PRIVACY POLICY

I. DEFINITIONS

1. Controller – the controller referred to in Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
2. Personal data – means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person date of birth, phone number, login, identification number, location data, online identifier, information collected through cookies and other similar technologies, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of a natural person. MOS processes the Personal Data of Users and of persons on whose behalf Users perform specific actions within MOS.
3. Account – a set of characteristics identifying the User that enables access to MOS.
4. Case Management Module (MOS) – an IT system operated by the Head of the Office for Foreigners, enabling, in particular, the submission of an application for a temporary residence permit and attachments to such an application, an application for a permanent residence permit, or an application for an EU long-term resident’s residence permit in electronic form using an online service.
5. Recipient – a natural or legal person, public authority, agency, or other entity to whom Personal Data is disclosed, regardless of whether they are a third party. Public authorities that may receive Personal Data in the course of specific proceedings in accordance with Union law or the law of a Member State are not considered Recipients; the processing of such data by these public authorities must comply with the data protection provisions applicable to the purposes of the processing.
6. Processor – a natural or legal person, public authority, agency, or other body that processes Personal Data on behalf of the Controller.
7. Policy – this Privacy Policy.
8. Terms of Service – a document specifying, in particular, the rules for using the Case Management Module portal and the scope of Users’ responsibilities.
9. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
10. User – a natural person who is registered with MOS and has an Account there.

II. PURPOSES AND SCOPE OF THE PRIVACY POLICY

The purpose of this Policy is to define the measures taken by the Controller regarding the protection of Personal Data processed through MOS. The Policy specifies, in particular, the scope and legal basis for the processing of Personal Data collected by the Controller in connection with Users’ use of MOS.

The Controller obtains Personal Data from the User when creating an Account in MOS, in connection with the User’s activities in MOS, and in connection with updates to Personal Data made through the Account.

III. SCOPE OF PERSONAL DATA PROCESSED BY THE CONTROLLER

During registration (creating an Account), it is mandatory to provide the following Personal Data:

1. first and last name,
2. date of birth,
3. gender,
4. citizenship,
5. PESEL
6. email address.

Failure to provide the information listed above will prevent registration with MOS, as it is necessary to submit an application through MOS.

You may voluntarily provide a mailing address during registration.

Creating an Account and accessing the Account require User authentication using an electronic identification method in accordance with Article 20a(1) of the Act of February 17, 2005, on the computerization of the activities of entities performing public tasks, providing the User’s personal data indicated in the Registration Form, and accepting the Terms of Service and Privacy Policy. The Account will be activated using an activation link sent via email. An Account that is not activated within the validity period of the activation link will be automatically deleted.

IV. PURPOSE, LEGAL BASIS, AND DURATION OF PERSONAL DATA PROCESSING

Data processed via the MOS will be used for the Head of the Office for Foreigners to perform statutory tasks specified, inter alia, in the Act of December 12, 2013, on Foreigners, and the Act of June 13, 2003, on granting protection to foreigners on the territory of the Republic of Poland, in particular with regard to the online completion of application forms for granting a foreigner a temporary residence permit and a permanent residence permit on the territory of the Republic of Poland. Additionally, MOS allows for the creation of Accounts for minors, which are managed by their legal guardians.

When using the Account, personal data will be processed to fulfill the legal obligation incumbent upon the Controller arising from the aforementioned laws and to perform tasks carried out within the scope of public authority entrusted to the Controller (Article 6(1)(c) and (e), Article 9(2)(g) of the GDPR).

Personal data may also be processed through MOS for analytical and statistical purposes pursuant to Article 6(1)(a) of the GDPR. For this purpose, the Controller will collect information such as data from cookies, browser information, and IP addresses. If this information is necessary for the functioning of MOS, it is processed pursuant to Article 6(1)(f) of the GDPR.

The Controller may process Personal Data in connection with the right to pursue claims or defend against claims pursuant to Article 6(1)(f) of the GDPR. For this purpose, the Controller may process Personal Data until the expiration of the statute of limitations in accordance with applicable regulations.

V. RETENTION PERIOD OF PERSONAL DATA IN MOS

Personal Data will be processed by MOS until the User deletes the Account or due to the User’s inactivity in the Account.

