańsk, and European Solidarity Centre in Gdańsk) pursuant to Article 6(1)(a) GDPR, i.e. on your consent given to the processing of personal data;
   b. informing you of any organised events, courses, conferences, competitions, promotions, or questionnaires pursuant to Article 6(1)(a) GDPR, as consent to data processing;
   c. compliance with the legal obligation stemming from the Regulation of the Minister of Health, of 26 August 2014 regarding medical examinations of candidates for secondary schools or higher education and for vocational qualification courses, students of these schools, students, students of qualifying vocational courses and participants of doctoral studies (Journal of Laws 2014: it. 1144, as amended) pursuant to Article 6(1)(c) and Article 9(2)(h) GDPR;
   d. conducting visual monitoring pursuant to Article 6(1)(f) GDPR, i.e. in pursuance of legitimate interests by the Medical University of Gdańsk;
   e. establishing and pursuing potential claims – in situations prescribed in the regulations of the common law based on Article 6(1)(f) GDPR, i.e. in pursuance of legitimate interests by the Medical University of Gdańsk.
   
   
5. Your provision of your personal data is mandatory once you have made your decision to join in the recruitment process, and it is furthermore necessary to attain the purposes specified in item 3. It is also prerequisite for your participation in the recruitment process and for your subsequent taking and completing the studies.
   
   
6. The recipients of your personal data shall be: the entities entitled to obtain them under the regulations of the law, the persons the Data Controller shall authorise to process the data in their performance of the duties of their job descriptions. Your data may further be received by entities, e.g. an occupational medicine unit, whom the Data Controller commissions to perform a service, especially with respect to handling the course of the studies run by the MUG, or other entities on the terms of entrustment agreements.
   
   
7. Your personal data shall be processed for the period necessary for the attainment of the purposes described above.
   
   Depending on the legal basis, this shall be, in particular:
   - the recruitment period (in the case of candidates not admitted to studies, they will be stored for the recruitment period and then for 6 months following the moment all appeal procedures initiated in the recruitment period have ceased to be deleted upon the lapse of the period),
   - in the case of candidates taking up studies in the selected mode of study following the recruitment – for the study period, and then for 50 years for archive purposes,
   - to a limited extent (the data of the payments made) – for the period defined in the Accounting Act, i.e. 5 years following the date the payment was made,
   - should you give your consent – until the time the user withdraws the consent, limits it, or takes other actions restricting the consent given.
   
   
8. Under the principles laid down in the GDPR regulations, you enjoy:
   
   a. the right to access your data,
   b. the right to rectify the data, if discordant with the actual facts,
   c. the right to erase the data, restrict their processing, and transfer the data in the circumstances prescribed by the law,
   d. the right to object to the processing of the data,
   e. in the event the processing is based on your consent, you enjoy the right to withdraw your consent at any time, although with no bearing on the legitimacy of the processing performed prior your withdrawal of the consent. You can voice your objection to the processing of your data and withdraw your consent by e-mail at: admission@gumed.edu.pl
   f. the right to lodge a complaint with the supervisory authority, i.e. President of the Personal Data Protection Office, should you decide that the processing of your personal data violates the personal data protection regulations.
   
   
9. The data you provide shall not be processed in any automated way, nor shall they be used to create profiles.
   
   
10. The Data Controller does not intend to transfer any personal data to any third country or an international organisation.