Privacy Policy

This Privacy Policy covers the processing of personal data of people who visit the iReteslaw repository and of people who hold a user account. The processing of data connected with depositing works in the repository is governed by a separate privacy notice.

The controller of personal data is the Institute of Slavic Studies, Polish Academy of Sciences, with its registered office at Jaracza 1, 00-378 Warsaw, Poland, referred to below as the “Controller”.

Contact details for the Controller: sekretariat@ispan.edu.pl, +48 504071786.

The Controller has appointed a Data Protection Officer, who can be contacted on matters concerning the processing of personal data by email at iod@ispan.edu.pl, or by post at the Controller’s address given above, marked “ochrona danych osobowych” (personal data protection).

Personal data is processed for the following purposes:

1. Operating the repository, including adapting its content to users’ needs – on the basis of the Controller’s legitimate interest (Article 6(1)(f) GDPR) in the proper functioning of the repository;
2. Compiling statistics and analyzing traffic in the repository – on the basis of the Controller’s legitimate interest (Article 6(1)(f) GDPR) in obtaining information about the number of people visiting the site;
3. Keeping the repository secure, including detecting misuse – on the basis of the Controller’s legitimate interest (Article 6(1)(f) GDPR) in securing the data held in the system;
4. Answering questions and requests sent to the Controller by users – on the basis of the Controller’s legitimate interest (Article 6(1)(f) GDPR) in responding to questions and requests;
5. Creating and administering user accounts – on the basis of the Controller’s legitimate interest (Article 6(1)(f) GDPR) in enabling users to register on the site;
6. Sending users the email notifications they have subscribed to about new or changed content in the repository – on the basis of the Controller’s legitimate interest (Article 6(1)(f) GDPR) in delivering the notifications users have requested;
7. Establishing, pursuing, or defending against claims – on the basis of the Controller’s legitimate interest (Article 6(1)(f) GDPR) in defending its legal position.

The following categories of data are processed in the repository:

1. Technical data – IP address, browser type, operating system, device information, and the time and date of the visit;
2. Data provided voluntarily by the user – first name, last name, and email address – to the extent that the user supplies them through the contact or registration forms;
3. Account data of registered users – email address, first name, last name, and password (stored in secured form).

Personal data may be disclosed to:

1. Providers of services to the Controller, in particular hosting, IT, and analytics services, under data processing agreements;
2. Public authorities in the cases provided for by law.

The personal data covered by this Policy is not transferred outside the European Economic Area. Transfers of data connected with deposited works are governed by the privacy notice for people depositing material in the repository.

Personal data is retained as follows:

1. Technical data (server logs): for 54 weeks from the date it is recorded;
2. Data from contact forms: for as long as is needed to answer the user’s question, and thereafter until any related claims become time-barred;
3. Account data: for as long as the user account exists; it is deleted when the account is closed.

In connection with the processing of personal data, users have the following rights:

1. The right to access the data and to obtain a copy of it;
2. The right to have inaccurate data corrected or incomplete data completed;
3. The right to erasure (the “right to be forgotten”) in the cases provided for in the GDPR;
4. The right to restriction of processing in the cases provided for in the GDPR;
5. The right to data portability, to the extent that data is processed by automated means on the basis of consent or a contract;
6. The right to object to processing based on the Controller’s legitimate interest or on the performance of a task carried out in the public interest.

To exercise these rights, please contact the Controller or the Data Protection Officer.

Users have the right to lodge a complaint with the supervisory authority, which is the President of the Personal Data Protection Office, Stanisława Moniuszki 1A, 00-014 Warsaw, Poland.

• The repository uses only those cookies that are necessary for it to function properly (technical cookies): a cookie that keeps the user signed in, cookies that secure requests, a cookie that remembers the chosen interface language, and a cookie that stores cookie preferences. None of these requires the user’s consent under Article 399(3) of the Act of 12 July 2024 – Electronic Communications Law (Journal of Laws, item 1221).
• The repository does not use marketing or advertising cookies.
• For statistical purposes, the repository uses a local installation of the Matomo analytics tool, configured to anonymize the IP addresses of visitors by removing part of each address, to operate without cookies, and not to record the address of the page from which a user reached the repository. Because the tool processes anonymized data without using cookies, its use does not require the user’s consent.
• Separately from the above, the repository displays a privacy settings banner through which consent to the collection of statistical data can be given or withheld. Where consent is not given, no statistical data is collected. These settings can be changed at any time using the “Cookie Settings” link in the repository footer. Cookies stored on a device can also be managed through the web browser’s settings.

Although the provision of personal data is voluntary, it may be necessary in order to use particular features of the repository (in particular, creating an account and depositing material both require data to be provided) or in order to receive answers to questions.

The repository does not make decisions based solely on automated processing, including profiling, that would produce legal effects concerning a user or similarly significantly affect them.

The Controller reserves the right to make changes to this Privacy Policy. Users are informed of any significant changes by a notice posted on the repository site.

This Privacy Policy is effective from 1 September 2026.