VI. IP ADDRESS, COOKIES

Cookies are IT data, specifically text files, stored on Users’ end devices (e.g., computer, phone, tablet) and transmitted by websites. These files allow the User’s device to be recognized, enabling the website to be tailored to their individual preferences, displayed in the User’s language as remembered by these files, and utilizing other website settings selected by the User. Cookies typically contain the name of the website they come from, their storage duration on the end device, and a unique identifier.

Cookies are also used to create anonymous, aggregated statistics that help the Administrator understand how the User uses MOS. Cookies also help ensure the refinement and smooth operation of MOS, including testing its performance.

Cookies can be categorized as follows:

1. Based on necessity for service delivery:

1. essential – these are absolutely necessary for the proper functioning of MOS or the features the User wishes to use,
2. functional – these are important for the operation of MOS because:

• • they serve to enhance the functionality of MOS; without them, the portal will function correctly but will not be tailored to the User’s preferences,
  • they ensure a high level of MOS functionality; without them, the portal’s functionality may be reduced, but their absence should not prevent full use of the portal,
  • they support most of MOS’s functionality; blocking them will cause selected features to not work properly.

2. Based on the duration for which cookies will be stored on the User’s device:

1. session cookies – cookies stored for the duration of the browser session and deleted upon closing the browser or logging out of MOS,
2. persistent – these are not deleted when the browser is closed and remain on the User’s device for the duration specified in the cookie parameters or until they are manually deleted by the User.

3. Based on their purpose:

1. MOS configuration – they enable the configuration of functions and services on the portal,
2. MOS security and reliability – they enable authentication verification and optimization of the portal’s performance,
3. authentication – they allow the system to detect when the User is logged in, enabling MOS to display relevant information and features,
4. session state – they allow for the storage of information about how Users interact with MOS, helping to improve the services available on the portal and enhance the browsing experience,
5. processes – enable the smooth operation of MOS and the features available on it.

As a rule, cookies do not constitute Personal Data. However, certain information stored in cookies (e.g., regarding preferences), especially when combined with other information about the User, may be treated as Personal Data. Personal Data collected using cookies may be processed solely for the purpose of performing the specific functions described above for the User.

By default, web browser software allows cookies to be placed on the User’s device. These settings can be changed to block the automatic handling of cookies in the web browser settings or to notify the User each time a cookie is sent to their device. Browser settings can be changed individually for each browser.

Restricting the use of cookies may affect certain features available on MOS.

VII. USERS’ RIGHTS REGARDING THE PROCESSING OF PERSONAL DATA AND THEIR EXERCISE

Users have the following rights arising from the processing of their Personal Data by the Administrator.

1. The right to access Personal Data and obtain a copy thereof.
2. The right to rectify Personal Data when the Personal Data is inaccurate or incomplete.
3. The right to erasure of Personal Data.
4. The right to restrict the processing of Personal Data.
5. The right to data portability with respect to Personal Data processed by automated means based on consent.
6. The right to object to the processing of Personal Data.
   
7. The right to withdraw consent to the processing of Personal Data without affecting the lawfulness of the processing prior to withdrawal.

Notwithstanding the foregoing, the User has the right to lodge a complaint regarding the processing of Personal Data by the Controller with the supervisory authority, which is the President of the Office for Personal Data Protection (address: ul. Stawki 2, 00-193 Warsaw).

VIII. RECIPIENTS OF PERSONAL DATA AND OTHER ENTITIES TO WHICH THE CONTROLLER MAY TRANSFER PERSONAL DATA

The Controller may transfer Personal Data to processors providing IT, postal, consulting, and legal services to the Controller. Notwithstanding the foregoing, the Controller may transfer Personal Data to public authorities and other public entities in connection with their performance of statutory duties. In such cases, these entities may become separate controllers of Personal Data. Personal Data processed by MOS is not transferred outside the European Economic Area.

IX. AMENDMENTS

This Policy may be amended if necessary, in which case Users will be notified via an appropriate notice available on MOS. The User will have the opportunity to confirm that they have reviewed the changes.

X. CONTACT INFORMATION

Information regarding the processing of Personal Data at MOS may be obtained by contacting the Data Protection Officer appointed by the Controller, in writing to the Controller’s address (mailing address: ul. Taborowa 33, 02-699 Warsaw) or electronically at: iod@udsc.gov.pl.